制作一个简单的装配模拟器
我正在开发检测未知病毒的项目，因此我将构建我的小型模拟器来模拟可执行文件的汇编代码，以便我可以检测它是否是通过将其模拟到虚拟寄存器然后观察会发生什么来确定病毒是否存在。 所以我需要帮助来获取 c 中每个汇编指令的代码。
I am working on project that is detecting unknown Viruses, so I am going to build my small emulator that emulates the assembly code of the executable so I can detect whether it is a virus or not by emulating it to virtual registers then observing what happens.
so I need help in getting the code of every assembly instruction in c .
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您想创建 x86 模拟器，您可以查看完整的操作码列表：
x86 指令集参考。但这似乎不是检测病毒的好方法。
If you want to create an x86 emulator, you can have a look at this complete opcodes listing:
x86 Instruction Set Reference. But it doesn't seem to be a good way to detect viruses.
您正在寻找 Bochs，它是 x86 ISA 和通用硬件的 LGPL 模拟器。
You're looking for Bochs, an LGPL'ed emulator of the x86 ISA and common hardware.
寄存器值中没有任何内容表明恶意。你最好放弃那个。大多数试图检测恶意行为的沙箱所做的是拦截系统/库调用。
使用上下文 %eax=1 %ebx=4000 %ecx=3F 调用 ftable+1 也可能意味着发射核导弹，因为它可能意味着打印 hello world。
现在，如果您将自己的函数放在系统和可执行文件之间，您就可以知道发生了什么（将其识别为恶意并不那么容易）。
这当然不需要模拟器，所以你最好重新考虑一下，因为编写一个准确的模拟器是非常非常困难的。
There is nothing in the register values that indicates maliciousness. You better give up on that. What most sandboxes trying to detect malicious behavior do is intercepting the system/library calls.
call ftable+1 with context %eax=1 %ebx=4000 %ecx=3F could as well mean shoot nuclear missiles as it could mean print hello world.
Now if you put your own function between the system and the executable you can know what is going on(identifying it as malicious isn't as easy as that).
That certainly needs no emulator, so you better reconsider that as writing an accurate emulator is very, very hard.