CAJ | 학술논문

由于虚拟机采用虚拟化技术和代码混淆技术，采用传统的逆向分析方法还原被虚拟机保护的算法时存在较大困难。为此，提出一种基于动态数据流分析的虚拟机保护破解方法。以动态二进制插桩平台Pin作为支撑，跟踪记录被虚拟机保护的算法在动态执行过程中的数据流信息，对记录的数据流信息进行整理分析，获取虚拟机指令的解释执行轨迹，还原程序的控制流图，根据轨迹信息对数据生成过程进行分层次、分阶段还原，并由分析人员结合控制流图和数据生成过程进行算法重构。实验结果证明，该方法能够正确还原程序的控制流和数据生成过程，辅助分析人员完成被保护算法的重构。
유우허의궤채용허의화기술화대마혼효기술，채용전통적역향분석방법환원피허의궤보호적산법시존재교대곤난。위차，제출일충기우동태수거류분석적허의궤보호파해방법。이동태이진제삽장평태Pin작위지탱，근종기록피허의궤보호적산법재동태집행과정중적수거류신식，대기록적수거류신식진행정리분석，획취허의궤지령적해석집행궤적，환원정서적공제류도，근거궤적신식대수거생성과정진행분층차、분계단환원，병유분석인원결합공제류도화수거생성과정진행산법중구。실험결과증명，해방법능구정학환원정서적공제류화수거생성과정，보조분석인원완성피보호산법적중구。
Traditional reverse analysis methods are not very effective in the analysis of the algorithms protected by virtual machine because of virtualization technology and code obfuscation technology. Aiming at this problem,this paper presents a virtual machine protection reverse engineering technique based on dataflow analysis. It uses Pin platform to record the data flow information during the execution of the protected algorithms dynamically, analyses the record information,restores the track of the virtual machine instructions and the control flow graph of the protected algorithms, gets data generation process hierarchically by using the track information. Then the analyzer uses those information to reconstruct the protected algorithms. Experimental results show that the proposed method can correctly restore the program control flow and data generation process,and assist the analyzer to reconstruct the protected algorithms.