基于混合分析的自动化脱壳技术研究

Research on Automatic Unpacking Technology Based on Hybrid Analysis

针对当前对恶意代码自动化脱壳的研究不够充分的问题,在恶意代码静态分析和动态分析的基础上,提出基于混合分析的动态高效自动化脱壳方法。通过将动态二进制插桩与静态墒值计算相结合的混合分析方法,解决恶意代码脱壳过程中的OEP定位和导入表修复问题,提出基于混合分析的入口点OEP定位方法和基于静态指令流跟踪的导入表修复方法。最后,测试结果验证了该脱壳方法的有效性和通用性。

At present,the research on automatic unpacking of malicious code is not enough.Aiming at this problem,based on the static analysis and dynamic analysis of malicious code,this paper proposes a dynamic and efficient automatic unpacking method based on hybrid analysis.A hybrid analysis method,which combines dynamic binary instrumentation and static entropy calculation,is proposed to solve the problem of OEP location and import table repair in the process of malicious code unpacking.A hybrid analysis based on entry point OEP location method and a static instruction flow tracking based on import table repair method are proposed.Finally,the test results verify the effectiveness and generality of the method.