文档介绍：第 26 卷第 1 .1
2009 年 1 月 Vol .2009No
Application Research puters Jan
PE 文件隐型加壳技术的研究与实现倡
1 1,2 2 1 1
徐向阳, 解庆春, 刘勇, 俞笛, 刘寅
(, 长沙 410082; ,兰州 730000)
摘要: 通过对( )文件格式的了解,编写分析工具对文件内部结构进行分析。详细介
PE portable executable PE
绍了对可执行文件加壳的全过程,在此过程中巧妙地使用 5、 32 等成熟的算法及防断点跟
PE MD CRC hash API
踪等多种反破解技术,并采用自动隐藏加密方案,大大地提高了软件的保护力度。
关键词: 可移植的可执行文件; 加壳; 哈希算法; 反跟踪
中图分类号: 309 +.7 文献标志码: 文章编号: 1001唱3695(2009)01唱0337唱02
TP A
Research and implementation of PE file stealthy shell technique
唱 1 , 唱 1,2 , 唱 2 , 唱 1 , 唱 1
XU Xiang yang XIE Qing chun LIU Yong YU Di LIU Yin
( munication, Hunan University, Changsha 410082, China; of Modern Physics, Chinese Academy
&
of Sciences, Lanzhou 730000, China)
Abstract: .
Wrote an analysis tool at the base of. understanding the, portable executable唱 file format It presented5, the whole32
processes of the encrypting on the PE file唱 in detail In these processes used variety, anti crack techniques such as MD CRC
algorithms of mature hash. as well as anti track from the interrupt of API functions and also. used some methods of automatic
hiding and encrypting The result is that the protection strength of the software is enhanced
Key words: ; ; ; 唱
PE file shell hash algorithm anti track
众所周知,当今盗版软件问题很严重,侵犯了软件开发者 DOS
MZ
HEADER
(
IMAGE_DOS_HEADERS)
, 。 DOS
Stub