基于代码重构和页面故障技术的隐蔽调试机制研究与实现

【作者】 陈沁源；

【导师】 李毅超；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2010， 硕士

【摘要】 恶意代码作为信息技术的衍生物,对网络安全领域的威胁日益严重。恶意代码分析工作具有十分重大的意义。通过对恶意代码运行机制的深入挖掘可以获得其内部详细信息,进而作为恶意代码检测的依据。恶意代码分析工作往往需要很多分析工具,调试器作为其中最有力的武器,被广泛应用于病毒分析,软件破解等领域。但是随着恶意代码编制技术的发展,恶意代码为了避免暴露自身的内部机制,纷纷采用反调试技术以对抗分析。此外,随着软件保护技术的进步,市面上出现了越来越多的加壳工具。这些工具使用简单方便,往往被恶意代码所利用。恶意代码采用的一系列反调试方法提高了调试难度,增加分析人员的工作量,甚至使得调试无法进行。因此需要一种新型调试机制,该机制在内部实现上应和常规调试技术有本质的不同,能从根本上规避恶意代码常用的各种反调试技术。本文以上述需求为背景,总结恶意代码常用的各种反调试技术,通过对主流调试技术的内部实现机制进行深入分析,探索出当前调试技术的不足之处。在此基础上,提出一种基于代码重构和页面故障的隐蔽调试机制。该调试机制采用页面故障技术实现断点设置和断点触发过程,采用代码重构技术来实现断点定位和单步调试过程。本文提出的隐蔽调试机制不依赖操作系统和CPU的常规调试支持,利用该机制所进行的任何调试操作都对调试目标透明。与传统调试机制相比,该技术在调试平台隐蔽性和提高软件可调试性等方面均更胜一筹。具体来说,本文的主要工作有:1)提出了隐蔽调试机制的总体技术方案,详细阐述了调试机制所采用的代码重构技术和页面故障技术,以及这些技术所依赖的操作系统和CPU支持。2)针对总体技术方案所面临的技术障碍,提出了相应的解决方法。本文在上述工作的基础上设计了一个隐蔽调试系统,给出了该系统的总体架构和工作流程。并详细阐述了系统各个功能模块的设计与实现。3)本文对上述的隐蔽调试系统进行试验验证,着重对调试系统的功能和隐蔽性进行了测试。最后对全文做了总结并客观评价了隐蔽调试系统的优点和不足,指出对后续工作的展望。更多还原

【Abstract】 As the derivative of information technologies, malicious codes threaten network security seriously. Analysis of malicious code has a very great significance; we can get the internal details through deep study of the operating mechanism of malicious codes. Then, what we got can be used as a evidence of malicious code detection. Malicious code analysis often requires a lot of tools. Debuggers, as one of the most powerful weapon, are widely used in virus analysis, software crack and other fields. But with the development of technology, malicious code generally use many anti-debugging techniques to avoid exposure their own internal mechanisms. In addition, with the development of software protection technologies, more and more pack tools came out into the market. These tools are easy to use, so are often used by malicious code to avoid debugger analysis. These anti-debugging techniques used by malicious code make it much difficult to analysis these malicious codes. And what is more, makes the debugging can not go on. Thus, a new type of debugging mechanism is required, which is essentially different from regular debugging tools in internal implementation mechanism, that can be used to anti those anti-debugging techniques that used by malicious codes.In this thesis, on the context of the above requirements, we sum up all kinds of anti-debugging techniques of malicious code and with the cooperation of research of mainstream debugging technologies and its internal mechanism. We find out the shortcomings of the current debugging techniques. Then we propose a stealthy debugging mechanism with the help of code reconstruction and page fault technique, the mechanism uses the page fault debugging technology to set breakpoints and breakpoint triggering processes, using the code reconstruct technology to achieve breakpoint positioning and single-step debugging process. The debugging mechanism proposed in this thesis will not make any change on the target program’s code space, while subtle debugging mechanism to achieve and without conventional operating system and CPU debugging support. Carried out using the mechanism of any debugging operations are transparent to the debug target. Compared with traditional debugging mechanisms, this technology are superior in terms of hidden and performance。Specifically, the main works of this thesis are:1) Presents a stealthy debugging mechanism, gives out details of page fault technique and reconstruct technique used by this mechanism, and also includes operating system and CPU that involved.2) Puts forward the solutions for the technical barriers of the overall technical program .Based on the above-mentioned works, we design and implement a stealthy debugging system, give out the system’s overall architecture and its workflow.3) Tests the stealthy debugging system, especially on the commissioning function of the system and healthy testing. Finally this thesis makes a summary on advantages and shortcomings of the system and points out the prospects for this field.更多还原