Binary program analytic system based on process simulation

Abstract

The invention discloses a binary program analytic system based on process simulation, belonging to the technical field of electronic data monitoring. The binary program analytic system comprises a simulator engine module, a memory management module, a process management module, a system call interface, a thread management module, a central processing module and an analytic component interface for providing an application program interface, wherein the simulator engine module is respectively connected with the memory management module, the progress management module, the system call interface and the analytic component interface; the progress management module is respectively connected with the memory management module, the central processing module and the system call interface; and the thread management module is respectively connected with the memory management module, the thread management module and the central processing module. The binary program analytic system does not depend on static reverse analysis carried out on a program, but adopts a completely dynamic analytic method, so that most of influences caused by a program protection technology can be avoided.

Description

technical field [0001] The invention relates to a system in the technical field of electronic data monitoring, in particular to a binary program analysis system based on process simulation. Background technique [0002] In the field of computer security, the reverse analysis of various software, especially malicious programs, is the basic work of program security analysis. Due to the lack of relevant semantic information, the reverse analysis of binary programs is often very difficult and requires a lot of manpower and material resources. Therefore, in order to assist analysts in reverse analysis, corresponding automated program analysis methods and analysis platforms have emerged as the times require. [0003] In order to realize automatic program analysis, it is necessary to monitor the instruction flow, control flow and data flow of the program in a fine-grained manner, and at the same time, it is necessary to obtain relevant information such as the processor and memory ...

AI Technical Summary

Problems solved by technology

But the defect and deficiency of this technology compared with the present invention are: first, this technology relies on static reverse analysis, and the widespread use of current software protection technology makes analysts often unable to carry out effective static analysis, so from many current programs In particular, it is difficult to extract static analysis results from malicious programs; second, the analysis method of this technology can only detect the abnormal operation of the program and analyze possible vulnerabilities, but cannot detect the potential malicious attacks of the program, especially Various attack methods such as ROP (Return-Oriented Programming) emerge in an endless stream. This technology cannot detect the vulnerabilities in the program that can be exploited by this type of attack. Third, in the current dynamic code execution is widely used In some cases, such as Plugin, User Scripting, Just-in-time Compilation, etc., this technology cannot effectively analyze such dynamically generated or loaded code, so it further limits its Analysis range

Images