针对指令重叠混淆技术的恶意代码反汇编研究  

Reasearch on the Disassembly Against the Malcode with Instruction Overlapping Obfuscation

作　　者：戴超[1,2] 庞建民[1,2] 梁光辉[1,2] 白虹[1,2] 张啸川[1,2] 陈茜月 

机构地区：[1]中国人民解放军信息工程大学,郑州450000 [2]数学工程与先进计算国家重点实验室,郑州450000

出　　处：《小型微型计算机系统》2016年第9期1975-1979,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金面上项目(61472447)资助

摘　　要：为了规避反病毒检测,恶意代码普遍采用混淆技术对抗检测技术.指令重叠是一种恶意代码开发者广泛应用的一种混淆技术,能够有效对抗静态分析.对指令重叠混淆技术的原理进行了分析,将指令重叠混淆分为jump-current型、jump-backward型以及jump-forward型,进而设计一种改进的行进递归反汇编算法.该算法基于控制转移指令的类型、控制转移指令的转移方向、指令重叠的地址范围实现了对指令重叠混淆技术正确识别.通过实验,本文提出的算法能够有效检测识别采用指令重叠混淆技术的恶意代码,进而提高了反汇编分析的准确性,同时未对执行效率产生显著影响.In order to evade the detection of anti-virus system,malware writers resort to obfuscation technology to resist the detection technolgy. Instruction overlapping is an effective method to confuse the process of static analysis ,which is used by malware authors at large. This paper analyzes the principles of instruction overlapping. It divides instruction overlapping into 3 categories, including jump- current,jump-backward and jump-forward. Then this paper proposes an improved recusive traveral algorithm. The algorithm could i- dentify the instruction overlapping based on the type,the direction of control-tranfer instruction and the range of overlapping instruc- tions. The test validates the effectiveness of the algorithm proposed in this paper, which could improve the accuracy of disassemble fur- ther without deteriorating the performance of algorithm remarkably.

关 键 词：恶意代码 指令重叠 混淆 反汇编 行进递归 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]