A method and device for detecting a PE virus, an electronic device, and a storage medium
By simulating the target resources during PE file runtime, and virtually executing and recording characteristic information, the problem of high resource consumption in PE virus detection in existing technologies is solved, achieving efficient and accurate virus detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SANGFOR TECH INC
- Filing Date
- 2022-05-31
- Publication Date
- 2026-05-29
AI Technical Summary
Existing PE virus detection methods are resource-intensive and inefficient, making it difficult to perform virus detection efficiently.
By simulating the target resources required for the execution of a PE file, including CPU, memory management module, and runtime library, the PE file is virtually executed and its characteristic information is recorded to determine whether the PE file is a virus file.
It reduces the resource consumption of PE virus detection and improves detection efficiency, especially the accuracy of detecting PE viruses with encrypted and packed code.
Smart Images
Figure CN115017505B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of virus detection technology, and in particular to a method, apparatus, electronic device and storage medium for detecting PE virus. Background Technology
[0002] PE (Portable Executable) format is the standard file format for portable executable files (such as exe, dll, vxd, sys, and vdm) in the Microsoft Win32 environment. In related technologies, the main method for detecting PE viruses is to simulate a complete runtime environment for the program (such as a sandbox) and determine whether it is a virus based on the program's behavior. However, the above methods for detecting PE viruses generally have low performance and consume a lot of resources.
[0003] Therefore, how to reduce the resource consumption of PE virus detection is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention
[0004] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for PE virus detection, which can reduce the resource consumption of PE virus detection.
[0005] To address the aforementioned technical problems, this application provides a method for detecting PE viruses, comprising:
[0006] Determine the target resources required for the PE file to run; wherein, the target resources include CPU, memory management module and runtime library;
[0007] The target resource is simulated to virtually execute the PE file, and the characteristic information generated by the PE file during the virtual execution is recorded;
[0008] The PE file is determined to be a virus file based on the aforementioned feature information.
[0009] Optionally, all or part of the simulated runtime libraries may be the target class runtime library; when the target class runtime library is invoked, it does not perform any essential functions, and it is also used to return fake execution results.
[0010] Optionally, the PE file can be virtually executed by simulating the target resource, including:
[0011] Load the PE file and read the instructions in the PE file;
[0012] A virtual system environment is constructed by simulating the runtime library, and the CPU is simulated to virtually execute the instructions in the PE file in the virtual system environment. The process memory data generated by the PE file during the virtual execution is stored in the simulated memory management module.
[0013] Optionally, the characteristic information generated by the PE file during virtual execution is recorded, including:
[0014] Detect the jump and decryption actions of the PE file during virtual execution;
[0015] The feature information is recorded based on the jump action and the decryption action; wherein, the feature information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed.
[0016] Optionally, determining whether the PE file is a virus file based on the feature information includes:
[0017] Determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules;
[0018] If so, the first data to be checked is read from the simulated memory management module according to the memory address corresponding to the jump action, and the second data to be checked is read from the simulated memory management module according to the memory address corresponding to the decryption action;
[0019] Based on the first data to be inspected and the second data to be inspected, determine whether the PE file is the virus file.
[0020] Optionally, determining whether the number of times the jump action is executed and the number of times the decryption action is executed conforms to preset rules includes:
[0021] Determine whether the number of times the jump action is executed is greater than a first preset value, and obtain a first determination result;
[0022] Determine whether the number of times the decryption action is executed is greater than a second preset value, and obtain a second determination result;
[0023] If both the first and second judgment results are yes, then the number of times the jump action is executed and the number of times the decryption action is executed are determined to conform to the preset rules.
[0024] Optionally, determining whether the PE file is the virus file based on the first data to be inspected and the second data to be inspected includes:
[0025] Perform virus feature matching operation on the first data to be inspected and the second data to be inspected;
[0026] If the match is successful, the PE file is determined to be the virus file;
[0027] If the match fails, the PE file is determined to be a normal file.
[0028] This application also provides a PE virus detection device, comprising:
[0029] The resource simulation module is used to determine the target resources required for the PE file to run; wherein, the target resources include CPU, memory management module and runtime library;
[0030] The feature recording module is used to virtually execute the PE file by simulating the target resource, and record the feature information generated by the PE file during the virtual execution process;
[0031] The detection module is used to determine whether the PE file is a virus file based on the feature information.
[0032] This application also provides a storage medium storing a computer program thereon, which, when executed, performs the steps of the above-described PE virus detection method.
[0033] This application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor invokes the computer program in the memory to implement the steps of the above-described PE virus detection method.
[0034] This application provides a method for detecting PE viruses, comprising: determining the target resources required for the execution of a PE file; wherein the target resources include a CPU, a memory management module, and a runtime library; virtually executing the PE file by simulating the target resources, and recording the characteristic information generated by the PE file during the virtual execution process; and determining whether the PE file is a virus file based on the characteristic information.
[0035] This application simulates the CPU, memory management module, and runtime library based on the target resources required for the PE file to run. It then virtually executes the PE file using these target resources and determines whether the PE file is a virus based on characteristic information during the virtual execution process. This PE virus detection process does not require simulating the entire set of hardware and software resources; it only simulates the resources needed to run the PE file, thus reducing the resource consumption for PE virus detection. This application also provides a PE virus detection device, a storage medium, and an electronic device, all possessing the aforementioned beneficial effects, which will not be elaborated upon here. Attached Figure Description
[0036] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0037] Figure 1 A flowchart illustrating a PE virus detection method provided in this application embodiment;
[0038] Figure 2 This is a schematic diagram of the architecture of a PE virus detection system provided in an embodiment of this application;
[0039] Figure 3 This is a flowchart of a virus signature scanning process provided in an embodiment of this application;
[0040] Figure 4 This is a schematic diagram of the structure of a PE virus detection device provided in an embodiment of this application. Detailed Implementation
[0041] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0042] Please see below. Figure 1 , Figure 1 This is a flowchart of a PE virus detection method provided in an embodiment of this application.
[0043] Specific steps may include:
[0044] S101: Determine the target resources required for the PE file to run;
[0045] This embodiment can be applied to a virus detection device to detect whether a PE file is a virus. After determining the PE file to be detected, the resources required for the PE file to run can be determined, and these resources can be simulated to obtain target resources. These target resources include CPU, memory management module, and runtime library. Different PE files require different runtime libraries during runtime; this embodiment can determine the corresponding simulated runtime library based on the type of PE file.
[0046] S102: The PE file is virtually executed by simulating the target resource, and the characteristic information generated by the PE file during the virtual execution is recorded;
[0047] In this implementation, the simulated CPU is used to virtually execute instructions in the PE file, the simulated memory management module is used to store data generated when the PE file is executed, and the simulated runtime library is used to provide the system environment (such as system interfaces and necessary dynamic link libraries DLLs). This embodiment can record corresponding characteristic information during the virtual execution of the PE file. The aforementioned characteristic information can be information related to virus behavior. All or a portion of the simulated runtime libraries in this step are target-class runtime libraries; when the target-class runtime library is called, it does not perform its essential functions, and it is also used to return forged execution results. Essential functions refer to the functions that the runtime library can perform when it is normally called. For example, during the virtual execution of the PE file, no actual communication actions may be performed; only the simulated interface returns forged execution results. The resources not simulated during the virtual execution of the PE file include hardware resources such as hard drives and network cards, and parts unrelated to program execution such as a complete operating system.
[0048] To reduce the resource consumption of PE virus detection, the target resources mentioned above can include only CPU, memory management module and runtime library. Therefore, this step can only simulate CPU, memory management module and runtime library.
[0049] S103: Determine whether the PE file is a virus file based on the aforementioned feature information.
[0050] The above-mentioned feature information is generated during the execution of PE files, which can improve the detection accuracy of PE viruses with encrypted or packed code.
[0051] This embodiment simulates the CPU, memory management module, and runtime library based on the target resources required for the PE file to run. It then uses these target resources to virtually execute the PE file and determines whether the PE file is a virus file based on the characteristic information during the virtual execution process.
[0052] Compared to a virtual machine, the simulated operating environment in this embodiment consumes fewer system resources. A virtual machine simulates the entire set of hardware and software resources, while this embodiment only needs to simulate the environment required for the PE software to run, including CPU simulation, memory simulation, and runtime library simulation (such as file operation simulation and module loading simulation). Hardware resources unrelated to the PE software's operation, such as hard drives, network cards, and the registry, do not need to be simulated. Therefore, the process of detecting PE viruses described above does not require simulating the entire set of hardware and software resources; it only simulates the resources needed to run the PE file, thus reducing the resource consumption for PE virus detection.
[0053] As for Figure 1A further description of the corresponding embodiment is that the PE file can be virtually executed in the following way: loading the PE file and reading the instructions in the PE file; constructing a virtual system environment by simulating the runtime library; virtually executing the instructions in the PE file in the virtual system environment by simulating the CPU; and storing the process memory data generated by the PE file during the virtual execution process into the simulated memory management module.
[0054] A PE file can contain multiple instructions. In this embodiment, the current instruction is determined from the PE file in a preset order (such as the order of instructions within the PE file). The CPU is simulated to virtually execute the current instruction in the virtual system environment. After the current instruction is executed, it is determined whether all instructions in the PE file have been executed. If not, the process proceeds to the step of determining the current instruction from the PE file in a preset order. This method allows for the virtual execution of all instructions in the PE file, improving the accuracy of PE virus detection.
[0055] As for Figure 1 A further description of the corresponding embodiments shows that whether a PE file is a virus file can be determined in the following ways:
[0056] The system detects jump and decryption actions during the virtual execution of the PE file; it records the characteristic information based on these actions; wherein the characteristic information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed. The jump action refers to an address jump, and the decryption action refers to data decryption.
[0057] Determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules; if so, read the first data to be checked from the simulated memory management module according to the memory address corresponding to the jump action, and read the second data to be checked from the simulated memory management module according to the memory address corresponding to the decryption action.
[0058] A virus signature matching operation is performed on the first data to be inspected and the second data to be inspected; if the match is successful, the PE file is determined to be the virus file; if the match fails, the PE file is determined to be a normal file.
[0059] The above embodiments address the shortcomings of existing virus detection methods in the industry and propose a new solution. This solution records memory addresses based on jump and decryption actions occurring during virtual execution. During detection, the corresponding memory data is retrieved based on the jump and decryption actions and used as the data to be detected. This process can efficiently detect PE viruses with encrypted code and static file packing.
[0060] As a feasible implementation method, the following approach can be used to determine whether the preset rules are met: determining whether the number of times the jump action is executed is greater than a first preset value, obtaining a first determination result; determining whether the number of times the decryption action is executed is greater than a second preset value, obtaining a second determination result; if both the first and second determination results are yes, then the number of times the jump action is executed and the number of times the decryption action is executed are determined to meet the preset rules. The first and second preset values can be obtained through sample analysis of PE files, for example, by determining the number of times the jump action and the number of times the decryption action are executed when an anomaly is detected after running the PE file.
[0061] The process described in the above embodiments is illustrated below through examples in practical applications. Please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the architecture of a PE virus detection system provided in an embodiment of this application. The architecture includes a virus detection module, a virus rule parsing module, and a virtual execution module. The virtual execution module is used to simulate the CPU, simulate the system environment, and load PE files.
[0062] The virus detection module is the actual user of virus rule characteristics and virtual execution. It determines whether a PE file is malicious by comparing the virtual execution with the characteristic values in the virus rules. The virtual execution module is responsible for loading the PE file and implementing virtual execution of the program by simulating the CPU and runtime libraries. It also stores the process memory data generated during the execution of the PE file in the virtual memory management module. The virus rule parsing module parses the virus rule base, providing the virus detection module with the characteristic locations (such as the number of program jumps and decryption attempts) and characteristic values of the corresponding viruses.
[0063] Please see Figure 3 , Figure 3 A flowchart of a virus signature scanning process provided in this application embodiment is as follows:
[0064] Step 1: Initialize the virtual execution module.
[0065] Step 2: Load the PE file.
[0066] Step 3: Execute the instructions in the PE file using the virtual CPU.
[0067] After loading the PE file, the instructions within it can be read. Specifically, in this embodiment, a virtual system environment can first be constructed by simulating a runtime library, then the instructions in the PE file can be simulated within the virtual system environment by simulating a CPU, and the process memory data generated by the PE file during virtual execution can be stored in the simulated memory management module.
[0068] Step 4: Determine if the maximum number of executions has been exceeded; if yes, proceed to Step 5; otherwise, return failure.
[0069] This embodiment allows setting a maximum number of executions. For example, the number of instructions in the PE file can be used as the maximum number of executions. When the number of virtually executed instructions exceeds the maximum number of executions, a failure can be returned and the process can be terminated. When the number of virtually executed instructions is not greater than the maximum number of executions, subsequent operations can continue.
[0070] Step 5: Determine if there is a jump or decryption action; if yes, proceed to step 6; if no, proceed to step 3.
[0071] Step 6: Record the relevant addresses.
[0072] The relevant addresses recorded in this embodiment include the memory addresses corresponding to jump actions and decryption actions. Specifically, this embodiment can detect jump actions and decryption actions that occur during the virtual execution of the PE file, and then record feature information based on the jump actions and decryption actions. The aforementioned feature information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed.
[0073] Step 7: Determine whether the number of times the jump action and the number of times the decryption action are executed meet the preset rules; if yes, proceed to step 8; if no, proceed to step 3.
[0074] Step 8: Take the corresponding data to be inspected and perform feature matching.
[0075] This embodiment can determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules; if so, the first data to be checked is read from the simulated memory management module according to the memory address corresponding to the jump action, and the second data to be checked is read from the simulated memory management module according to the memory address corresponding to the decryption action, so as to determine whether the PE file is the virus file based on the first data to be checked and the second data to be checked.
[0076] Specifically, the following methods can be used to determine whether the preset rules are met: determine whether the number of times the jump action is executed is greater than a first preset value to obtain a first judgment result; determine whether the number of times the decryption action is executed is greater than a second preset value to obtain a second judgment result; if both the first judgment result and the second judgment result are yes, then it is determined that the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules.
[0077] Step 9: Determine if the match is successful; if yes, return success; otherwise, return failure.
[0078] In the above process, a successful return indicates that the PE file is a virus file, while a failure return indicates that the PE file is a normal file. Specifically, this step can perform a virus signature matching operation on the first and second data to be inspected; if the match is successful, the PE file is determined to be a virus file; if the match fails, the PE file is determined to be a normal file.
[0079] This embodiment simulates the CPU and system environment through software to achieve virtual execution of PE files. It records information such as the number of jumps and decryptions during program execution to obtain memory data. This data is then matched with corresponding features in virus rules to detect viruses based on the matching results. This embodiment solves the problem of not being able to extract static features of encrypted and packed malicious programs, and its efficiency is far higher than the conventional method of judging based on software behavior within a virtual machine.
[0080] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a PE virus detection device provided in an embodiment of this application;
[0081] The device may include:
[0082] The resource simulation module 401 is used to determine the target resources required for the PE file to run; wherein, the target resources include CPU, memory management module and runtime library;
[0083] The feature recording module 402 is used to simulate the virtual execution of the PE file by the target resource and record the feature information generated by the PE file during the virtual execution process;
[0084] The detection module 403 is used to determine whether the PE file is a virus file based on the feature information.
[0085] This embodiment simulates the CPU, memory management module, and runtime library based on the target resources required for the PE file to run. It then virtually executes the PE file using these target resources and determines whether the PE file is a virus based on characteristic information during the virtual execution process. This PE virus detection process does not require simulating the entire set of hardware and software resources; it only simulates the resources needed to run the PE file, thus reducing the resource consumption for PE virus detection.
[0086] Furthermore, the simulated runtime library, or a portion thereof, is a target class runtime library; when the target class runtime library is invoked, it does not perform any essential functions, and it is also used to return fabricated runtime results.
[0087] Furthermore, the feature recording module 402 includes:
[0088] The file loading unit is used to load the PE file and read the instructions in the PE file;
[0089] The virtual execution unit is used to construct a virtual system environment by simulating the runtime library, to virtually execute the instructions in the PE file in the virtual system environment by simulating the CPU, and to store the process memory data generated by the PE file during the virtual execution to the simulated memory management module.
[0090] Furthermore, the virtual execution unit is used to determine the current instruction from the PE file in a preset order; it is also used to virtually execute the current instruction in the virtual system environment by simulating the CPU; and it is also used to determine whether all the instructions in the PE file have been executed after the current instruction has been executed; if not, it proceeds to the step of determining the current instruction from the PE file in a preset order.
[0091] Furthermore, the feature recording module 402 includes:
[0092] An action detection unit is used to detect jump actions and decryption actions of the PE file during virtual execution;
[0093] A recording unit is used to record the feature information based on the jump action and the decryption action; wherein the feature information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed.
[0094] Furthermore, the detection module 403 is used to determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules; if so, it reads the first data to be checked from the simulated memory management module according to the memory address corresponding to the jump action, and reads the second data to be checked from the simulated memory management module according to the memory address corresponding to the decryption action; it is also used to determine whether the PE file is the virus file based on the first data to be checked and the second data to be checked.
[0095] Furthermore, the process by which the detection module 403 determines whether the number of times the jump action is executed and the number of times the decryption action is executed conforms to the preset rules includes: determining whether the number of times the jump action is executed is greater than a first preset value to obtain a first determination result; determining whether the number of times the decryption action is executed is greater than a second preset value to obtain a second determination result; if both the first determination result and the second determination result are yes, then it is determined that the number of times the jump action is executed and the number of times the decryption action is executed conforms to the preset rules.
[0096] Furthermore, the process by which the detection module 403 determines whether the PE file is a virus file based on the first data to be detected and the second data to be detected includes: performing a virus feature matching operation on the first data to be detected and the second data to be detected; if the matching is successful, the PE file is determined to be a virus file; if the matching fails, the PE file is determined to be a normal file.
[0097] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus, which will not be repeated here.
[0098] This application also provides a storage medium on which a computer program is stored, which, when executed, can perform the steps provided in the above embodiments. The storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0099] This application also provides an electronic device that may include a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, it can implement the steps provided in the above embodiments. Of course, the electronic device may also include various network interfaces, power supplies, and other components.
[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.
[0101] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
Claims
1. A method for detecting PE virus, characterized in that, include: Determine the target resources required for the PE file to run; wherein, the target resources include CPU, memory management module and runtime library; The PE file is virtually executed by simulating the target resource, and the characteristic information generated by the PE file during the virtual execution is recorded; wherein, all or part of the simulated runtime libraries are target class runtime libraries; when the target class runtime library is called, it does not perform its essential functions, and the target class runtime library is also used to return fake running results; Based on the aforementioned characteristic information, determine whether the PE file is a virus file; The feature information generated by the PE file during virtual execution includes: Detect the jump and decryption actions of the PE file during virtual execution; The feature information is recorded based on the jump action and the decryption action; wherein, the feature information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed; Accordingly, determining whether the PE file is a virus file based on the aforementioned feature information includes: Determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules; If so, the first data to be checked is read from the simulated memory management module according to the memory address corresponding to the jump action, and the second data to be checked is read from the simulated memory management module according to the memory address corresponding to the decryption action. Based on the first data to be inspected and the second data to be inspected, determine whether the PE file is the virus file.
2. The PE virus detection method according to claim 1, characterized in that, The PE file is virtually executed by simulating the target resource, including: Load the PE file and read the instructions in the PE file; A virtual system environment is constructed by simulating the runtime library, and the CPU is simulated to virtually execute the instructions in the PE file in the virtual system environment. The process memory data generated by the PE file during the virtual execution is stored in the simulated memory management module.
3. The PE virus detection method according to claim 1, characterized in that, Determining whether the number of times the jump action is executed and the number of times the decryption action is executed conform to preset rules includes: Determine whether the number of times the jump action is executed is greater than a first preset value, and obtain a first determination result; Determine whether the number of times the decryption action is executed is greater than a second preset value, and obtain a second determination result; If both the first and second judgment results are yes, then the number of times the jump action is executed and the number of times the decryption action is executed are determined to conform to the preset rules.
4. The PE virus detection method according to claim 1, characterized in that, Determining whether the PE file is a virus file based on the first data to be inspected and the second data to be inspected includes: Perform virus feature matching operation on the first data to be inspected and the second data to be inspected; If the match is successful, the PE file is determined to be the virus file; If the match fails, the PE file is determined to be a normal file.
5. A PE virus detection device, characterized in that, include: The resource simulation module is used to determine the target resources required for the PE file to run; wherein, the target resources include CPU, memory management module and runtime library; The feature recording module is used to virtually execute the PE file by simulating the target resource and record the feature information generated by the PE file during the virtual execution process; wherein, all or part of the simulated runtime libraries are target class runtime libraries; when the target class runtime library is called, it does not perform its essential functions, and the target class runtime library is also used to return fake running results; The detection module is used to determine whether the PE file is a virus file based on the feature information. The feature recording module includes: An action detection unit is used to detect jump actions and decryption actions of the PE file during virtual execution; A recording unit is used to record the feature information based on the jump action and the decryption action; wherein, the feature information includes the memory address corresponding to the jump action, the number of times the jump action is executed, the memory address corresponding to the decryption action, and the number of times the decryption action is executed; The detection module is used to determine whether the number of times the jump action is executed and the number of times the decryption action is executed meet the preset rules; if so, it reads the first data to be checked from the simulated memory management module according to the memory address corresponding to the jump action, and reads the second data to be checked from the simulated memory management module according to the memory address corresponding to the decryption action; it is also used to determine whether the PE file is the virus file based on the first data to be checked and the second data to be checked.
6. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the PE virus detection method as described in any one of claims 1 to 4.
7. A storage medium, characterized in that, The storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the PE virus detection method as described in any one of claims 1 to 4.