The acquisition section which acquires the 2nd value which is shown by

摘要

PROBLEM TO BE SOLVED: To provide a data specification device, a data specification method and a data specification program that enable efficiency of a work related to unpacking.;SOLUTION: A memory access monitoring section 31 acquires a value shown by prescribed capacity data including a region of a compressed or enciphered program when the data is read for each prescribed capacity from a memory and a value shown by prescribed capacity data which is read from the memory, is restored and is written. An entropy calculation section 33 calculates an entropy value for each data amount corresponding to a prescribed number of times of reading and writing using the acquired values. A log analysis section 71 specifies a writing destination of the data executed at the earliest time of the prescribed capacity data which is written in the memory in a time section from a point of time when the entropy value related to reading becomes higher than a prescribed threshold up to a point of time when the entropy value related to writing becomes lower than a prescribed threshold as a start position when a restored program is executed.;COPYRIGHT: (C)2013,JPO&INPIT