低代价的软件防逆向分析方法研究与实现

发布时间：2018-07-24 20:36

【摘要】：伴随着软件行业不断的发展,随之产生的软件逆向问题也变得越发重要。针对软件逆向的保护技术也层出不穷,如虚拟机保护技术、加壳保护技术、API保护技术、反调试保护技术等等。这些保护技术一般分为两类,一类是利用加密算法或程序结构变化使程序变的极其复杂,晦涩难懂,给逆向分析人员在逆向程序的过程中造成困扰,进而达到保护程序的目的。另一类是对逆向分析过程中使用到的信息和方法进行针对性保护。第一类方法保护强度大但往往容易对程序的性能造成较大的影响,第二类方法虽然不会对程序造成较大的影响但是其存在着容易被去除的缺点。针对这些问题,本文提出低代价的防逆向分析方法,此方法具体的由两种方法组成,分别是反污点分析方法和隐式反调试方法,它们是针对逆向分析过程中的关键步骤设计而成,在不对程序性能造成较大损耗的前提下提高程序的抗逆向分析能力。针对逆向分析根据程序数据流获取程序控制流这一环节设计了反污点分析方法,通过三种技术实现了对污点数据的漂白,可以有效保护程序的敏感数据不被跟踪,进一步保护程序数据流信息,使目标程序防逆向能力提升。针对一般反调试容易被去除的问题提出隐式反调试方法,将程序的调试信息与运行信息相结合,由于其隐藏了反调试保护方法的特征,所以在反调试的同时也提升了反调试被发现和去除的难度。这两种方法都不会对程序造成较大的性能损耗。最后根据本文所提出的方法实现了低代价的防逆向分析原型系统,它结合了本文所提出的方法,可以对程序进行保护,使程序的防逆向能力提升。最后通过有效性分析分析了本文方法的有效性,实验表明本文所提出方法不会对程序造成较大的性能损耗。
[Abstract]:With the development of software industry, software reverse problem becomes more and more important. Software reverse protection technology is also emerging in endlessly, such as virtual machine protection technology, shell protection technology and API protection technology, anti-debugging protection technology and so on. These protection techniques are generally divided into two categories, one is that the use of encryption algorithms or program structure changes to make the program extremely complex, obscure and difficult to understand, to reverse analysts in the process of reverse program problems, and then achieve the purpose of the protection program. The other is to protect the information and methods used in reverse analysis. The first method has high protection intensity but it is easy to affect the performance of the program. The second kind of method has the disadvantage of easy to be removed although it will not have a great impact on the program. To solve these problems, this paper proposes a low-cost anti-reverse analysis method, which is composed of two specific methods: anti-stain analysis method and implicit anti-debugging method. They are designed for the key steps in the process of reverse analysis, which can improve the anti-reverse analysis ability of the program without causing large losses to the program. The reverse analysis method is designed to obtain program control flow according to the program data flow in reverse analysis. Through three techniques, the stain data can be bleached, and the sensitive data of the program can be effectively protected from being tracked. Further protect program data flow information, so that the target program anti-reverse ability to improve. An implicit anti-debugging method is proposed to solve the general problem that anti-debugging is easy to be removed. It combines debugging information with running information, because it hides the characteristics of anti-debugging protection method. So in the anti-debugging but also increased the difficulty of anti-debugging was found and removed. Neither of these methods will cause a large performance loss to the program. Finally, a low cost anti-reverse analysis prototype system is implemented according to the method proposed in this paper. It combines the method proposed in this paper and can protect the program and enhance the anti-reverse ability of the program. Finally, the effectiveness of the proposed method is analyzed, and the experimental results show that the proposed method does not cause much performance loss to the program.
【学位授予单位】：西北大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.5;TP309

【相似文献】