关键词: 恶意程序, 逆向分析, QQ密码大划拉, 壳, 启动函数, Windows API

Abstract: The reverse analysis process is an advanced and efficient method that exposes the intention and process of malwares. This paper introduces the basic concepts, methods, and tools of the reverse analysis process. A case study of a malware in China, which was used to obtain QQ accounts and passwords, is presented to illustrate the whole process of the reverse analysis process of malware from the aspects of checking pack, unpacking, breakpoint setting, program tracing, key information acquiring and other facets.

Key words: malware, reverse analysis, QQ passwords collecting, pack, start function, Windows API