General automated shelling engine and method

Abstract

The invention relates to a general automatic shelling engine and a method for computer binary shell applying program. The system consists of a disassembling unit, a virtual execution unit, a shelling monitoring unit and a program restructuring unit. The method is that: an object program is activated in a debugging mode, the disassembling unit is used for acquiring the assembler instruction of the object program, the virtual execution unit slices and generates a corresponding basic block and executes the instruction virtually, the shelling monitoring unit detects the memory writing behavior of the object program and records all memory writing regions, the shelling monitoring unit also monitors the behavior of an object program control flow jumping to a new memory writing region and accordingly judges that the shelling process ends, and the program restructuring unit is used for collecting data of all new memory writing regions and generating an original binary program through techniques such as RAM dump, input list restructuring. The invention is suitable for quick and general shelling of an unknown shell applying program and auxiliary condition code detection method without the feature of the shell applying program and with little running load.

Description

technical field [0001] The invention relates to a general automatic unpacking engine and method for packing binary programs. The invention is used for dynamic fine-grained automatic analysis of known and unknown binary packing programs, and assists professional security personnel in analyzing and detecting characteristic codes. Background technique [0002] At present, among all kinds of malicious programs circulating on the Internet, more than 90% of the surveys have adopted the method of packing to resist the detection of traditional signature scanning. Both are generated through polymorphism / deformation packing. The packer is to compress, encrypt, and anti-track the original binary program to prevent normal detection. Because signature scanning belongs to misuse detection, it has a very high accuracy rate, but because it requires a large number of samples, this method has a relatively large false negative rate, because different packers are used to detect a binary progr...

AI Technical Summary

Problems solved by technology

At the same time, since the unpacking method of the virtual machine needs to simulate the CPU instruction set, the efficiency is very low, and the running load is relatively large when processing large batches of files.

[0005] The heuristic scanning method is a behavior detection method, which can roughly determine whether the program has been packed, but often cannot accurately determine the type of the original binary program, and cannot decompress the original binary program

Therefore, in most cases, heuristic scanning can only guess that the binary program contains malicious behavior, which has a wide range of applications, but the accuracy rate is low

Images