Method for attacking software protection virtual machine based on fuzzy clustering

Abstract

The invention discloses a method for attacking a software protection virtual machine based on fuzzy clustering. The method comprises the following steps of 1) selecting a program segment protected by the software protection virtual machine, and performing disassembling processing on a program by adopting a disassembling engine; 2) extracting a program execution stream, putting the program into OllyDbg for execution to a program ending position, and recording all instructions executed by the protected program and a state of a register after instruction execution through using OllyScript; 3) analyzing a data stream file generated in the step 2), extracting Handlers, and performing cutting by adopting a recursion scheme; 4) extracting eigenvalues of the Handlers by adopting an N-Perm algorithm; 5) performing clustering on the Handlers by adopting a fuzzy clustering algorithm according to eigenvalue correlativity; and 6) obtaining a clustering result, analyzing semanteme of the clustering result, importing the semanteme for analyzing the program segment, and giving out a flow chart of the protected program, thereby realizing attack to the software protection virtual machine. According to the method, a foundation is laid for later research on automatic attack to the software protection virtual machine.

Description

technical field [0001] The invention relates to computer technology, in particular to a fuzzy clustering-based software protection virtual machine attack method. Background technique [0002] Software protection for virtual machines is currently the software protection solution with the highest protection intensity. When analyzing the program protected by the software protection virtual machine, there are usually the following two solutions. The first is complete manual restoration, that is, using the traditional reverse thinking of looking at the process statically and looking at the data dynamically, put the program into IDA and OllyDbg for execution, execute it step by step, analyze each instruction repeatedly, and finally crack the program. The disadvantage of this idea is that it is time-consuming and labor-intensive, especially for a protection scheme with high protection intensity such as software protection virtual machine, it is not practically operable. The secon...

AI Technical Summary

Problems solved by technology

The disadvantage of this idea is that it is time-consuming and labor-intensive, especially for the protection scheme with high protection intensity such as software protection virtual machine, it is not actually operable

The disadvantage of this idea is that it has high requirements on the structure of the virtual machine and is not universal.

Images