浅析PE文件脱壳技术

如今随着大家对知识产权保护的重视,使得对于自己程序的加壳保护也变得越来越普遍。除此之外,这一技术也被广泛用于病毒和木马之中,使其不易被杀毒软件查杀。其中,PE文件的加壳尤为常见,若想对其进一步的研究,脱壳是必不可少的。本文首先介绍了PE文件结构和现阶段的加壳技术,其次阐述了脱壳原理和常见方法。     

PE文件中脱壳技术的研究

对PE(Portable Executable)文件进行加壳是保护软件的有效手段,但恶意程序也会通过加壳来保护自己.作为一名病毒分析师或软件安全分析员,只有先将其脱壳,才能进行彻底的分析.以Windows记事本程序为实例,首先分析了PE文件结构及其加壳原理,其次阐述了脱壳的一般步骤,然后从压缩壳和加密壳的角度,重点探讨了脱壳技术的原理和方法.最后对伪装壳和多重壳及程序自校验进行了探讨和分析.     

虚拟机在软件加壳中的应用研究

为提高壳的安全性,研究了基于虚拟机的加壳技术.虚拟机通过编译器,把原始字节码编译成伪指令;在执行时,通过虚拟机的解释器把伪指令翻译成原始字节码.设计了伪指令,实现了编译器,并对PE文件补充解释器,构建新的PE头部、节表和节.实验表明,基于虚拟机加壳提高了软件的安全性.     

一种基于信息熵的PE文件加壳检测方法

病毒文件经常加壳且壳的种类繁多,壳的特征经常变化。导致现有的基于特征库的壳检测软件经常失效,不能判断出一个文件是否加壳。提出一种基于信息熵的文件加壳检测算法,可以在壳特征经常变化的情况下,对文件是否加壳做出有效的判断。     

基于带权欧拉距离的PE文件壳检测技术

越来越多的恶意软件出现在网络上。恶意软件作者通过网络将软件中的恶意代码植入用户的电脑中,从而达到诸如获得用户名与密码的非法目的。为了阻止它们对用户电脑的侵害,软件分析人员必须分析恶意软件的工作原理。但是,如果这些恶意软件加壳,那么分析它们就会变得非常困难,因此必须对他们进行脱壳。脱壳的第一步即检测这些恶意软件是否加壳。本文通过对未加壳和已经加壳的软件PE头部进行分析与比较,提出了带权欧拉距离PE文件壳检测(PDWED)算法,其中包括构造一个含有10个元素的向量,并为每个向量中每个元素分配一个权重值,计算向量的带权欧拉距离。实验结果表明,PDWED能够比较快速而又准确地检测软件是否加壳。     

对加壳技术的改进:超粒度混杂技术

首先介绍过去的一些软件保护技术，分析它们的不足之处，然后介绍目前应用最广泛的加壳技术和它的弱点。最后提出了改进的方法：超粒度混杂技术的原理、算法和具体的实现。     

软件加壳与脱壳技术的实现

本文介绍了软件加壳与脱壳的原理,并用Delphi6.0实现了文件加壳与脱壳程序以及自解压脱壳程序.文中根据该原理对加壳与脱壳的编程思路作了概括和分析,并给出了加壳与脱壳两个关键模块的实现代码.     

木马的伪装和免杀技术分析

首先介绍了木马技术的结构和基本功能,描述了木马的发展概况--它的五个发展阶段,及其未来的发展趋势.然后着重从更名换姓、文件捆绑、木马加壳、文件重组四个方面分析了木马的伪装技术.最后从加壳、修改特征码、加花指令、修改内存特征码等方面,分析和介绍了木马的免杀的技术.本文试图通过研究木马的攻击技术,找到防范的途径.     

基于JNI机制与云平台的细粒度Android应用加固方法

Android应用加固是信息安全领域研究的热点之一.针对现有加壳技术以及so文件整体加固方案的不足,融合JNI机制、动态加载技术及云平台理念,提出一种面向Android应用的加固模型,给出了基于JNI机制的函数代码加固方案和基于云平台的加壳解壳方案,形成了一种基于JNI机制与云平台的细粒度Android应用加固方法,从而实现了so文件的细粒度加固,解决了源apk文件易被获取以及解壳程序易被篡改的问题.开发了加固系统原型,验证了基于JNI机制与云平台的细粒度Android应用加固方法的有效性,且加固应用的Dalvik虚拟机工作负担、内存占用量及启动时间并未显著增加.     

PE文件动态加壳技术的研究与实现

对可执行文件加壳是保护软件的一种有效方法。但常用的加壳软件采用的是一种静态加壳技术,所有被加壳后的可执行文件都具有部分相同的代码,这样就增加了软件被破解的可能性,不能完全满足PE文件保护的需求。针对这一不足,在分析PE文件格式和加载机制的基础上,提出PE文件动态加壳的思想,设计和实现了一种PE文件动态加壳软件。试验结果表明其可以有效地提高PE文件的自我保护能力。     

A toolbox for adding knowledge-based modules to existing statistical software

This paper describes TAXSY, a consultation system shell written in SAS^®. TAXSY consists of a set of SAS programs which, with the addition of datasets with rules and interface code, form a flexible system for knowledge-based consultation. The design makes the knowledge transparent and allows easy modification and experimentation.SAS, SAS/STAT, SAS/AF and SAS/IML are registered trademarks of SAS Institute Inc., Cary, NC, USA.     

Efficient modeling of panel-like structures in perforation simulations

This paper presents results of numerical simulations for impact effects in panel-like structures using solid and shell element modeling techniques. Three examples from experiments in literature have been numerically analyzed. The nonlinear transient dynamic analysis code, LS-DYNA is used in the simulations to model projectiles and panel-like targets. It is found that models established for panel-like targets using solid shell elements cannot only save significant computational effort, but also produce good results as long as the panel-like targets satisfy certain conditions. A criterion that governs the validity of modeling panel-like targets with shell elements is proposed in the paper.     

轴向载荷作用下圆柱壳的屈曲仿真

本文采用非线性有限元方法，在经典刚塑性理论的基础上，考虑了材料非线性、大变形效应对材料的影响，利用大型通用程序LS—DYNA对圆柱壳轴向冲击屈曲过程进行了计算机仿真分析。分析表明，利用非线性有限元数值仿真方法，可以对圆柱壳屈曲这一复杂的力学过程进行真实有效的模拟再现。     

Oracle数据库的逻辑备份shell程序

本文通过一个Oracle数据库的逻辑备份shell程序,介绍shell程序的编写方法,并阐述了shell程序对运行维护工作的意义。     

A fuzzy expert system shell using both exact and inexact reasoning

This paper presents a comprehensive expert system shell which can deal with both exact and inexact reasoning. A prototype of this proposed shell, code named as SYSTEM Z-IIe, has been implemented successfully. It is a rule-based system which employs fuzzy logic and numbers for its reasoning. Two basic inexact concepts, fuzziness and uncertainty, are both used and distinct from each other clearly in the system. Moreover, these two concepts have been built into two levels for inexact reasoning, i.e. the level of the rules and facts, and the level of the values of the objects of these rules and facts. Other features of Z-IIe include multiple fuzzy propositions in rules and dual fact input mechanisms. It also allows any combinations of fuzzy and normal terms and uncertainties. Fuzzy numeric comparison logic control is also available for the rules and facts. Its natural language interface which uses English with restricted syntax improves the efficiency of knowledge engineering. Z-IIe is also coupled to a Database Management System for supplying facts from existing databases if appropriate. All these features can be combined to build very powerful expert systems and are illustrated by an example.     

Insight into finite element shell discretizations by use of the “basic shell mathematical model”

The objective of this paper is to gain insight into finite element discretizations of shells using the basic shell mathematical model and, in particular, regarding the sources of “locking”. We briefly review the “basic shell mathematical model” and present a formulation of shell finite elements based on this model. These shell finite elements are equivalent to the widely-used continuum mechanics based shell finite elements. We consider a free hyperboloid shell problem, which is known to be difficult to solve accurately. Using a fine mesh of MITC9 elements based on the basic shell mathematical model, a detailed analysis is performed giving the distributions of all strain terms. A similar analysis using the MITC6 shell element shows why this element locks when the shell thickness is very small.     

Linux中文件权限管理的探讨

Linux是一种多用户的操作系统,其文件权限管理在文件管理中占有重要的地位。为了更好地把握Linux的文件权限的相关内容,本文以多种Linux的发行版为平台,结合文件权限的相关概念,探讨了文件权限管理的主要方式——图形化方式和shell命令方式。其中重点探讨了采用shell命令对文件权限的管理,完善了chmod的常规用法,扩充了umask的文字设定法。     

Axisymmetric shell optimization under fracture mechanics and geometric constraint

This paper describes a problem of axisymmetric shell optimization under fracture mechanics and geometric constraints. The shell is made from quasi-brittle materials, and through crack arising is admitted. It is supposed that the shell is loaded by cyclic forces. A crack propagation process related to the stress intensity factor is described by Paris fatigue law. The problem of finding the meridian shape and the thickness distribution (geometric design variables) of the shell having the smallest mass subject to constraints on the cyclic number for fatigue cracks and geometrical constraint on the shell volume is investigated. Special attention is devoted to different possibilities of problem transformation and analytical methods of their solution. Using minimax approach, optimal shapes of the shells and their thickness distributions have been found analytically.     

面向对象的三维壳体非线性有限元程序设计方法

面向对象的有限元程序设计可以大大提高程序的模块化和代码的重用性，本文将结合三维壳体单元模型的特点、介绍如何对其进行面向对象的程序设计，根据非线性有限元的求解步骤，把整个程序框架划分成一些基类，并派生出相应的子类，本文只对其中的几个类（包括它们的派生类）进行重点阐述，并说明它们之间是如何来传递消息，这包括单元类，材料类，非线性方程求解器类，总装类和分析类及它们的子类。