Dissertation > Excellent graduate degree dissertation topics show

A Study on Packed Detection and Exuviate Based on Weighted Euclidean Distance

Author: HuangJianJun
Tutor: ChenQin
School: Hangzhou University of Electronic Science and Technology
Course: Computer Software and Theory
Keywords: PE file format Shell detection Entry point With weighted Euclidean distance
CLC: TP311.53
Type: Master's thesis
Year: 2009
Downloads: 46
Quote: 0
Read: Download Dissertation

Abstract


The emergence of the shell, software protection has entered a new era. Packers technology has been widely used in software protection, reverse analysis software to decrypt and malware detection process, the software shelling has become a very important part of the software. The software shell detection is the premise of the shelling, it lay a solid foundation for subsequent shelling. At present, most of the more mature, wide application shell detection algorithm based on shell characteristics, through the establishment of the shell feature database query feature string file to be tested to determine whether the shell, but these algorithms can not detect the characteristic string other than the feature library, and easily deceived . In this paper, the focus on software the shell detection algorithm research. First, at home and abroad PE file shell detection, the status of shelling technology and related software, made an in-depth analysis of these technologies; focused on other related structures of the optional image header block, the input table, and resources, with a focus analysis of the PE file format. Secondly, in order to improve the detection rate, this PHAD using the shell detection techniques based on feature vectors, but Since eigenvectors PHAD not adequately reflect the characteristics of the packed file, the coupled vector, each element having the same weight, such that The false negative rate, the high rate of false positives. In this paper, these defects on the basis of the PHAD increase feature vector elements, the optimal sequence comparison method to determine the weight value, and with the right Euclidean distance calculation from the strategy, we propose a shell detection algorithm based on the Euclidean distance with the right . The algorithm determined by the threshold and shell detected two phases, the two phases prior to the implementation of the preparatory work should be carried out to determine whether the file to be tested to meet the PE file format and calculate the NCV of the file to be tested to the value. Determine the threshold stage the main task is to determine the threshold value, the value provided to the shell detection phase; the the shell detection phase threshold to determine whether the file to be tested packers. Experimental results show that the false negative rate and false alarm rate of the algorithm are PHAD 1/16 and 1/8, the shell detection accuracy has been increased by nearly 12%. Finally, the shell loaded with the implementation process analysis and research, one can effectively extract hidden information packers memory monitoring data acquisition algorithm, the algorithm can be the packers during program execution trace memory in the memory write data operation occurs collection packers need to write. Identified in the data acquisition algorithm based on test space, combined with the method of the shell detection algorithms and manual shelling ESP law, designed an original program entry point determination algorithm obtained packer entry point, and then perform the dump shelling operation is complete. The Papers in the PE file shelling research has a certain theoretical reference value and the actual value.

Related Dissertations

  1. Applied Anatomic Study of the Parameters of Screw Fixation for the Sacroiliac Joint,R687.3
  2. The Research and Implementation of Static Software Watermarking,TP309.7
  3. Studies on the Postponement Strategy in Supply Chain Based on Mass Customization,F273;F224
  4. The Research and Implementation of GPU-based Ray Tracing Algorithm,TP391.41
  5. Calling and Transcendental: Study on Chuang Tzu’s Life Philosophy,B223.5
  6. Bovine iris recognition technology,TP391.41
  7. Questions in Class in Cinese Teaching,H193
  8. Real-time Modification of Network Data Packets Based on Tcp: Framework and Implementation,TP393.08
  9. Obtains Beauty from the Actual Situation to Inquire into the Modern Prose Reading Education,G633.3
  10. Color photographs of text extraction and recognition date,TP391.4
  11. Clinical Applied Anatomic Study and CT Measurement of the Sacroiliac Screw Internal Fixation,R687.3
  12. History of mathematics in the teaching of mathematical concepts,G633.6
  13. Entry point for study of the development of modern logistics industry in China,F259.2
  14. Reading Faulkner’s Light in August,I712
  15. A Research of Commands’ Editing and Reproducing Mechanism Based on Analyzing Win32 Kernel Encoding and Decoding Mechanism,TP393.01
  16. Lyrics understand the importance of Singing,J616.2
  17. Research and Implementation of Description of AOP’s Pointcuts Based on XML,TP311.11
  18. Anatomic Study of the Safety and Restrictions Using Posterior Approch Screw Fixation of the Atlas,R687.3
  19. Take Bottle Gourd Myth as Point of Penetration to Discuss the Culture of Our Country Zhuang Nationality and Laos Lao-thai Nationality Race Group,C95
  20. The Research of Key Technology in Heterogeneous Cluster Management System,TP393.07

CLC: > Industrial Technology > Automation technology,computer technology > Computing technology,computer technology > Computer software > Program design,software engineering > Software Engineering > Software Maintenance
© 2012 www.DissertationTopic.Net  Mobile