用户态反调试检测模型  

User-level anti-debugging detection model

作　　者：颜瑞彬 高见[1,2] 李天洋 YAN Rui-bin;GAO Jian;LI Tian-yang(School of Information Network Security,People’s Public Security University of China,Beijing 100038,China;Key Laboratory of Safety Precautions and Risk Assessment,People’s Public Security University of China,Beijing 102623,China)

机构地区：[1]中国人民公安大学信息网络安全学院,北京100038 [2]中国人民公安大学安全防范与风险评估公安部重点实验室,北京102623

出　　处：《计算机工程与设计》2023年第8期2280-2288,共9页Computer Engineering and Design

基　　金：公安部科技强警基础工作专项基金项目(2022JC01)。

摘　　要：当前反调试技术在软件保护领域备受重视,与此同时,越来越多的用户态程序利用该技术来对抗逆向分析。利用特征值匹配和Pin插桩技术,提出一种用户态反调试检测模型。模型中通过插桩计算call指令和ret指令的一致性,初步筛选出包含反调试机制的程序,设计基于IDC和基于机器码的反调试检测算法对程序的汇编代码进行检测。实验结果表明,反调试技术检测模型可以准确确定反调试类型并定位反调试技术的位置,在大量使用反调试技术的程序中具有较高的准确率。At present,anti-debugging technology is highly valued in the field of software protection.At the same time,more and more user-level programs use this technology to resist reverse analysis.A user-level anti-debugging detection model was proposed based on matching and Pin instrumentation technologies.The program containing the anti-debugging mechanism was preliminarily screened out by calculating the consistency of the call instruction and the ret instruction by instrumentation,and anti-debugging detection algorithms based on IDC and machine code were designed to detect the assembly code of the program.Experimental results show that the anti-debugging technology detection model can accurately determine the anti-debugging type,locate the position of the anti-debugging technology,and has a high accuracy rate in the programs using a large number of anti-debugging technologies.

关 键 词：反调试技术 用户态程序 网络安全 逆向分析 反调试检测 恶意程序 软件保护 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]