反汇编过程中call指令后混淆数据的识别  

Identification of Obfuscated Data After call Instruction in Disassembly Process

作　　者：岳峰[1] 庞建民[1] 赵荣彩[1] 白莉莉[1] 

机构地区：[1]信息工程大学信息工程学院,郑州450002

出　　处：《计算机工程》2010年第7期144-146,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA01Z408)

摘　　要：恶意程序往往使用各种混淆手段来阻碍静态反汇编,call指令后插入数据便是常用的一种,对该方式的混淆进行研究,提出一种有效的识别call指令后混淆数据的方法。该方法基于改进的递归分析反汇编算法,分两阶段对混淆进行处理。经测试验证,该方法可有效地对此种混淆做出判断,提高反汇编的准确性。A number of obfuscation techniques are used to foil thc static disassembly process by malware, in which embedding obfuscated data after call instruction is the most common style. This paper presents a detection arithmetic that can abstract the obfuscated data accurately after the call instruction. Based on improved recursive traversal disassembly arithmetic, this method can handle this style of obsfuscation in two phases. A test report is provided to prove the effect of this arithmetic.

关 键 词：静态反汇编 代码混淆 恶意代码 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]