基于特征值的模板化库函数识别  

Recognition of Template Library Functions Based on Features

作　　者：汪玮[1] 陈凯明[1] 

机构地区：[1]中国科学技术大学计算机科学与技术学院,合肥230027

出　　处：《计算机系统应用》2012年第8期52-56,共5页Computer Systems & Applications

摘　　要：逆编译是编译的逆过程,目的是将可执行的二进制机器代码变换为功能等价的高级语言代码,它在监控恶意代码,挖掘软件漏洞的工作中起着重要的作用。而在面向对象语言的逆编译过程中,模板化库函数识别的难度和复杂性非常大。通过分析现有的C++库函数识别方法,针对库函数模板识别中特征值冲突的关键问题,提出一种改进的特征值构造方法,它能够更完整的保存库函数信息,降低特征值冲突出现的概率,并通过识别部分C++标准模板库函数验证了该算法。The decompilation decode binary instructions and data into high level source code against compllanon, it plays an important part in finding malware and discovering software vulnerability. But the recognition of template library functions is very difficult in decompilation of object-oriented language. This paper analyzes the existing algorithm of library function recognition and aims at the key problem of feature conflicts to introduce an improved algorithm based on feature-recognition. This algorithm can store much more library function informations to avoid feature conflicts and has been verified in some experiments about C＋＋ STL recognition.

关 键 词：逆编译 模板 库函数 识别 

分 类 号：TP314[自动化与计算机技术—计算机软件与理论]