ArchInfer: An Automatic Protocol Format Inference Algorithm Based on Dynamic Program Analysis
摘要
Protocol reverse engineering is crucial in the face of numerous unknown protocols on the Internet. However, conventional protocol reverse engineering relies heavily on manual analysis, which is both inefficient and time-consuming. This paper proposes ArchInfer, a novel approach to infer the message field types of protocol terminal programs based on execution traces. We first introduce the concepts of logical locations and logical variables, and propose classification criteria for machine instructions. On this basis, we present the ArchInfer algorithm, which performs different operations based on instruction types to infer the types of logical variables. Experimental results using open-source terminal programs demonstrate that ArchInfer outperforms existing methods in both the accuracy and completeness of inferred message field types.