逆向分析技术在电子数据司法鉴定中的应用

Application of Reverse Engineering in Digital Forensic

电子数据司法鉴定需要确定破坏性程序(如木马)的行为、窃取信息的发送方向、传播机理。而软件逆向分析通过对目标程序"反编译"或"反汇编"的方法,分析目标程序的功能、结构、处理流程。本文介绍了软件逆向分析的基本概念和常用工具以及软件逆向分析的基本方法,并用实例讲述了软件逆向分析在电子数据司法鉴定中的应用。

In some cases of digital forensic,such as malware's analysis.We need to determine the malware's behavior.For example,how it send the stolen information and spread.Through the reverse engineering,we may decompile or disassemble those malware to analyze the program's function,structure,processes.This paper introduces the basic concepts and commonly used software tools of reverse engineering.Described with an example of reverse engineering in digital forensic.