Apparatus and method for exuviations of file

Abstract

The invention relates to a device and a method used for exuviating a file. The device comprises a virtual machine used for simulating a real computer; a controller used for detecting the shell type of the file; and an exuviating module used for confirming a code needed to be executed in the real computer in the exuviating process of the file based on the type of the detected shell; wherein, the virtual machine executes the rest codes except the confirmed code in the exuviating procedure of the file; the exuviating module executes the confirmed code in the real computer. The device and the method can be used to fast exuviate the file.

Description

technical field

[0001] The invention relates to computer virus antivirus, in particular to a device and method for unpacking files. Background technique

[0002] The rapid development of computer and network technology has greatly promoted information exchange. At the same time, computer viruses are constantly evolving and updating along with the development of technology. From the early prank games to today, computer viruses have seriously threatened people's normal use of computers. Thus, how to prevent virus attack has become a focus of attention.

[0003] An important step to prevent virus attack is to identify the files with virus before the virus runs, that is, to check the virus, so as to take corresponding measures to contain it from invading the computer system. The current anti-virus software generally uses a virus checking method to match a signature string method. That is to say, use the feature string (one or more specific binary code streams) extracted from ...

Examples

Embodiment Construction

[0026] The core idea of ​​the present invention is: at first detect the shell type of the file that has been packed, then according to the detected shell type, determine the code ( For example, code that uses time-consuming compression or encryption algorithms to decompress or decrypt data), and code that requires the virtual machine to skip execution or that the virtual machine executes but modifies the execution result to represent that the unpacker executes on a real computer Specific codes (for example, features and functions that are not supported by the code of the debugger, etc.), finally, execute the determined code that needs to be executed in the real computer in the real computer and execute the unpacking program on the virtual computer except for the The rest of the code that is determined to be executed in the real computer, and, in the virtual machine, skip the specific code in the sheller that requires the virtual machine to skip or execute the specific code in t...

technical field

[0001] The invention relates to computer virus antivirus, in particular to a device and method for unpacking files. Background technique

[0002] The rapid development of computer and network technology has greatly promoted information exchange. At the same time, computer viruses are constantly evolving and updating along with the development of technology. From the early prank games to today, computer viruses have seriously threatened people's normal use of computers. Thus, how to prevent virus attack has become a focus of attention.

[0003] An important step to prevent virus attack is to identify the files with virus before the virus runs, that is, to check the virus, so as to take corresponding measures to contain it from invading the computer system. The current anti-virus software generally uses a virus checking method to match a signature string method. That is to say, use the feature string (one or more specific binary code streams) extracted from ...

Examples

Embodiment Construction

[0026] The core idea of ​​the present invention is: at first detect the shell type of the file that has been packed, then according to the detected shell type, determine the code ( For example, code that uses time-consuming compression or encryption algorithms to decompress or decrypt data), and code that requires the virtual machine to skip execution or that the virtual machine executes but modifies the execution result to represent that the unpacker executes on a real computer Specific codes (for example, features and functions that are not supported by the code of the debugger, etc.), finally, execute the determined code that needs to be executed in the real computer in the real computer and execute the unpacking program on the virtual computer except for the The rest of the code that is determined to be executed in the real computer, and, in the virtual machine, skip the specific code in the sheller that requires the virtual machine to skip or execute the specific code in t...

Images