程序自动脱壳数据采集技术研究  

Research of data acquisition technology in program automatic unpacking

作　　者：曾勇军[1] 朱俊虎[1] 奚琪[1] 

机构地区：[1]信息工程大学信息工程学院,郑州450002

出　　处：《计算机应用》2009年第3期813-816,共4页journal of Computer Applications

摘　　要：自动提取加壳程序隐藏的代码和数据是目前恶意代码检测技术面临的重要问题。分析了加壳程序运行的本质特征,给出了存储器监控算法和动态基本块标记算法,描述了基于QEMU仿真器的程序自动脱壳数据采集系统的设计思路。实验结果表明,该系统可以有效地提取被加壳程序的代码和数据,完整地记录程序脱壳的执行行为。The hidden code and data extraction of packed program is an important issue of malware detection technology.The running characteristics of packed program were analyzed,the memory monitoring algorithm and dynamic identification algorithm of basic block were given,and the data acquisition system of program automatic unpacking based on QEMU emulator was described.Testing results show that the code and data of original program can be extracted,and executable behavior of program unpacking can be recorded.

关 键 词：脱壳 QEMU仿真器 数据采集 基本块 

分 类 号：TP274.2[自动化与计算机技术—检测技术与自动化装置]