Apparatus and method for exuviations of file

Abstract

The invention relates to a device and a method used for exuviating a file. The device comprises a virtual machine used for simulating a real computer; a controller used for detecting the shell type of the file; and an exuviating module used for confirming a code needed to be executed in the real computer in the exuviating process of the file based on the type of the detected shell; wherein, the virtual machine executes the rest codes except the confirmed code in the exuviating procedure of the file; the exuviating module executes the confirmed code in the real computer. The device and the method can be used to fast exuviate the file.

Description

technical field [0001] The invention relates to computer virus antivirus, in particular to a device and method for unpacking files. Background technique [0002] The rapid development of computer and network technology has greatly promoted information exchange. At the same time, computer viruses are constantly evolving and updating along with the development of technology. From the early prank games to today, computer viruses have seriously threatened people's normal use of computers. Thus, how to prevent virus attack has become a focus of attention. [0003] An important step to prevent virus attack is to identify the files with virus before the virus runs, that is, to check the virus, so as to take corresponding measures to contain it from invading the computer system. The current anti-virus software generally uses a virus checking method to match a signature string method. That is to say, use the feature string (one or more specific binary code streams) extracted from ...

AI Technical Summary

Problems solved by technology

[0008] First, some virus files are usually packed by complex and time-consuming compression algorithms or encryption algorithms, so when a conventional virtual machine unpacks such packed virus files, it takes a lot of time to unpack them. Compress or decrypt data, resulting in a long execution time for unpacking, which affects the entire virus checking process

Taking the LZPack shell as an example, because it uses the LZMA algorithm with a relatively large compression rate to compress files when packing, when the virtual machine unpacks the file with the LZPack shell, it decompresses 300K data (after decompression, it is about 1MB or so) takes about 12-15 seconds, which will greatly affect the entire virus screening process

[0009] Second, some more complex shells often insert some codes for detecting debuggers such as API breakpoint detection, debugger detection and single-step exception detection in their shelling programs

Since the virtual machine is essentially a debugger, and the process of unpacking the packed file by the virtual machine is essentially a debugging process, so when the unpacking program detects that it is unpacking in the virtual machine during execution, its It will exit the unpacking process, which increases the difficulty of unpacking the virtual machine

Images