Method for recognizing malicious codes in host software after infection by malware

Abstract

A method for recognizing malicious codes in host software after infection by malware comprises steps as follows: firstly, disassembling codes of the host software are acquired with a recursive descent disassembling method, wherein disassembling codes corresponding to a machine instruction, various citation information in the codes and import table function information are required to be acquired; then, breaking points among code sequences are determined according to the citation condition, and a code sequence between two breaking points forms a code block; then, merging is performed according to the relationship of adjacent code blocks; the longest code block sequence which doesn't employ an import table function is sought according to the import table function use condition; finally, a starting software block and an ending software block of malicious codes are determined according to the calling relation between the malicious codes and host software codes, and accordingly, a required malicious code sequence is obtained. The method can be taken as a universal method for recognizing malicious codes in the host software, and specific code position information is provided for further restoration of the software.

Description

technical field [0001] The invention belongs to a method for identifying computer malicious codes, in particular to a method for identifying malicious codes injected into infected host software. Background technique [0002] Under the Windows platform, many malware inject valid code into normal files through infection techniques. Malware will inject some files in batches through infection techniques. For example, some WIN32 computer viruses will traverse files in the current directory or the system directory, and inject malicious codes into all PE files that meet the infection conditions; some malware will Infect some key or commonly used system files, such as explorer.exe of Windows system, commonly used .dll files, greatly increasing the chance of malicious code being executed. It would be very expensive to detect all these files and handle them correctly. [0003] For most of the executable files in PE (Portable Executables) format under the Windows platform, the system...

AI Technical Summary

Problems solved by technology

In terms of calling system functions, the original code will directly fill in the relevant functions in the corresponding dynamic link library into the import table during compilation, and the functions in the import table can be directly called through the call instruction; while the injected code is difficult to know in advance The logical address of the functions in the import table, so these functions cannot be called directly

Images