反编译中的库函数识别技术研究  

Study of library functions identification in decompilation

作　　者：秦艳锋 王清贤 曾勇军 奚琪 

机构地区：[1]数学工程与先进计算国家重点实验室,郑州450001 [2]洛阳外国语学院语言工程系,洛阳471003

出　　处：《东南大学学报（自然科学版）》2012年第A02期256-260,共5页Journal of Southeast University：Natural Science Edition

基　　金：国家高技术研究发展计划(863计划)资助项目(2012AA012902)

摘　　要：为提高反编译过程的整体效率,研究了静态库函数和动态库函数识别技术.结合静态库函数识别的难点,对比分析了面向对象和面向过程2类语言代码对函数识别的影响;结合标准库、专业库和用户库各自的编制方式及特点,对静态库函数的识别模型及其中涉及的一些关键技术,如函数特征的选择、提取与存储、函数识别预处理和特征模式匹配等进行了分析,并且对库函数特征选取、函数模块识别等重要问题给出了应用实例或算法.根据动态库的特点,对使用了一般调用方式和特殊调用方式的动态库函数识别方法进行了简要的分析与论述.最后对库函数识别技术进行了分析总结与展望,对进一步提升程序逆向分析的效果和效率有着重要的参考价值.In order to improve the overall efficiency of decompilation, the identification technology of static and dynamic library functions is studied. First, combined with the identification difficulties of static library functions, the effect of two types code of the object-oriented and process-oriented language is contrastively analyzed. Combined with the respective characteristics of standard libraries, professional libraries and user libraries, the identification model of static library functions and some involved key technologies, such as selection, extraction and storage of function features, the prepro- cessing of function identification and pattern matching, are analyzed and discussed. An algorithm and some applied examples are also given for some important problems in the function feature extrac- tion and the function identification. Secondly, according to the characteristics of the dynamic library, which use the common call mode and the special call mode, the identification technology is briefly studied. Finally, the identification technology of the static and dynamic library functions is summarized, which has important reference value for further enhancing the effectiveness and effi- ciency of the program reverse analysis.

关 键 词：函数识别 库函数 静态库 动态库 模式匹配 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]