2025年看雪第九届安全开发者峰会：ReCopilot：基于大模型的二进制逆向工程助手

ReReCopilot:基于大模型的二进制逆向工程助手陈国强奇安信技术研究院Summary&Summary&DiscussionDatabuildingDatabuildingBinarySFTdPretraindataPretraindatarecopilot-baserecopilot-baserecopilot-dpoBasemodelworldknowledgemathematicsreasoningcodingidentity1.现成的软件包:带有调试信息和源代码1.现成的软件包:带有调试信息和源代码2.交叉编译:Cross-Arch,Cross-Opti,Cross-Compiler,Cross-Platform3.AutoCompiler:Ad-hocSoftPPCODEllFunctionNameRecovery<funcname>lFunctionSignatureRecovery<signature><signature-str>lVariablesRecovery<vars>lArgumentsRecovery<args>lVariableRecovery<var:var_name>lArgumentRecovery<arg:arg_name>lAlgorithmIdentification</algorithm>lBriefSummary<summary-brief-cn><summary-brief-en>lSummary</summary-cn></summary-en>lBinaryFunctionAnalysis<func-analysis>lDecompilation<decompilation><context<context-pseudocode>{context}</context-pseudocode><pseudocode>{target_func}</pseudocode><Call-Chains>{call_chains}</Call-Chains><Data-Flow>{data_flow}</Data-Flow>AnalysisTaskTag:{task_tag}<Thought>Thinking...</Thought><Output>JSONFormat</Output>Generator-Discriminator(persona-drivendatasynthesis)G-ParserBaddataBuildingLoopInputOutputSourcecodeMetainfoD-ParserD-ParserStep(-N)GuideAssembleAssemble目标:提升输出格式遵循能力&增强推理逻辑一致性目标:提升输出格式遵循能力&增强推理逻辑一致性D-D-Parser<…Step(-N)GuideStepCoTG-ParserBuildingLoopSourcecodeMetainfoInputOutputBaddataD-ParserDPO★AssembleAssembleTool-level BinaryFunctionrecopilotrecopilot-embeddingUserQueryTripletLossTripletLossEmbeddingEmbeddingReCopilot-Agent:CodeReCopilot-Agent:CodeEmReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudy``````ReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudyReCopilotReCopilot-Agent:CaseStudy★···ReCopilotReCopilot-Agent:CaseStudyQQReCopilotReCopilot-Agent:CaseStudyQQnotifynotify_rc(constchar*cmd_str)[EXPORT].notify_rc_service(cmd_str,0,15u);.j_logmessage_normal("rc_service","%s%d:notify_rc%s",...);.logmessage_normal(flag,fmt);.vsnprintf(msg,0x200u,fmt,varg_r2);ReCopilotReCopilot-Agent:CaseStudyB.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.####RCEExploitationStrategyPOST:action_mode=install&apps_name=AAAA&apps_flag=<GOT_A