A computer program unshelling method, device and electronic equipment

Abstract

Embodiments of the present application disclose a computer program unshelling method and device and electronic equipment, and relate to the technical field of computer, and the method comprises the following steps: extracting current disassembled instruction code from a computer program to be unshelled according to the execution order of the computer program; determining whether the current disassembled instruction code exists in a pre-created entry point instruction library, the entry point instruction library comprising a plurality of instruction codes, the plurality of instruction codes being extracted from entry points of unshelled programs generated using a plurality of different compiling tools respectively; and when the current disassembled instruction code exists in the entry point instruction library, taking the position where the current disassembled instruction code is located as an entry point of the computer program, and performing an unshelling operation. By using the method, the generality of performing an unshelling operation on a computer program is improved, and compared with an artificial unshelling mode, the efficiency of the unshelling operation is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, and electronic device for unpacking computer programs. Background Technology

[0002] Compressing executable programs is a technique frequently used by malicious code writers. Compressing executable programs can compress them, reducing their size, and can also be used to encrypt them, preventing researchers from analyzing them. Compressing techniques themselves are not malicious; many software programs use them for self-protection.

[0003] According to statistics, packed malicious code now accounts for more than 80% of all malicious code, posing a huge challenge to antivirus software detection and manual analysis.

[0004] Currently, there are two main methods for shell removal: manual removal, which requires professional analysts, and removal using a dedicated shell removal machine. Both methods have significant drawbacks: manual removal requires specialized analysts, leading to time-consuming processes and a shortage of qualified personnel; dedicated shell removal machines can only operate on a specific type of shell and lack versatility. Therefore, finding an automated and versatile shell removal solution is essential. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a computer program unpacking method, apparatus, and electronic device to solve the problem of poor universality and efficiency in the prior art for unpacking packed computer programs.

[0006] In a first aspect, embodiments of the present invention provide a method for unpacking a computer program, comprising:

[0007] Extract the current disassembled instruction code from the computer program to be unpacked, in the order in which the computer program is executed;

[0008] Determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools.

[0009] When the current disassembled instruction code exists in the entry point instruction library, the location of the current disassembled instruction code is taken as the entry point of the computer program, and the unpacking operation is performed.

[0010] According to a specific implementation of an embodiment of the present invention, the step of extracting the current disassembly instruction code from the computer program to be unpacked, in the order of execution of the computer program, includes:

[0011] From the computer program to be unpacked, extract the latest disassembly instructions according to the execution order of the computer program, and use them as the current disassembly instructions;

[0012] If the current disassembly instruction is the first disassembly instruction of the computer program, the current disassembly instruction is determined as the current instruction concatenation code;

[0013] If the current disassembly instruction is not the first disassembly instruction of the computer program, the current disassembly instruction is concatenated with the concatenation code of the previous instruction to obtain the concatenation code of the current instruction;

[0014] Determine whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, wherein the minimum length is the length of the instruction code with the smallest length among the multiple instruction codes included in the entry point instruction library, and the maximum length is the length of the instruction code with the largest length among the multiple instruction codes included in the entry point instruction library;

[0015] When the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, the current instruction concatenation code is determined as the current disassembly instruction code;

[0016] When the length of the current instruction concatenation code is less than the minimum length, return to the step of extracting the latest disassembly instruction from the computer program to be unpacked, according to the execution order of the computer program, and using it as the current disassembly instruction;

[0017] When the length of the current instruction concatenation code is greater than the maximum length, a portion of the disassembled instructions are deleted from the current instruction concatenation code to obtain a new current instruction concatenation code, and the process returns to the step of determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length.

[0018] According to a specific implementation of an embodiment of the present invention, the step of extracting the latest disassembly instructions from the computer program to be unpacked, in the order of execution of the computer program, and using them as the current disassembly instructions, includes:

[0019] From the computer program to be unpacked, the latest disassembly instructions are extracted in the order of execution of the computer program using dynamic instrumentation, and used as the current disassembly instructions.

[0020] According to a specific implementation of an embodiment of the present invention, the method further includes:

[0021] When the current disassembled instruction code is not present in the entry point instruction library, extract the function API that will be called after the current disassembled instruction code from the computer program;

[0022] When it is determined that the function API is a high-risk function API, the process of performing unpacking operation on the computer program is terminated.

[0023] When it is determined that the function API is not a high-risk function API, return to the step of extracting the current disassembled instruction code from the computer program to be unpacked in the order of execution of the computer program.

[0024] In a second aspect, embodiments of the present invention provide a computer program unpacking device, comprising:

[0025] The instruction code extraction module is used to extract the current disassembled instruction code from the computer program to be unpacked, according to the execution order of the computer program;

[0026] The instruction code judgment module is used to determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools.

[0027] The unpacking operation execution module is used to, when the current disassembled instruction code exists in the entry point instruction library, take the location of the current disassembled instruction code as the entry point of the computer program and perform the unpacking operation.

[0028] According to a specific implementation of an embodiment of the present invention, the instruction code extraction module includes:

[0029] The instruction extraction submodule is used to extract the latest disassembly instructions from the computer program to be unpacked, according to the execution order of the computer program, and use them as the current disassembly instructions;

[0030] The code concatenation generation submodule is used to determine the current disassembly instruction as the current instruction concatenation code if the current disassembly instruction is the first disassembly instruction of the computer program; and to concatenate the current disassembly instruction with the previous instruction concatenation code if the current disassembly instruction is not the first disassembly instruction of the computer program to obtain the current instruction concatenation code.

[0031] The code length determination submodule is used to determine whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length. The minimum length is the length of the instruction code with the smallest length among the multiple instruction codes included in the entry point instruction library, and the maximum length is the length of the instruction code with the largest length among the multiple instruction codes included in the entry point instruction library.

[0032] When the length of the current instruction concatenation code is less than the minimum length, the instruction extraction submodule is triggered to execute the step of extracting the latest disassembly instruction from the computer program to be unpacked, according to the execution order of the computer program, and using it as the current disassembly instruction;

[0033] The instruction code generation submodule is used to determine the current instruction concatenation code as the current disassembled instruction code when the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length;

[0034] The code concatenation generation submodule is further configured to, when the length of the current instruction concatenation code is greater than the maximum length, delete a portion of the disassembled instructions from the current instruction concatenation code to obtain a new current instruction concatenation code, and trigger the code length judgment submodule to execute the step of determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length.

[0035] According to a specific implementation of an embodiment of the present invention, the instruction extraction submodule is specifically used to extract the latest disassembly instructions from the computer program to be unpacked using a dynamic instrumentation method, in accordance with the execution order of the computer program, and use them as the current disassembly instructions.

[0036] According to a specific implementation of an embodiment of the present invention, the apparatus further includes:

[0037] The function API extraction module is used to extract the function API that will be called after the current disassembled instruction code from the computer program when the current disassembled instruction code does not exist in the entry point instruction library.

[0038] When it is determined that the function API is a high-risk function API, the process of performing unpacking operation on the computer program is terminated.

[0039] When it is determined that the function API is not a high-risk function API, the instruction code extraction module is triggered to perform the step of extracting the current disassembled instruction code from the computer program to be unpacked in the order of execution of the computer program.

[0040] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in any of the foregoing implementations.

[0041] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the method described in any of the foregoing implementations.

[0042] Fifthly, embodiments of the present invention also provide an application program that is executed to implement the method described in any embodiment of the present invention.

[0043] The computer program unpacking method provided in this invention pre-creates an entry point instruction library based on multiple instruction codes extracted from the entry points of unpacked programs generated using various compilation tools. For the computer program to be unpacked, the current disassembled instruction code is extracted according to the program's execution order. It is then determined whether this current disassembled instruction code exists in the pre-created entry point instruction library. If it does, the location of this current disassembled instruction code is used as the entry point, and the unpacking operation is performed. This method can determine the entry point of computer programs packed using various packing techniques, thereby completing the unpacking operation, improving the versatility of the unpacking operation, and increasing the efficiency compared to manual unpacking methods. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A flowchart of a computer program unpacking method provided for embodiments of the present invention;

[0046] Figure 2 A flowchart of a computer program unpacking method provided in another embodiment of the present invention;

[0047] Figure 3A schematic diagram of the structure of a computer program unpacking device provided in an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of the instruction code extraction module in a computer program unpacking device provided in an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of a computer program unpacking device provided for another embodiment of the present invention;

[0050] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0051] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0052] This invention provides a method for unpacking computer programs, such as... Figure 1 As shown, it includes:

[0053] Step 11: Extract the current disassembled instruction code from the computer program to be unpacked, according to the execution order of the computer program;

[0054] Step 12: Determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools.

[0055] Step 13: When the current disassembled instruction code exists in the entry point instruction library, the location of the current disassembled instruction code is taken as the entry point of the computer program, and the unpacking operation is performed.

[0056] The computer program unpacking method provided in this embodiment of the invention pre-creates an entry point instruction library based on multiple instruction codes extracted from the entry points of unpacked programs generated using various compilation tools. For the computer program to be unpacked, the current disassembled instruction code is extracted according to the program's execution order. It is then determined whether this current disassembled instruction code exists in the pre-created entry point instruction library. If it does, the location of this current disassembled instruction code is used as the entry point, and the unpacking operation is performed. This method can determine the entry point of computer programs packed using various packing techniques, thereby completing the unpacking operation, improving the versatility of the unpacking operation, and increasing the efficiency compared to manual unpacking methods.

[0057] In this embodiment of the invention, the computer program to be unpacked can be any type of packed executable program.

[0058] During the creation of the entry point instruction library, it is also possible to extract instruction code from the entry points of various unpacked programs generated by different known compilation tools. The extracted instruction code can be deduplicated, and the remaining instruction code can be added to the entry point instruction library.

[0059] Given the characteristics of unpacked computer programs, the instruction code at the entry point may be composed of multiple instructions concatenated together. Therefore, the extracted instruction code may be code concatenated from multiple instructions.

[0060] In an embodiment of the present invention, when the current disassembled instruction code does not exist in the entry point instruction library, the function API to be called after the current disassembled instruction code can be extracted from the computer program; when it is determined that the function API is a high-risk function API, the unpacking operation of the computer program is terminated; when it is determined that the function API is not a high-risk function API, the process returns to step 11 above, that is, new disassembled instruction code is extracted from the computer program to be unpacked according to the execution order of the computer program, and used as the current disassembled instruction code, and subsequent judgment and unpacking operations are performed.

[0061] Since extracting disassembled instruction code from a computer program may require executing that computer program, when a function API is determined to be a high-risk function API, it indicates that the computer program may be malicious. Ending the unpacking operation on the computer program, i.e., ending the process of this method, can avoid executing the high-risk function API and thus avoid adverse consequences.

[0062] The computer program unpacking method provided in the embodiments of the present invention will be described in detail below.

[0063] This invention provides a method for unpacking computer programs, such as... Figure 2 As shown, the specific steps may include the following:

[0064] Step 201: Extract the latest disassembly instructions from the computer program to be unpacked, according to the execution order of the computer program, and use them as the current disassembly instructions.

[0065] In this step, dynamic instrumentation can be used to extract the latest disassembled instructions according to the execution order of the computer program, and use these as the current disassembled instructions. Dynamic instrumentation is a method of analyzing the runtime behavior of a binary application by injecting instrumented code. This technique can insert specific analysis code during program execution according to the user's analysis needs without affecting the dynamic execution result of the program, thus achieving monitoring and analysis of the program's dynamic execution process. Assuming that in Example 1, the computer program includes multiple disassembled instructions in execution order, with the first six instructions being instructions 1 to 6.

[0066] In this step, if the latest disassembly instruction extracted last time was instruction 3, then the disassembly instruction extracted in step 201 this time will be instruction 4.

[0067] Step 202: Determine whether the current disassembly instruction is the first disassembly instruction. If it is, proceed to step 203; otherwise, proceed to step 204.

[0068] Step 203: If the current disassembly instruction is the first disassembly instruction of the computer program, determine the current disassembly instruction as the current instruction concatenation code.

[0069] In Example 1, if the current disassembly instruction extracted in step 201 above is instruction 1, then in this step, instruction 1 will be determined as the current instruction concatenation code.

[0070] Step 204: If the current disassembly instruction is not the first disassembly instruction of the computer program, concatenate the current disassembly instruction with the concatenation code of the previous instruction to obtain the concatenation code of the current instruction.

[0071] In Example 1, if the current disassembly instruction extracted in step 201 above is instruction 2 and the current instruction concatenation code is instruction 1, then in this step, instruction 1 and instruction 2 are concatenated to obtain instruction 1+2, which is used as the current instruction concatenation code.

[0072] In Example 1, if the current disassembly instruction extracted in step 201 above is instruction 5, and the current instruction concatenation code is instruction 2+3+4, then in this step, instruction 2+3+4 is concatenated with instruction 5 to obtain instruction 2+3+4+5, which is used as the current instruction concatenation code.

[0073] Step 205: Determine whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, where the minimum length is the length of the instruction code with the shortest length among the multiple instruction codes included in the entry point instruction library, and the maximum length is the length of the instruction code with the longest length among the multiple instruction codes included in the entry point instruction library.

[0074] If the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, proceed to step 207.

[0075] If the length of the current instruction concatenation code is less than the minimum length, return to execute step 201 above;

[0076] If the length of the current instruction concatenation code is greater than the maximum length, proceed to step 206.

[0077] Step 206: Delete a portion of the disassembled instructions from the current instruction concatenation code to obtain a new current instruction concatenation code, and return to execute step 205 above.

[0078] In this step, specifically, the first disassembled instruction can be deleted from the current instruction concatenation code to obtain a new current instruction concatenation code.

[0079] For example, if the current instruction concatenation code is instruction 1+2+3+4, in this step, the first disassembled instruction is deleted from the current instruction concatenation code, that is, instruction 1 is deleted from instruction 1+2+3+4, resulting in instruction 2+3+4, which is used as the new current instruction concatenation code.

[0080] Step 207: When the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, it indicates that the current instruction concatenation code may be located in the entry point instruction library. The current instruction concatenation code is determined as the current disassembly instruction code, and it is determined whether the current disassembly instruction code exists in the pre-created entry point instruction library. If it exists, proceed to step 208; if it does not exist, proceed to step 209.

[0081] Step 208: When the current disassembled instruction code exists in the entry point instruction library, it means that the location of the current disassembled instruction code is the entry point of the computer program. Therefore, the unpacking operation can be performed using this location as the entry point.

[0082] The unpacking operation performed in this step can be performed using various known unpacking methods.

[0083] Step 209: Extract the function API that will be called after the current disassembled instruction code from the computer program.

[0084] Since the last instruction in the current disassembled instruction code is the current disassembled instruction extracted in step 201 above, this step is equivalent to extracting the function API that will be called after the current disassembled instruction.

[0085] Step 210: Determine whether the function API is a high-risk function API.

[0086] If it is a high-risk function API, the process of performing unpacking operations on the computer program is terminated, that is, the flow of this method for the computer program is terminated.

[0087] If it is not a high-risk function API, return to step 201 above and continue to extract the latest disassembly instructions, which will be used to find the entry point of the computer program through subsequent steps.

[0088] In this step, to determine whether a function API is a high-risk function API, a high-risk function API library can be created in advance. By determining whether the function API is located in the high-risk function API library, it can be determined whether it is a high-risk function API.

[0089] Using the above-described embodiments of the present invention Figure 2 The computer program unpacking method shown improves the versatility of the unpacking operation and, compared with manual unpacking methods, increases the efficiency of the unpacking operation.

[0090] Furthermore, it can avoid executing high-risk function APIs, thereby preventing adverse consequences during method execution.

[0091] Accordingly, based on the same inventive concept as the computer program unpacking method provided in the embodiments of the present invention, the embodiments of the present invention also provide a computer program unpacking device, such as... Figure 3 As shown, it includes:

[0092] The instruction code extraction module 31 is used to extract the current disassembled instruction code from the computer program to be unpacked, according to the execution order of the computer program;

[0093] The instruction code judgment module 32 is used to determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools.

[0094] The unpacking operation execution module 33 is used to perform an unpacking operation when the current disassembled instruction code exists in the entry point instruction library, taking the location of the current disassembled instruction code as the entry point of the computer program.

[0095] According to a specific implementation of an embodiment of the present invention, the instruction code extraction module 31, as follows: Figure 4 As shown, it includes:

[0096] The instruction extraction submodule 311 is used to extract the latest disassembly instructions from the computer program to be unpacked, according to the execution order of the computer program, and use them as the current disassembly instructions;

[0097] The code concatenation generation submodule 312 is used to determine the current disassembly instruction as the current instruction concatenation code if the current disassembly instruction is the first disassembly instruction of the computer program; and to concatenate the current disassembly instruction with the previous instruction concatenation code if the current disassembly instruction is not the first disassembly instruction of the computer program to obtain the current instruction concatenation code.

[0098] The code length determination submodule 313 is used to determine whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, wherein the minimum length is the length of the instruction code with the smallest length among the multiple instruction codes included in the entry point instruction library, and the maximum length is the length of the instruction code with the largest length among the multiple instruction codes included in the entry point instruction library.

[0099] When the length of the current instruction concatenation code is less than the minimum length, the instruction extraction submodule 311 is triggered to execute the step of extracting the latest disassembly instruction from the computer program to be unpacked, according to the execution order of the computer program, and using it as the current disassembly instruction;

[0100] The instruction code generation submodule 314 is used to determine the current instruction concatenation code as the current disassembly instruction code when the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length;

[0101] The concatenated code generation submodule 312 is further configured to delete a portion of the disassembled instructions from the current instruction concatenation code when the length of the current instruction concatenation code is greater than the maximum length, obtain a new current instruction concatenation code, and trigger the code length judgment submodule 313 to perform the step of determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length.

[0102] According to a specific implementation of an embodiment of the present invention, the instruction extraction submodule 311 is specifically used to extract the latest disassembly instructions from the computer program to be unpacked using a dynamic instrumentation method, in accordance with the execution order of the computer program, and use them as the current disassembly instructions.

[0103] According to a specific implementation of an embodiment of the present invention, the device, such as Figure 5 As shown, it also includes:

[0104] The function API extraction module 34 is used to extract the function API that will be called after the current disassembled instruction code from the computer program when the current disassembled instruction code does not exist in the entry point instruction library.

[0105] When it is determined that the function API is a high-risk function API, the process of performing unpacking operation on the computer program is terminated.

[0106] When it is determined that the function API is not a high-risk function API, the instruction code extraction module 31 is triggered to execute the step of extracting the current disassembled instruction code from the computer program to be unpacked in the order of execution of the computer program.

[0107] The apparatus of this embodiment can be used to perform Figures 1-2 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0108] This invention also provides an electronic device, which includes the apparatus described in any of the foregoing embodiments.

[0109] Figure 6 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 1-2 The process of the illustrated embodiment is as follows: Figure 6 As shown, the aforementioned electronic device may include: a housing 61, a processor 62, a memory 63, a circuit board 64, and a power supply circuit 65. The circuit board 64 is disposed inside the space enclosed by the housing 61, and the processor 62 and the memory 63 are disposed on the circuit board 64. The power supply circuit 65 is used to supply power to various circuits or devices of the aforementioned electronic device. The memory 63 is used to store executable program code. The processor 62 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 63, for executing the computer program unpacking method described in any of the foregoing embodiments.

[0110] For details on the specific execution process of the above steps by processor 62, and the steps further executed by processor 62 through running executable program code, please refer to the present invention. Figure 1-2 The description of the illustrated embodiments will not be repeated here.

[0111] This electronic device exists in various forms, including but not limited to:

[0112] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0113] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0114] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0115] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0116] (5) Other electronic devices with data interaction functions.

[0117] Embodiments of the present invention also provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the method provided in any of the foregoing embodiments.

[0118] Embodiments of the present invention also provide an application program that is executed to implement the methods provided in any embodiment of the present invention.

[0119] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0120] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0121] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0122] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0123] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0124] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for unpacking computer programs, characterized in that, include: Extract the current disassembled instruction code from the computer program to be unpacked, in the order in which the computer program is executed; Determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools. When the current disassembled instruction code exists in the entry point instruction library, the location of the current disassembled instruction code is taken as the entry point of the computer program, and the unpacking operation is performed. The step of extracting the current disassembly instruction code from the computer program to be unpacked, according to the execution order of the computer program, includes: extracting the latest disassembly instruction from the computer program to be unpacked, according to the execution order of the computer program, as the current disassembly instruction; if the current disassembly instruction is the first disassembly instruction of the computer program, determining the current disassembly instruction as the current instruction concatenation code; if the current disassembly instruction is not the first disassembly instruction of the computer program, concatenating the current disassembly instruction with the previous instruction concatenation code to obtain the current instruction concatenation code; determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, wherein the minimum length is the length of the instruction code with the smallest length among the multiple instruction codes included in the entry point instruction library. The maximum length is the length of the longest instruction code among the multiple instruction codes included in the entry point instruction library; when the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, the current instruction concatenation code is determined as the current disassembled instruction code; when the length of the current instruction concatenation code is less than the minimum length, the step of extracting the latest disassembled instruction from the computer program to be unpacked according to the execution order of the computer program is returned to be executed, and the latest disassembled instruction is used as the current disassembled instruction; when the length of the current instruction concatenation code is greater than the maximum length, a portion of the disassembled instructions is deleted from the current instruction concatenation code to obtain a new current instruction concatenation code, and the step of determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length is returned to be executed.

2. The computer program unpacking method according to claim 1, characterized in that, The step of extracting the latest disassembly instructions from the computer program to be unpacked, according to the execution order of the computer program, and using them as the current disassembly instructions, includes: From the computer program to be unpacked, the latest disassembly instructions are extracted in the order of execution of the computer program using dynamic instrumentation, and used as the current disassembly instructions.

3. The computer program unpacking method according to claim 1, characterized in that, Also includes: When the current disassembled instruction code is not present in the entry point instruction library, extract the function API that will be called after the current disassembled instruction code from the computer program; When it is determined that the function API is a high-risk function API, the process of performing unpacking operation on the computer program is terminated. When it is determined that the function API is not a high-risk function API, return to the step of extracting the current disassembled instruction code from the computer program to be unpacked in the order of execution of the computer program.

4. A computer program unpacking device, characterized in that, include: The instruction code extraction module is used to extract the current disassembled instruction code from the computer program to be unpacked, according to the execution order of the computer program; The step of extracting the current disassembled instruction code from the computer program to be unpacked, according to the execution order of the computer program, includes: extracting the latest disassembled instruction from the computer program to be unpacked, according to the execution order of the computer program, as the current disassembled instruction; if the current disassembled instruction is the first disassembled instruction of the computer program, determining the current disassembled instruction as the current instruction concatenation code; if the current disassembled instruction is not the first disassembled instruction of the computer program, concatenating the current disassembled instruction with the previous instruction concatenation code to obtain the current instruction concatenation code; determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, wherein the minimum length is the length of the shortest instruction code among the multiple instruction codes included in the entry point instruction library. The maximum length is the length of the longest instruction code among the multiple instruction codes included in the entry point instruction library; when the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length, the current instruction concatenation code is determined as the current disassembled instruction code; when the length of the current instruction concatenation code is less than the minimum length, the process returns to the step of extracting the latest disassembled instruction from the computer program to be unpacked according to the execution order of the computer program, and using it as the current disassembled instruction; when the length of the current instruction concatenation code is greater than the maximum length, a portion of the disassembled instructions is deleted from the current instruction concatenation code to obtain a new current instruction concatenation code, and the process returns to the step of determining whether the length of the current instruction concatenation code is not less than the minimum length and not greater than the maximum length. The instruction code judgment module is used to determine whether the current disassembled instruction code exists in the pre-created entry point instruction library. The entry point instruction library includes multiple instruction codes, which are extracted from the entry points of unpacked programs generated using various different compilation tools. The unpacking operation execution module is used to, when the current disassembled instruction code exists in the entry point instruction library, take the location of the current disassembled instruction code as the entry point of the computer program and perform the unpacking operation.

5. The computer program unpacking device according to claim 4, characterized in that, The instruction code extraction module is specifically used to extract the latest disassembly instructions from the computer program to be unpacked using a dynamic instrumentation method, according to the execution order of the computer program, and use them as the current disassembly instructions.

6. The computer program unpacking device according to claim 4, characterized in that, Also includes: The function API extraction module is used to extract the function API that will be called after the current disassembled instruction code from the computer program when the current disassembled instruction code does not exist in the entry point instruction library. When it is determined that the function API is a high-risk function API, the process of performing unpacking operation on the computer program is terminated. When it is determined that the function API is not a high-risk function API, the instruction code extraction module is triggered to perform the step of extracting the current disassembled instruction code from the computer program to be unpacked in the order of execution of the computer program.

7. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in claims 1-3 above.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the method described in claims 1-3.

Images