Research And Implementation Of The Debugging Mechanism Based On Code Refactoring And Page Faults Hidden

As the derivative of information technologies, malicious codes threaten network security seriously. Analysis of malicious code has a very great significance; we can get the internal details through deep study of the operating mechanism of malicious codes. Then, what we got can be used as a evidence of malicious code detection. Malicious code analysis often requires a lot of tools. Debuggers, as one of the most powerful weapon, are widely used in virus analysis, software crack and other fields. But with the development of technology, malicious code generally use many anti-debugging techniques to avoid exposure their own internal mechanisms. In addition, with the development of software protection technologies, more and more pack tools came out into the market. These tools are easy to use, so are often used by malicious code to avoid debugger analysis. These anti-debugging techniques used by malicious code make it much difficult to analysis these malicious codes. And what is more, makes the debugging can not go on. Thus, a new type of debugging mechanism is required, which is essentially different from regular debugging tools in internal implementation mechanism, that can be used to anti those anti-debugging techniques that used by malicious codes.In this thesis, on the context of the above requirements, we sum up all kinds of anti-debugging techniques of malicious code and with the cooperation of research of mainstream debugging technologies and its internal mechanism. We find out the shortcomings of the current debugging techniques. Then we propose a stealthy debugging mechanism with the help of code reconstruction and page fault technique, the mechanism uses the page fault debugging technology to set breakpoints and breakpoint triggering processes, using the code reconstruct technology to achieve breakpoint positioning and single-step debugging process. The debugging mechanism proposed in this thesis will not make any change on the target program's code space, while subtle debugging mechanism to achieve and without conventional operating system and CPU debugging support. Carried out using the mechanism of any debugging operations are transparent to the debug target. Compared with traditional debugging mechanisms, this technology are superior in terms of hidden and performance。Specifically, the main works of this thesis are:1) Presents a stealthy debugging mechanism, gives out details of page fault technique and reconstruct technique used by this mechanism, and also includes operating system and CPU that involved.2) Puts forward the solutions for the technical barriers of the overall technical program .Based on the above-mentioned works, we design and implement a stealthy debugging system, give out the system's overall architecture and its workflow.3) Tests the stealthy debugging system, especially on the commissioning function of the system and healthy testing. Finally this thesis makes a summary on advantages and shortcomings of the system and points out the prospects for this field.