Self-modifying code identification method based on hardware emulator

Abstract

The invention belongs to the technical field of software security measurement and evaluation, especially relates to a self-modifying code recognition method based on a hardware simulator. The invention is provided with a marker in the hardware simulator in order to only execute a target executable file by one step and capture a virtual system execute instruction, the information in the process can be executed by using a shadow memory monitoring program, the code which is dynamically released into the memory and is executed can be recognized and executed in the course of program execution, so that data information of the analysis target can be acquired. The data acquisition of the invention is implemented by the simulation hardware, is not executed by placing the malevolence code on a true CPU, so the actual system can not be affected. The invention adopts the hardware simulator as a dynamic analysis platform, which can improve the transparency between the analysis platform and the code and can effectively defend against the detection of the code.

Description

technical field [0001] The invention belongs to the technical field of software safety evaluation, and in particular relates to a hardware simulator-based self-modifying code identification method. Background technique [0002] Self-modifying code (Self-Modifying Code, SMC) means that the code intentionally modifies its own code during execution, so that the actual running code is different from the static binary representation before execution, so as to hide information such as instructions and program execution flow. [0003] SMC is one of the technologies that can effectively resist static reverse analysis. It is widely used in the fields of software protection and malicious code. Increase the difficulty of reverse analysts' program analysis and understanding of protected code. [0004] Compared with the dynamic analysis method, the static analysis method has obvious advantages in terms of analysis comprehensiveness, etc., and it is still the most important code analysis...

AI Technical Summary

Problems solved by technology

However, with the increasing perfection and widespread use of anti-reverse analysis techniques such as SMC, the analysis ability of static analysis methods is subject to more and more constraints.

For the code protected by SMC technology, the actual executed code is often inconsistent with the static binary representation, so static analysis is almost powerless

Images