Abstract: Self Modifying Code（SMC） is the common form of malware to disable the static analysis of reverse engineering techniques.It is difficult for traditional operating system to handle SMC efficiently.This paper presents a Virtual Machine （VM） based framework called CASMonitor，which can monitor the given process out of guest operating system dynamically and transparently，analyze the new code generated by SMC during runtime，for entry point detection or virus-scanning.Experiments on x86/Win32 show that it can handle various popular binary packers.

Key words: Virtual Machine（VM）, Self Modifying Code（SMC）, malware

摘要： 自修改代码技术是恶意程序用以防止反汇编静态分析的最常见技术。传统操作系统的恶意代码防范技术不能有效监测和防止自修改恶意代码的执行和传播。介绍了一个基于虚拟机架构对自修改代码进行监测和监控的方法CASMonitor，能够从虚拟机外部动态、透明地监控虚拟机内部指定程序的执行过程，监测代码的自修改行为，解析新生成代码的入口点，进而提供病毒扫描等功能。x86/Win32虚拟机架构下的实验表明，该技术能够处理多种自修改代码行为以及常见的加壳工具。

关键词: 虚拟机, 自修改代码, 恶意程序