一种基于全系统仿真和指令流分析的二进制代码分析方法

Approach of binary code analysis based on full-system emulation and instruction-flow analysis

提出了一种基于全系统仿真和指令流分析的二进制代码分析方法,该方法核心思想是在一个全系统仿真虚拟机上执行二进制代码,通过截获并分析二进制代码运行时产生的指令流信息,分析程序行为特征。基于该方法,设计并实现了一个二进制代码分析系统。实验结果表明,通过该系统捕获并分析指令流,能够更为高效全面地提取出代码执行过程中产生的各类信息。对于使用抗分析技术手段的二进制代码,该分析方法很有效果。

This paper proposed an approach of binary analysis based on full-system emulation and instruction-flow analysis technology.This approach ran executable binary code on a virtual machine which used full-system emulation technology,and then captured and analyzed runtime instruction-flow information to figure out this program＇s feature.This paper covered design and implement of such a binary code analysis system.Experiment result illustrates that it is more efficient and general to capture,extract and analyze runtime instruction-flow information by using this system.This approach is particularly effective to analyze binary code which uses anti-analysis technology.