基于运行期指令流的数字取证分析

Computer system's runtime information is an essential part of the digital evidence. Current digital forensic approaches mainly focus on memory and I/O data, while the runtime instructions from processes are often ignored. We present a novel approach on runtime instruction forensic analysis and have developed a forensic system which collects instruction flow and extracts digital evidence. The system is based on whole-system emulation technique and analysts are allowed to define analysis strategy to improve analysis efficiency and reduce overhead. This forensic approach and system are applicable to binary code analysis, information retrieval and malware forensics.     

一种基于全系统仿真和指令流分析的二进制代码分析方法*

二进制代码分析是分析程序行为特征的重要手段。本文提出了一种基于全系统仿真和指令流分析的二进制代码分析方法,该方法的核心思想是在一个全系统仿真虚拟机上执行二进制代码,通过截获并分析二进制代码运行时产生的指令流信息,分析程序行为特征。基于该方法,本文设计并实现了一个二进制代码分析系统。实验结果表明,通过该系统捕获并分析指令流,能够更为高效全面地提取出代码执行过程中产生的各类信息。对于使用抗分析技术手段的二进制代码,本文的分析方法很有效果。