摘要
传统的逆向分析方法在分析多进程架构软件时具有较多难以克服的困难,针对这个问题提出了基于TEMU的进程间通信过程逆向方法。利用动态二进制分析平台TEMU记录多进程程序函数调用信息,结合进程间通信函数的关联规则从函数调用信息中提取进程间通信的通信方法、通信数据和通信协作机制。根据该方法设计并实现了一个原型系统,对多款多进程架构软件进行测试,测试结果表明,该方法能够准确提取多进程架构软件的进程间通信过程,对多进程架构软件逆向起到了很大的辅助作用。
Due to some difficulty in analysis of multi-process software with custom reverse method,this paper presented the reversing of inter-process communication based on TEMU.Record functions called information in multi-process software with dynamic binary analysis platform TEMU,combined with functions correlation to extract the method,data and mechanism of inter-process communication.This paper designed and realized a model,and tested it with several multi-process software.The results show that this method can extract inter-process communication procedure correct,plays an important role in reversing of multi-process software.
出处
《计算机应用研究》
CSCD
北大核心
2013年第7期2091-2095,共5页
Application Research of Computers
关键词
进程间通信
动态二进制分析
软件逆向
函数关联
inter-process communication
dynamic binary analysis
software reverse
functions correlation
