Research For Virtual Machine Software Protection Method Of Attack

With the development of software security, many software protection technologies have been proposed, including software decryption, obfuscation, tamper-proof, watermark and so on. In which, VM-based software protection has been used widely for software code protection. It will translate the key X86instructions which needs to be protected to byte-codes, and the VM interpreter will interpret them according to these byte-codes. The original codes will be deleted from the target, and instead of it, there will be the VM interpreter to implement the same functionality. The amounts of the junk codes and the complex VM framework will increase the difficulty of cracking. But it has not been protected software from cracking, new attacking technologies make these protection highly uncompetitive. Therefore, based on the game theory and the idea of attack and defense, we have researched the attack strategy of VM, aim to show the software vulnerability to protector, support them to develop better protection technologies.Main work in this thesis includes:Firstly, Introducing the status of software protection; secondly, form the reverse engineering aspects, give the details about VM-based software protection technology and the details of its main parts; Then, based on mounts of attack experiments, a new semi-automatic VM restore attack is proposed, including use "dynamic extracting, static analysis" and "anti-deformation engine" to retore Handlers; build handlers set, handler combinative set and void handler set to manage handlers; at last, restore the X86instructions from VM interpreter according to register data tracking. At last, the VM semi-automatic attack system is developed, the Code Virtualizer has been used as the experiment target to verify the theory.