The generation method of random instruction sequence and relevant reverse instruction sequence for constructing self-sealing code blocks were emphasized,including random original instruction sequence generation based on instruction encode table and reverse instruction sequence generation based on reverse engineering.

To make the test process feasible, some instruction sequences are carefully selected to let them be able to execute repeatedly by the microprocessor, and the average current consumed by AT89C51 is then measured with a simple current meter.

This method,using the decompilation of program,identifies behaviors according to the analysis of instruction sequence and control flow graph,so as to complete the design of virus detection method founded on the identify of suspicious behaviors.