摘要
针对当前对恶意代码自动化脱壳的研究不够充分的问题,在恶意代码静态分析和动态分析的基础上,提出基于混合分析的动态高效自动化脱壳方法。通过将动态二进制插桩与静态墒值计算相结合的混合分析方法,解决恶意代码脱壳过程中的OEP定位和导入表修复问题,提出基于混合分析的入口点OEP定位方法和基于静态指令流跟踪的导入表修复方法。最后,测试结果验证了该脱壳方法的有效性和通用性。
At present,the research on automatic unpacking of malicious code is not enough.Aiming at this problem,based on the static analysis and dynamic analysis of malicious code,this paper proposes a dynamic and efficient automatic unpacking method based on hybrid analysis.A hybrid analysis method,which combines dynamic binary instrumentation and static entropy calculation,is proposed to solve the problem of OEP location and import table repair in the process of malicious code unpacking.A hybrid analysis based on entry point OEP location method and a static instruction flow tracking based on import table repair method are proposed.Finally,the test results verify the effectiveness and generality of the method.
作者
徐旭
XU Xu(State Key Laboratory of Mathematical Engineering and Advanced Computing, Information Engineering University, Zhengzhou 450001, China)
出处
《信息工程大学学报》
2020年第1期55-60,67,共7页
Journal of Information Engineering University
关键词
混合分析
脱壳
OEP定位
导入表修复
hybrid analysis
unpacking
OEP location
import table repair
