Generic Unpacking Method Based on Detecting Original Entry Point

摘要: In this paper, we focus on the problem of unpacking packed executables in a generic way. That is, do not assume specific knowledge about algorithms used to produce executable (i.e. extract/create reverse algorithm). general, when launched, will first reconstruct code original program, write it down someplace memory and then transfer execution that by assigning Extended Instruction Pointer (EIP) so-called Original Entry Point (OEP) program. Accordingly, if had way accurately identify event flow thus OEP, could more easily extract for analysis (cf. inspecting remaining after OEP was reached). We propose an effective method based combination two novel detection techniques, one relying incremental measurement entropy information stored space assigned process, other searching counting potential Windows API calls same space.