Research On Data Encrypt And Decrypt Process Reverse Analysis

Automated reverse analyzing the process of encryption and decryption can decrease theworkload of manual analysis, increase the efficiency of research on cipher algorithm security. Itplays an active role to improve software security and protect the security of network datatransmission. At present, the research on reverse analysis of encrypting and decrypting processpays more attention to algorithms identification. There is no mature theory or tools for analyzingthe entire process of encryption and decryption. The thesis summarizes the existing researchresults, based on the existing algorithms identification technology, explores a way to automatedanalyze the process of encryption and decryption with the aid of data flow analysis.The paper introducts the concept, significance and development status of encrypting anddecrypting process reverse analysis. To solve the problem in current algorithms identificationtechnology, the author makes some improvement to increase the accuracy and efficiency ofalgorithms identification.The article defines a dependency graph of encryption and decryptionprocess, and extract the process of encryption and decryption through comparing the similaritybetween dependency graphs.The study of improving the exsiting cipher algorithms identification technology reflects inthree aspects: using entropy to describe the feature of the cipher function, build cipher functionfeature database, and using Bayesian model to identify cipher algorithms. The method ofgenerating the dependency graph of encryption and decryption process is based on data flowtrack.The author observes a method of drawing the maximum equivalent subgraph of twodependency graphs of encryption and decryption process by similarity comparison aim to extractthe entire process of encryption and decryption.Finally, this thesis designs and implementes a prototype system (DCPL) based on Pin,which is a dynamic binary platform, for reverse analyzing the encryption and decryption process.The results of experiments on software with encryption and decryption functions show that, thesystem can identify the cipher algorithms accurately and extract the process of encryption anddecryption fast with a low spending of system resources.