CN108959921A

CN108959921A - A kind of malware analysis method based on intelligent terminal chip

Info

Publication number: CN108959921A
Application number: CN201810538417.1A
Authority: CN
Inventors: 李毅; 陈贤斌; 左震宇; 汤伟
Original assignee: Rock Software (shanghai) Co Ltd
Current assignee: Rock Software (shanghai) Co Ltd
Priority date: 2018-05-30
Filing date: 2018-05-30
Publication date: 2018-12-07
Anticipated expiration: 2038-05-30
Also published as: CN108959921B

Abstract

The malware analysis method based on intelligent terminal chip that the invention discloses a kind of obtains corresponding IC chip from intelligent terminal first, reads the logic unit data in chip, then analyzed data.The IC chip that scheme provided by the invention passes through dismantling intelligence；Malware behavior is analyzed based on the data stored in IC chip, analysis evidence obtaining can be carried out to Malware in the case where intelligent terminal can not effectively be switched on, to effectively solve the problems, such as that damage intelligent terminal can not analyze Malware.

Description

A kind of malware analysis method based on intelligent terminal chip

Technical field

The present invention relates to electronic evidence-collecting technologies, and in particular to the analysis forensic technologies of Malware.

Background technique

In recent years, increasing sharply with smart phone user, cell-phone function is also more and more.It stores in mobile phone a large amount of The information such as privacy of user, property.Security issues become increasingly urgent, and illegal person makes it hide by writing Malware On the mobile phone of user, the privacy information of user is then obtained, or customizes the business etc. of payment wantonly, causes the economic damage of user It becomes estranged privacy leakage.

Various malware analysis tools are had devised to this people, however existing most malware analysis tool, Requiring smart phone is to carry out the case where can be switched on and can run.If smart phone leads to intelligence in damage or other reasons Energy mobile phone cannot be started up, these malware analysis tools are then had no way of doing it, and evidence obtaining will have reached an impasse, and there is presently no preferable Method thoroughly solve the problems, such as this.

Summary of the invention

Malware analysis can not be carried out when smart machine cannot be started up for existing malware analysis tool The problem of, need a kind of new smart machine malware analysis scheme.

For this purpose, the purpose of the present invention is to provide a kind of malware analysis method based on intelligent terminal chip, can have Effect ground is solved the problems, such as to the smart phone malware analysis that cannot be started up.

In order to achieve the above object, the malware analysis method provided by the invention based on intelligent terminal chip, packet Include following steps:

Obtain the IC chip on intelligent terminal mainboard；

IC chip bottom data is read into single file；

Successful file is read in parsing；

Malware analysis is carried out to the data file after parsing.

Further, when reading IC chip data, chip is converted into USB DISK and is read out again, and generated single Dump file.

The IC chip that scheme provided by the invention passes through dismantling intelligence；Malice is analyzed based on the data stored in IC chip Software action can carry out analysis evidence obtaining to Malware in the case where intelligent terminal can not effectively be switched on, to effectively solve The problem of certainly damage intelligent terminal can not analyze Malware becomes one of the important breakthrough of electronic evidence-collecting work.

Detailed description of the invention

The present invention is further illustrated below in conjunction with the drawings and specific embodiments.

Fig. 1 is the flow chart that present example carries out malware analysis for damage smart phone；

Fig. 2 is the structural schematic diagram that conversion module is read in present example.

Specific embodiment

In order to be easy to understand the technical means, the creative features, the aims and the efficiencies achieved by the present invention, tie below Conjunction is specifically illustrating, and the present invention is further explained.

This example outside the intelligent terminal for being not powered on operation by directly reading dependency number in intelligent terminal chip According to thus analyzing mobile phone Malware behavior.The program is switched on without intelligent terminal, can be to original soft in intelligent terminal Part is analyzed.

Specifically, the scheme that this example carries out malware analysis to the intelligent terminal that cannot be started up is as follows:

Firstly, dismantling intelligent terminal, obtains its corresponding IC chip；

Then, reading intelligent terminal IC chip is single dump file；

Then, single dump file data is parsed respectively；

Finally, the data obtained for parsing carry out malicious act analysis by malware analysis tool.

The malware analysis being achieved in the case of cannot be started up for intelligent terminal.

In addition, the intelligent terminal being directed in this example approach is existing conventional intelligent terminal, such as operation Android system Smart phone, tablet computer or the smart phone for running IOS system, tablet computer etc..

For above scheme, it is illustrated by taking Android mobile phone as an example by an application example below.

For the smart phone of operation Android system in this example, and smart phone damage can not effectively be switched on.At this In the case of, in order to effectively analyze the malicious act for the software installed in the smart phone, this example uses following scheme:

Step 101: obtaining the IC chip on smart phone mainboard.

The step specifically obtains the storage chip on smart phone mainboard, first according to the model of smart phone, dismantling The mainboard of mobile phone out finds mobile phone storage chip, is removed chip from mainboard by demounting tool, be cleaned and dried to With.

Step 102: reading IC chip bottom data into single file.

The step puts it on corresponding conversion equipment, passes through for the storage chip got is disassembled in step 101 Storage chip is converted into USB DISK and is read out by the conversion equipment, and generates single dump file, and thus, it is possible to quickly complete The whole legacy data read on storage chip.

By way of the angle pin of storage chip in this programme getting dismantling is converted into SD card, then meet a SD EMMC chip is converted into USB DISK and is read out by the reading hardware module of card, realization.

Referring to fig. 2, this programme chip is read by following reading conversion module realization and be converted into USB DISK into Row is read.

As seen from the figure, which mainly includes control single chip computer STM32, SD/eMMC turn USB read module with And USB HUB, wherein SD/eMMC turns USB read module and is connected to eMMC chip by eMMC bus, and passes through USB data line It is connected to USB HUB；Single-chip microcontroller STM32 is connected to eMMC chip by eMMC bus, and is connected to USB by USB data line HUB；USB HUB is then connected to several USB interfaces.

USB DISK is converted by eMMC chip as a result, to be read out, and may be implemented:

1. the information such as the amount of capacity of character library can be recognized；

2. the reading of dump file can be carried out to character library；

3. normally reading each partition directory and the associated documents inside character library；

4. the character library can be recognized inside the disk management of Windows.

Step 103: successful file is read in parsing.

For each dump file read in the step, data analysis is carried out by analysis tool, to extract malice Software relative program file.

Step 104: malware analysis is carried out to the data file after parsing.

The step carries out malicious act analysis for the Malware relative program file that step 103 extracts.

Based on aforementioned four step it is found that this programme is based on intelligent terminal chip, smart phone storage chip is directly read In data, and analyze mobile phone Malware behavior, and various smart machines, including most of intelligence can be suitable for scheme Android or IOS mobile phone, tablet computer etc..

The malware analysis scheme based on intelligent terminal chip that this example provides is when for electronic evidence evidence obtaining, energy It is enough to carry out correct quickly analysis for the intelligent terminal damaged.

Form the malware analysis tool based on intelligent terminal chip based on top scheme, the analysis tool by software and Hardware cooperation is constituted, including smart phone demounting tool, conversion equipment, data analytical tool and Malware behavioural analysis work Tool.Wherein, conversion equipment and data analytical tool data connection, and data analytical tool and Malware behavioural analysis tool number According to connection.

Thus the malware analysis tool needle constituted carries out Malware behavioural analysis evidence obtaining to the intelligent terminal of damage When, first choice passes through smart phone demounting tool from the IC chip obtained above cell phone mainboard in smart phone；Then, by IC chip It is placed in conversion equipment, storage chip is converted into USB DISK by conversion equipment, reads the logic unit data in chip, And single dump file is generated, and by the single dump transmitting file in real time of generation to data analytical tool；Then, data parse Tool carries out malware analysis to the data received, extracts Malware relative program file based on the analysis results, and real Shi Chuanzhi Malware behavioural analysis tool；Finally, related to the Malware received by Malware behavioural analysis tool Program file carries out Malware behavioural analysis, and has according to standard criterion output and have equal authenticity, public with papery evidence The electronic evidence that Jian Fadeng relevant department is approved.

The basic principles, main features and advantages of the present invention have been shown and described above.The technology of the industry Personnel are it should be appreciated that the present invention is not limited to the above embodiments, and the above embodiments and description only describe this The principle of invention, without departing from the spirit and scope of the present invention, various changes and improvements may be made to the invention, these changes Change and improvement all fall within the protetion scope of the claimed invention.The claimed scope of the invention by appended claims and its Equivalent thereof.

Claims

1. the malware analysis method based on intelligent terminal chip, which comprises the steps of:

Obtain the IC chip on intelligent terminal mainboard；

IC chip bottom data is read into single file；

Successful file is read in parsing；

Malware analysis is carried out to the data file after parsing.

2. malware analysis method according to claim 1, which is characterized in that when reading IC chip data, by core Piece is converted into USB DISK and is read out again, and generates single dump file.