基于API Hooking勒索软件WannaCry的解密方法  

An approach to decrypting ransomware wannacry based on api hooking

作　　者：郭春生 程光[1] Guo Chun-sheng;Cheng Guang(Key Laboratory of Computer Network and Information Integration, Ministry of Education, School of Computer Science and Engineering, School of Cyber Science and Technology, Southeast University, JiangsuNanjing 211189)

机构地区：[1]东南大学计算机网络和信息集成教育部重点实验室计算机科学与工程学院网络空间安全学院,江苏南京211189

出　　处：《网络空间安全》2018年第1期8-14,共7页Cyberspace Security

基　　金：国家重点研发计划:SDN/NFV与NDN安全研究(项目编号:2017YFB0801703);国家自然科学基金青年基金:基于网络编码的信息中心网络研究(项目编号:61602114)支持

摘　　要：勒索软件WannaCry的肆意扩散对网络用户造成了极大的危害,如何能够防范和解密WannaCry是目前的热点研究问题。为了实现对勒索软件WannaCry的解密,论文提出了基于API hooking的解密方法去恢复受害者的文件数据。首先,研究了WannaCry病毒执行时的详细加解密流程,发现其使用的加解密API函数;其次,针对这些加解密API函数实现Hook,使用自定义的钩子函数记录下密钥信息;最后,实现原型系统,监控操作系统中所有的进程。一旦勒索软件WannaCry感染主机,原型系统记录下勒索软件WannaCry使用的密钥信息,以此来完成文件的解密,结果表明系统能够完全的实现对勒索软件WannaCry的解密。Recently,the wanton outbreak of ransomware WannaCry caused great harm to the network users.How to prevent and decrypt ransomware WannaCry is a hot research issue at present.In order to implementthe decryption of ransomware WannaCry,we proposes a novel method based on API hooking to decryptand free the damaged data.Firstly,we study the encryption and decryption process of WannaCry virus and find the encryption/decryption API functions used by WannaCry.Secondly,performing API hooking for key operations,records key information with the customized hook functions.Finally,implementing the prototype system and monitoring all the processes in the operating system.When WannaCry infected the host computer,the prototype system recorded the key information to complete the decryption of the files.The result shows that the system can be effectively used to mitigate users from the damages caysed by WannaCry.

关 键 词：APIHooking 勒索软件 WannaCry 解密 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]