A dynamic program analysis method for a WOW64 environment enhanced

Abstract

The application discloses a kind of dynamic program analysis methods for WOW64 environment enhancement, can be carried out to the target application program of high-efficiency fine-grained analysis under the running of WOW64 environment, fusion 64-bit Windows operating system built-in simulator realizes the high-efficiency stable analysis of 32-bit and mixed program, while compatible 64-bit mode execution code analysis, using system kernel characteristics realizes the interception and dynamic insertion of target program execution, and proposes the dynamic analysis code generation scheme for WOW64 environment enhancement, reduce the influence on target program execution, with good deployability.The application realizes the dynamic program insertion of system kernel driver and analysis method, optimization is carried out to the analysis scene under the WOW64 environment, can realize the dynamic analysis of multiple types of programs.The application improves the availability of dynamic analysis in the WOW64 environment, further improves the performance of fine-grained analysis and analysis detection confrontation ability.

Images