Instruction positioning method and device

Abstract

The embodiment of the present application discloses a command positioning method and device. A specific implementation of the method includes: determining the memory segment used by the input data or output data of the program to be analyzed; based on the memory segment, performing the following instruction positioning steps: removing the read and write permissions of the memory segment; running the program to be analyzed; responding Detect the abnormal signal of reading and writing data, and determine the position of the corresponding reading and writing instruction in the program to be analyzed. Perform read and write operations; in response to the end of the logic analysis for the read and write instructions, and it is determined that logic analysis needs to be continued, determine the source memory segment of the data in the memory segment, and continue to execute the instruction positioning step based on the source memory segment. This implementation mode has the characteristics of accurate positioning without omission, fast and efficient, simple operation, no environment configuration or dependence, and can be completed synchronously during analysis without affecting analysis efficiency.

Description

technical field [0001] The embodiments of the present application relate to the field of computer technology, and in particular to a method and device for locating instructions. Background technique [0002] Currently, mobile App security protection technologies are developing rapidly, among which code obfuscation, as the most widely used and most versatile technology, has become a protection strategy that must be added to every application. [0003] For example, the principle of ollvm obfuscation technology is based on the llvm compiler, which directly expands and obfuscates the native layer assembly instructions. By adding a large number of invalid jumps and code fragments, obfuscating all function names and variable names, the instruction set in a single function may expand dozens of times after obfuscation, and based on the characteristics of the llvm compiler, the obfuscated function flow will also be greatly optimized. However, both obfuscation and optimization will n...

AI Technical Summary

Problems solved by technology

The design of the sandbox and the configuration of the internal experimental environment in the early stage are relatively complicated, and the application support of the sandbox is a major problem of this technology. To a certain extent, it supports the simplification of the algorithm of some apps.

To sum up, the actual operation process of this method is complicated, the environment dependence is serious, and the application support is not high.

Images