一种基于中断处理机制的动态反汇编算法

传统的反汇编是静态进行的,它难以处理逻辑陷阱、花指令、代码中的数据、动态控制流等问题,这就导致其最终的反汇编结果可能不完整,存在错误.一段特意设计的代码,可以用动态控制流替代静态控制流;一段特意设计的花指令,可以让静态控制流关系任意复杂,这都将使静态反汇编分析难以进行.让代码运行起来,动态地进行反汇编,可以解决上述静态反汇编遇到的问题.结合计算机的中断处理机制,使得代码的实际执行路径是可知的.针对实际执行到的计算机指令进行反汇编,确保了反汇编结果的准确性;反复执行代码,在时间上进行积累,可以确保反汇编结果的完整性不断增加并趋于完整.

Algorithm for Dynamic Disassembly Based on Interrupt Scheme

Disassembly is done statically,usually.It is hard to deal with logic trap,deceiving-instruction,data-in-code,dynamic control-flow-instruction,etc.by static disassembly.On the other hand,the code can be specially designed using dynamic control-flow-instruction instead,or with logic trap and deceiving-instruction,which both can make the static disassembly and analyzing impossible.Working with the interrupt scheme,disassembly can be done dynamically.The instructions executed exactly can be traced and disassemb...