程序自动脱壳数据采集技术研究

自动提取加壳程序隐藏的代码和数据是目前恶意代码检测技术面临的重要问题。分析了加壳程序运行的本质特征，给出了存储器监控算法和动态基本块标记算法，描述了基于QEMU仿真器的程序自动脱壳数据采集系统的设计思路。实验结果表明，该系统可以有效地提取被加壳程序的代码和数据，完整地记录程序脱壳的执行行为。

Research of data acquisition technology in program automatic unpacking

The hidden code and data extraction of packed program is an important issue of malware detection technology. The running characteristics of packed program were analyzed, the memory monitoring algorithm and dynamic identification algorithm of basic block were given, and the data acquisition system of program automatic unpacking based on QEMU emulator was described. Testing results show that the code and data of original program can be extracted, and executable behavior of program unpacking can be recorded.