基于不透明谓词的软件抗动态逆向分析研究  

Research on software anti-dynamic reverse analysis based on opaque predicate

作　　者：韩翔宇[1] 李强[1] 黄海军[1] 余祥[1] 

机构地区：[1]合肥电子工程学院,合肥230037

出　　处：《计算机应用研究》2017年第8期2422-2428,共7页Application Research of Computers

基　　金：技术基础条件建设项目(72131022);电子工程学院科研基金资助项目(KY15N639)

摘　　要：传统的不透明谓词对谓词内部逻辑结构进行复杂化,难以有效应对软件的动态逆向分析。通过插入运行环境检测代码并将检测结果返回给不透明谓词,动态选择分支路径使软件仅在安全环境下运行被保护代码,防止代码被动态分析。引入一般和关键节点概念,提高谓词内部逻辑结构的复杂度,并使用形式化方法进行描述。实验证明,成功检测出虚拟机和调试器并避开了受保护代码;在静态指令统计上与使用变形隐匿的方法对比,具有更好的隐匿效果。Traditional opaque predicate aims at complex the internal construction of predicate which cannot deal with dynamic analysis. This paper proposed to return the result of condition checking to the predicates to limit the software running the pro- tected code only in the safe environment, which kept the code away from dynamic reverse analysis. This paper introduced the concept of key point and normal point to increase the complexity of the opaque predicate and describe it with formalized language. Experimental result shows that proposed method finds the debugger and the virtual machine successfully and shows a better result in the statistics compared with instructions transformation.

关 键 词：不透明谓词 代码混淆 抗逆向分析 软件保护 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]