一种基于中断处理机制的动态反汇编算法  

Algorithm for Dynamic Disassembly Based on Interrupt Scheme

作　　者：杨慕晗[1] 

机构地区：[1]中国科学院研究生院信息安全国家重点实验室,北京100049

出　　处：《计算机科学》2008年第12期280-284,294,共6页Computer Science

摘　　要：传统的反汇编是静态进行的,它难以处理逻辑陷阱、花指令、代码中的数据、动态控制流等问题,这就导致其最终的反汇编结果可能不完整,存在错误。一段特意设计的代码,可以用动态控制流替代静态控制流;一段特意设计的花指令,可以让静态控制流关系任意复杂,这都将使静态反汇编分析难以进行。让代码运行起来,动态地进行反汇编,可以解决上述静态反汇编遇到的问题。结合计算机的中断处理机制,使得代码的实际执行路径是可知的。针对实际执行到的计算机指令进行反汇编,确保了反汇编结果的准确性;反复执行代码,在时间上进行积累,可以确保反汇编结果的完整性不断增加并趋于完整。Disassembly is done statically, usually. It is hard to deal with logic trap, deceiving-instruction, data-in-code, dynamic control-flow-instruction, etc. by static disassembly. On the other hand, the code can be specially designed using dynamic control-flow-instruction instead, or with logic trap and deceiving-instruction, which both can make the static disassembly and analyzing impossible. Working with the interrupt scheme, disassembly can be done dynamically. The instructions executed exactly can be traced and disassembled. Following this method, all instructions disassembled are correct. Meanwhile, code can be run repeatly, and more code, finally almost all, will be processed.

关 键 词：反汇编 逆向工程 信息安全 

分 类 号：TP316.7[自动化与计算机技术—计算机软件与理论] TP313[自动化与计算机技术—计算机科学与技术]