基于语义的二进制代码自动化反混淆方法  

Semantics-based binary code automated de-obfuscation approach

作　　者：郭军[1,2] 王蕾[1,2] 汤战勇[1,2] 房鼎益[1,2] 

机构地区：[1]西北大学信息科学与技术学院,陕西西安710127 [2]西北大学爱迪德物联网信息安全联合实验室,陕西西安710127

出　　处：《华中科技大学学报（自然科学版）》2016年第3期55-59,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家科技支撑计划资助项目(2013BAK01B02);国家自然科学基金资助项目(61170218;61272461;61202393);陕西省教育厅产业化培育项目(2013JC07);陕西省自然科学基础研究计划资助项目(2012JQ8049);陕西省国际合作与交流项目(2015KW-003)

摘　　要：针对已有的二进制代码反混淆方法只针对特定的混淆方法、不适用于未知的混淆方法,且代码覆盖率低的问题,提出了一种基于语义的二进制代码自动化反混淆方法,通过语义相关指令识别对混淆后程序的指令序列进行优化,能同时适用于已有的和未知的混淆方法.此外,提出了一种低开销的多执行路径构造方法,在提高代码覆盖率的同时降低了开销.实验结果表明:该方法具有较好的反混淆效果,对于恶意软件分析具有很好的辅助性作用,可有效地降低分析恶意软件的难度,提高分析恶意软件的效率.Current binary code de-obfuscation approaches only target a limited set of specific obfuscations and are ineffective against new obfuscations.State-of-the-art approaches of this problem are based on dynamic analysis and face the challenge of low code coverage.A semantics-based automated de-obfuscation approach was introduced.The key point of this approach is to optimize the instruction traces of the obfuscated program with the results of semantically relevant instruction identification,which can be applied to both existing and new obfuscation techniques.Moreover,a low-cost solution for multiple execution paths exploration was introduced.The proposed solution can enhance the code coverage and reduce the overhead at the same time.Experiment results show that the de-obfuscation approach is particularly effective and can be an invaluable aid for malware analysis.It can reduce the difficulty,and improve the efficiency of malware analysis effectively.

关 键 词：恶意软件 动态分析 语义 混淆 代码反混淆 代码覆盖率 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]