堆栈型虚拟机代码入口点定位方法研究  

Research on locating entry point of stack-based virtual machine

作　　者：蔡瑞杰 刘胜利 林伟 刘龙 王东霞 

机构地区：[1]数学工程与先进计算国家重点实验室,郑州450001 [2]信息系统安全技术重点实验室,北京100101

出　　处：《计算机应用研究》2015年第12期3688-3692,共5页Application Research of Computers

基　　金：国家科技支撑计划资助项目(2012BAH47B01);国家自然科学基金资助项目(61271252);郑州市科技创新团队资助项目(10CXTD150);上海市科研计划资助项目(13DZ1108800)

摘　　要：在采用虚拟化技术保护的程序中定位x86代码和虚拟机代码的临界点是实现被虚拟机保护代码自动化提取和还原的前提,目前尚不存在能有效实现虚拟机代码入口点定位的方法。针对该问题,构建一个程序状态转移模型,并在此模型的基础上,提出基于栈监控的自建栈型虚拟机代码入口点定位方法和基于寄存器值聚类分析的复用栈型虚拟机代码入口点定位方法,有效解决了虚拟机代码入口点的定位问题。实验结果表明,该方法能有效实现堆栈型虚拟机代码入口点的准确定位。Locating the entry point of stack-based virtual machine in the program protected by virtualization technology is the key to restore the virtual machine protection code. Currently, there was no existing methods could reliably locate the entry point of code protected by virtual machine. To solve this problem, this paper established a program state model. Based on the model, this paper presented the method of stack-based monitoring to locate the entry point of code protected by the self-building stack VM, and also presented the method of clustering register values to locate the entry point of code protected by the reusing stack virtual machine. By this way, the problem was solved efficiently. Experimental results show that the proposed method can locate the entry point of the stack-based virtual machine code.

关 键 词：虚拟机保护 栈切换 寄存器值聚类 虚拟机入口点 状态转移 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论]