Windows应用层反调试详述  

Elaboration of Anti-Debugging Technology in the Application Layer of Windows

作　　者：李庆 LI Qing(CETC Cyberspace Security Technology Co.,Ltd.,Chengdu Sichuan 610095,China)

机构地区：[1]中电科网络安全科技股份有限公司,四川成都610095

出　　处：《信息安全与通信保密》2023年第4期73-82,共10页Information Security and Communications Privacy

摘　　要：从Computer Usage Corporation公司(世界上第一个专门从事软件开发和服务的公司)诞生至今,软件产业经历了几十年的快速发展,越来越多的人依赖各式各样的软件工作和生活。商业软件本身所蕴含的巨大价值以及人们对知识产权保护观念的淡薄,导致了许多破解商业软件的行为发生,比如盗版、数据篡改等,而大多数不法行为基本都会依赖各种调试工具来完成。以防止软件被破解,检测逆向分析调试工具为研究目的,分析了目前在Windows系统中调试工具广泛存在的固有特征和其所用到的技术,并对现有的反调试方法进行总结,对Windows系统应用层中调试器的检测,提升软件自身反调试、防破解能力具有较为重要的意义。The software industry has experienced the rapid development for dozens of years since the birth of Computer Usage Corporation(the world’s first company specialized in software development and service),and more and more people are relying on various software to work and live.Many commercial software decoding behaviors,such as piracy and data modification,etc.occur because of the huge value inherent in commercial software and people’s weak awareness of the intellectual property protection,and most of the illegal behaviors are completed by relying on various debugging tools.This paper studies the detection of reverse analysis debugging tools,analyzes the widely used inherent characteristics and applied technologies in Windows systems,and summarizes the existing anti-debugging methods to prevent the decoding of software,which is of great significance for the detection of debuggers in the application layer of Windows systems and the improvement of the software’s anti-debugging as well as the decoding capacities.

关 键 词：反调试 调试器 软件防护 逆向工程 防破解 壳 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]