Enhanced method based on virtual registers rotation

Yan PAN; Wei LIN

doi:10.11959/j.issn.2096-109x.2018038

您当前的位置：

首页 >

文章列表页 >

Enhanced method based on virtual registers rotation

Papers | 更新时间：2024-06-03

- Enhanced method based on virtual registers rotation
- Chinese Journal of Network and Information Security Vol. 4, Issue 5, Pages: 47-54(2018)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018038
  CLC： TP311
- Online First：2018-05，
  
  Published：15 May 2018
- 稿件说明：
移动端阅览
Yan PAN, Wei LIN. Enhanced method based on virtual registers rotation[J]. Chinese Journal of Network and Information Security, 2018, 4(5): 47-54.
DOI：

Yan PAN, Wei LIN. Enhanced method based on virtual registers rotation[J]. Chinese Journal of Network and Information Security, 2018, 4(5): 47-54. DOI： 10.11959/j.issn.2096-109x.2018038.

摘要

为了对抗基于数据流逆向分析的语义攻击，以虚拟寄存器为切入点，提出了一种增强型虚拟寄存器轮转算法。该算法通过在解释执行中随机打乱部分虚拟寄存器与操作数的虚拟编译映射关系，有效地增加了虚拟机在解释执行过程中的数据流复杂度；同时，随机采用3种机制对轮转长度进行设定，增强了虚拟机代码保护系统的多样性。最后，设计实现了采用增强型虚拟寄存器轮转算法的虚拟机代码保护原型系统，验证了该算法的有效性。

Abstract

Sematic attacks based on the data flow analysis bring big challenges to the code obfuscation.Concerning the data flow of virtual machine based (VM-based) code protection

the method transfers the mapping relation between the virtual registers and the op-code of the bytecode during executing

which means the uncertainty and complexity of the data flow during interpretive execution of the bytecode.In addition

three policies are proposed to address the problem that how to choose the length of rotation for each bytecode

which grows complexity of the protection.Finally

a prototype of VRR-VM (virtual machine protection system based on virtual registers rotation) was implemented.Experiment results show that the method is effective and applicable for anti-reversing.

关键词

Keywords

references

NEWSOME J , SONG D . Dynamic taint analysis for automatic detection,analysis,and signature generation of exploits on commodity software [J ] . Chinese Journal of Engineering Mathematics , 2005 , 29 ( 5 ): 720 - 724 .

徐欣 . 动态数据流分析技术在恶意软件分析中的应用研究 [D ] . 合肥:中国科学技术大学 , 2016 .

XU X . Research of dynamic data flow analysis technology application in malware analysis [D ] . Hefei:University of Science and Technology of China , 2016 .

REDDI JANAPA V , et al . PIN:a binary instrumentation tool for computer architecture research and education [C ] // The Workshop on Computer Architecture Education , 2004 :22.

CHOW J , PFAFF B , GARFINKEL T , et al . Understanding data lifetime via whole system simulation [C ] // Usenix Security Symposium , 2004 : 321 - 336 .

SHARIF M , LANZI A , GIFFIN J , et al . Automatic reverse engineering of malware emulators [C ] // 2009 30th IEEE Symposium on Security and Privacy . 2009 : 94 - 109 .

黄荷洁 , 康绯 , 舒辉 , 等 . 基于动态数据流分析的虚拟机保护破解技术 [J ] . 计算机工程 , 2014 , 40 ( 9 ): 59 - 65 .

HUANG H J , KANG F , SHU H , et al . Reverse technology of virtual machine protection based on dynamic dataflow analysis [J ] . Computer Engineering , 2014 , 40 ( 9 ): 59 - 65 .

徐方华 . 基于虚拟堆的虚拟保护技术的研究 [D ] . 昆明:云南大学 , 2013 .

XU F H . Research on virtual protection technology based on virtual heap [D ] . Kunming:Yunnan University , 2013 .

WANG H , FANG D , LI G , et al . NISLVMP:improved virtual machine-based software protection [C ] // The Ninth International Conference on Computational Intelligence and Security . 2013 : 479 - 483 .

舒柏程 , 李毅超 , 曹跃 . 基于虚拟机的软件保护技术研究 [J ] . 计算机工程与科学 , 2008 , 30 ( A1 ): 25 - 28 .

SHU B C , LI Y C , CAO Y . Research on software protection based on virtual machine [J ] . Computer Engineering ＆ Science , 2008 , 30 ( A1 ): 25 - 28 .

GHOSH S , HISER J , DAVIDSON J W . Replacement attacks against VM-protected applications [C ] // ACM Sigplan/sigops Conference on Virtual Execution Environments . 2012 : 203 - 214 .

COOGAN K P . Deobfuscation of packed and virtualization-obfuscation protected binaries [D ] . Arizona:University of Arizona , 2011 .

COOGAN K , LU G , DEBRAY S . Deobfuscation of virtualization-obfuscated software:a semantics-based approach [C ] // ACM Conference on Computer and Communications Security . 2011 : 275 - 284 .

房鼎益 , 张恒 , 汤战勇 , 等 . 一种抗语义攻击的虚拟化软件保护方法 [J ] . 四川大学学报(工程科学版) , 2017 , 49 ( 1 ): 159 - 168 .

FANG D Y , ZHANG H , TANG Z Y , et al . DAS-VMP:a virtual machine-based software protection method for defending against semantic attacks [J ] . Journal of Sichuan University (Advanced Engineering Sciences) , 2017 , 49 ( 1 ): 159 - 168 .

谢鑫 , 刘粉林 , 芦斌 , 等 . Handler混淆增强的虚拟机保护方法 [J ] . 计算机工程与应用 , 2016 , 52 ( 15 ): 146 - 152 .

XIE X , LIU F L , LU B , et al . Virtual machine protection based on Handler obfuscation enhancement [J ] . Computer Engineering and Applications , 2016 , 52 ( 15 ): 146 - 152 .

谢鑫 , 刘粉林 , 芦斌 , 等 . 一种基于代码并行化和虚拟机多样化的软件保护方法 [J ] . 小型微型计算机系统 , 2015 , 36 ( 11 ): 2588 - 2593 .

XIE X , LIU F L , LU B , et al . Software protection scheme based on code parallelization and virtual machine diversity [J ] . Journal of Chinese Computer Systems , 2015 , 36 ( 11 ): 2588 - 2593 .

房鼎益 , 赵媛 , 王怀军 , 等 . 一种具有时间多样性的虚拟机软件保护方法 [J ] . 软件学报 , 2015 , 26 ( 6 ): 1322 - 1339 .

FANG D Y , ZHAO Y , WANG H J , et al . Software protection based on virtual machine with time diversity [J ] . Journal of Software , 2015 , 26 ( 6 ): 1322 - 1339 .

WANG H J , FANG D Y , LI G , et al . TDVMP:Improved virtual machine-based software protection with time diversity [C ] // ACM Sigplan on Program Protection and Reverse Engineering Workshop . 2014 : 1 - 9 .

WANG H J , FANG D Y , LI G , et al . NISLVMP:improved virtual machine-based software protection [C ] // The Ninth International Conference on Computational Intelligence and Security . 2013 : 479 - 483 .

KUANG K , TANG Z , GONG X , et al . Exploiting dynamic scheduling for vm-based code obfuscation [C ] // IEEE Trustcom/bigdatase/ispa . 2017 : 489 - 496 .

KUANG K , TANG Z , GONG X , et al . Enhance virtual-machine-based code obfuscation security through dynamic bytecode scheduling [J ] . Computers ＆ Security , 2018 , 74 : 202 - 220 .

TANG Z , LI G , FANG D , et al . Code virtualized protection system with instruction set randomization [J ] . Journal of Huazhong University of Science ＆ Technology , 2016 .

XU J F , ZHANG W , SUN B . Research on software protection based on virtual machine [J ] . Journal of China Universities of Posts ＆Telecommunications , 2012 , 19 ( S1 ): 122 - 126 .

Views

1353

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Binary program taint analysis optimization method based on function summary

Related Author

Pan YANG

Fei KANG

Hui SHU

Yuyao HUANG

Xiaoshao LYU

Related Institution

No data

⁰