CN105303073A - Protecting method for software codes - Google Patents

Protecting method for software codes Download PDF

Info

Publication number
CN105303073A
CN105303073A CN201510845479.3A CN201510845479A CN105303073A CN 105303073 A CN105303073 A CN 105303073A CN 201510845479 A CN201510845479 A CN 201510845479A CN 105303073 A CN105303073 A CN 105303073A
Authority
CN
China
Prior art keywords
hook function
self
function
api hook
defined api
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201510845479.3A
Other languages
Chinese (zh)
Other versions
CN105303073B (en
Inventor
孙吉平
韩勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Senseshield Technology Co Ltd
Original Assignee
Beijing Senseshield Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Senseshield Technology Co Ltd filed Critical Beijing Senseshield Technology Co Ltd
Priority to CN201510845479.3A priority Critical patent/CN105303073B/en
Publication of CN105303073A publication Critical patent/CN105303073A/en
Application granted granted Critical
Publication of CN105303073B publication Critical patent/CN105303073B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12Protecting executable software
    • G06F21/121Restricting unauthorised execution of programs
    • G06F21/125Restricting unauthorised execution of programs by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a protecting method for software codes. The protecting method comprises the following steps: S1) performing user-defined modification on at least one API (Application Program Interface) function in an API function library of an operation system in advance, and then acquiring a user-defined API hook function, linking the user-defined API hook function with the API function library; S2) installing or integrating the user-defined API hook function into a target application program under the operation system in terminal equipment which is connected with a hardware encrypting device; S3) while encrypting a script code loaded to the target application program, running the target application program, firstly performing the user-defined API hook function and then invoking the hardware encrypting device, thereby acquiring an encrypted data; S4) while decrypting the encrypted data, running the target application program, firstly performing the user-defined API hook function and then invoking the hardware encrypting, thereby acquiring a decrypted data. According to the protecting method for software codes, the poor safety and the potential safety hazard caused by the incapability of the shell to protect the script code in text form in the present software code protecting scheme are solved.

Description

Software code guard method
Technical field
The present invention relates to computer software fields, particularly a kind of software code guard method.
Background technology
Script be otherwise known as enlarging language, it is a kind of programming language, being used for control software design application program or request software application carries out a certain service, script be traditional write to shorten-compile-link-operational process and the computer programming language that creates.Script has simple, easy to learn, easy-to-use characteristic usually, object be exactly wish to allow programmer complete program fast write work, scripted code generally to load in destination application and is all exist in the form of text, be similar to a kind of order, only make an explanation when called, a scripted code is normally explained and is run and decomplier.For software developer, it is important that the execution efficiency of software can not show a candle to development efficiency, and therefore in software development, the use of script becomes more and more general, therefore also seems important to the protection of the scripted code be loaded in destination application.
Generally; the code protection of compiling type is completed by shell and hardware encipher equipment usually; but for the script without compilation process own; when storing as textual form; the protection of housing form is also inapplicable; scripted code usually need the interpreter of operating system or independently interpreter make an explanation, if but the non-opening of the code of interpreter, then protect scripted code more difficult.
Summary of the invention
In view of the problems referred to above that prior art exists, the object of this invention is to provide a kind of software code guard method, the method can carry out available protecting to scripted code by the mode of encryption and decryption scripted code under the cooperation of api function and encryption hardware.
To achieve these goals, the invention provides a kind of software code guard method, comprising the following steps:
S1, carries out self-defined amendment at least one api function in the api function storehouse of operating system in advance and obtains self-defined API Hook Function, and itself and described api function storehouse are mounted;
S2, is installed to or is integrated in the destination application in terminal device under operating system by described self-defined API Hook Function, described terminal device and hardware encipher equipment connection;
S3, when being encrypted the scripted code be loaded in described destination application, run described destination application and first perform described self-defined API Hook Function, calling described hardware encipher equipment by described self-defined API Hook Function and acquisition enciphered data is encrypted to the scripted code be loaded in described destination application;
S4, when being decrypted described enciphered data, run described destination application and first perform described self-defined API Hook Function, calling described hardware encipher equipment by described self-defined API Hook Function and rear acquisition data decryption is decrypted to described enciphered data.
As preferably, step S2 comprises: the running environment of described self-defined API Hook Function to described hardware encipher equipment checks.
As preferably, step S3 comprises:
S31, by the interpreter of described operating system or described terminal device independently interpreter store described scripted code;
S32, described destination application first performs described self-defined API Hook Function, and described self-defined API Hook Function calls described hardware encipher equipment, and described hardware encipher equipment is encrypted described scripted code thus obtains described enciphered data;
S33, described enciphered data is sent to described destination application or is stored in described hardware encipher equipment by described self-defined API Hook Function.
As preferably, step S4 comprises:
S41, described interpreter reads described enciphered data;
S42, destination application first performs described self-defined API Hook Function, and described self-defined API Hook Function calls described hardware encipher equipment, and described hardware encipher equipment is decrypted described enciphered data thus obtains data decryption;
S43, described data decryption is submitted to described interpreter by described self-defined API Hook Function;
S44, described interpreter carries out decipher to described data decryption.
As preferably, described self-defined API Hook Function comprises a filter function, described filter function is configured to when described destination application runs by the api function filtering of described operating system, and described filter function is tied to described hardware encipher equipment to call described hardware encipher equipment simultaneously.
As preferably, remove that install or integrated described self-defined API Hook Function when described destination application exits.
As preferably, described hardware encipher equipment is encryption lock or USB flash disk lock.
As preferably, described self-defined API Hook Function is revised by importing table or the mode of Registry Modifications is installed in the described destination application under windows operating system or linux operating system.
Beneficial effect of the present invention is: utilize self-defined API Hook Function and hardware encipher equipment; do not affecting the exploitation of former scripted code; under not relating to the prerequisite of interpreter principle; the potential safety hazard solve poor stability in existing software code protection scheme, the scripted code of textual form can not being protected to produce by shell, simultaneously owing to by means of hardware encipher equipment thus improve the protection intensity to scripted code.
Accompanying drawing explanation
Fig. 1 is the schematic flow sheet of the software code guard method of the embodiment of the present invention;
Fig. 2 is the schematic flow sheet of the step 3 of the software code guard method of the embodiment of the present invention;
Fig. 3 is the schematic flow sheet of the step 4 of the software code guard method of the embodiment of the present invention.
Embodiment
For making those skilled in the art understand the present invention better, first API (ApplicationProgrammingInterface) i.e. application programming interface is described.
API refers to that computer operating system (Operatingsystem) or routine library are supplied to the code of application call use.Its fundamental purpose allows Application developer be called one group of routine function, and need not consider the source code of its bottom or understand the details of its internal work mechanism.API itself is abstract, and it only defines an interface, and does not relate to the details such as how application program realizes.For example, WINDOWS operating system provides WINDOWSAPI, WINDOWSAPI is the System Programming interface for WINDOWS operating system family, it be a set of be used for control WINDOWS the outward appearance of all parts and a set of predefined WINDOWS function of behavior, each action of user can cause the operation of one or several function to tell what WINDOWS there occurs, the natural code of this similar WINDOWS to a certain extent, other language is only to provide the method for the automatic and easier access API of a kind of energy, every application program performed under WINDOWS working environment can call WINDOWSAPI.
With reference to the accompanying drawings embodiments of the invention are described in detail.
A kind of software code guard method of embodiments of the invention, as shown in Figure 1, comprises the following steps:
S1, carries out self-defined amendment at least one api function in the api function storehouse of operating system in advance and obtains self-defined API Hook Function, and itself and api function storehouse are mounted;
This self-defined API Hook Function can realize self-defining objective function, its hanging API function library makes redirect to perform this self-defined API Hook Function when operating system Using API Function storehouse, it should be noted that the parameter of self-defining function, return type, method of calling are preferably identical with the function in api function storehouse, this can realize corresponding objective function by the parameter obtaining parameter or Modification growth function very easily, and realizes without the need to the inside considering this self-defined API Hook Function;
S2, is installed to or is integrated in the destination application in terminal device under operating system by self-defined API Hook Function, described terminal device and hardware encipher equipment connection;
In the parallel port that hardware encipher equipment is plugged on terminal device usually or USB port, this terminal device is computing machine, panel computer or other smart machine;
S3, when being encrypted the scripted code be loaded in destination application, operational objective application program also first performs self-defined API Hook Function, calls hardware encipher equipment be encrypted acquisition enciphered data to the scripted code be loaded in destination application by self-defined API Hook Function;
S4, when needing the scripted code after to encryption to be decrypted, namely when enciphered data is read in operational objective application program process, first perform self-defined API Hook Function, call hardware encipher equipment by self-defined API Hook Function and rear acquisition data decryption is decrypted to enciphered data.
Above-mentioned hardware encipher equipment can be built-in with single chip circuit, the algorithm software being exclusively used in encryption is included in single-chip microcomputer, its processing power that there is judgement, analyze, and have anti-decryption capabilities initiatively, hardware encipher equipment can be encryption lock, USB flash disk lock, softdog or other encryption device.
In an embodiment of the invention, when performing above-mentioned steps S2, self-defined API Hook Function can check the running environment of hardware encipher equipment, thus the software runtime environment under guarantee operating system does not have mistake, hardware encipher equipment can normally identify, or hardware encipher equipment normally can submit registration to.
Step S3 can specifically comprise: S31, by independently interpreter stores scripts code in the interpreter of operating system or terminal device; S32, described destination application first performs self-defined API Hook Function, and self-defined API Hook Function calls hardware encipher equipment, and hardware encipher equipment is encrypted scripted code thus obtains enciphered data; S33, enciphered data is sent in destination application or is stored in hardware encipher equipment by self-defined API Hook Function.
Step S4 can specifically comprise: S41, and interpreter reads enciphered data but do not carry out decipher work to enciphered data (i.e. encryption after scripted code), and this interpreter is independently interpreter in the interpreter of operating system or terminal device; S42, above-mentioned steps S41 trigger destination application and first perform self-defined API Hook Function, and self-defined API Hook Function calls hardware encipher equipment, and hardware encipher equipment is decrypted enciphered data thus obtains data decryption; S43, data decryption is submitted to interpreter by self-defined API Hook Function; S44, interpreter data decryption is namely deciphered after scripted code carry out normal decipher and perform scripted code.
In an embodiment of the invention, when designing in advance, a filter function can be comprised in self-defined API Hook Function, filter function be configured to when destination application runs by original for operating system api function filtering (be not delete, but shielding), make destination application first can perform self-defined API Hook Function, filter function is tied to hardware encipher equipment to call hardware encipher equipment simultaneously.
In another embodiment, user can be pointed out installation or integrated self-defined API Hook Function whether is removed when destination application exits.Such as when no longer needing the operation being encrypted scripted code or deciphering, user optionally can remove self-defined API Hook Function to reduce taking system resource, improves the operational efficiency of operating system.
Self-defined API Hook Function can be installed and use under several operation systems environment in the present invention, such as self-defined API Hook Function can be revised by importing table or the mode of Registry Modifications is installed in the destination application under windows operating system or linux operating system, this installation process easily realizes.
By software code guard method provided by the present invention especially to the guard method of scripted code; self-defined API Hook Function is loaded in destination application and performs; this process does not affect the exploitation to scripted code itself; have nothing to do with interpreter principle thus simplify step and improve versatility; solve scripted code usually to exist in the form of text and the potential safety hazard brought; simultaneously owing to employing hardware encipher equipment when being encrypted scripted code, this makes to obtain effective raising to the protection intensity of scripted code.
Above embodiment is only exemplary embodiment of the present invention, and be not used in restriction the present invention, protection scope of the present invention is defined by the claims.Those skilled in the art can in essence of the present invention and protection domain, and make various amendment or equivalent replacement to the present invention, this amendment or equivalent replacement also should be considered as dropping in protection scope of the present invention.

Claims (8)

1. a software code guard method, is characterized in that, comprises the following steps:
S1, carries out self-defined amendment at least one api function in the api function storehouse of operating system in advance and obtains self-defined API Hook Function, and itself and described api function storehouse are mounted;
S2, is installed to or is integrated in the destination application in terminal device under operating system by described self-defined API Hook Function, described terminal device and hardware encipher equipment connection;
S3, when being encrypted the scripted code be loaded in described destination application, run described destination application and first perform described self-defined API Hook Function, calling described hardware encipher equipment by described self-defined API Hook Function and acquisition enciphered data is encrypted to the scripted code be loaded in described destination application;
S4, when being decrypted described enciphered data, run described destination application and first perform described self-defined API Hook Function, calling described hardware encipher equipment by described self-defined API Hook Function and rear acquisition data decryption is decrypted to described enciphered data.
2. software code guard method according to claim 1, it is characterized in that, step S2 comprises: the running environment of described self-defined API Hook Function to described hardware encipher equipment checks.
3. software code guard method according to claim 1, it is characterized in that, step S3 comprises:
S31, by the interpreter of described operating system or described terminal device independently interpreter store described scripted code;
S32, described destination application first performs described self-defined API Hook Function, and described self-defined API Hook Function calls described hardware encipher equipment, and described hardware encipher equipment is encrypted described scripted code thus obtains described enciphered data;
S33, described enciphered data is sent to described destination application or is stored in described hardware encipher equipment by described self-defined API Hook Function.
4. software code guard method according to claim 3, it is characterized in that, step S4 comprises:
S41, described interpreter reads described enciphered data;
S42, destination application first performs described self-defined API Hook Function, and described self-defined API Hook Function calls described hardware encipher equipment, and described hardware encipher equipment is decrypted described enciphered data thus obtains data decryption;
S43, described data decryption is submitted to described interpreter by described self-defined API Hook Function;
S44, described interpreter carries out decipher to described data decryption.
5. software code guard method according to claim 1; it is characterized in that; described self-defined API Hook Function comprises a filter function; described filter function is configured to when described destination application runs by the api function filtering of described operating system, and described filter function is tied to described hardware encipher equipment to call described hardware encipher equipment simultaneously.
6. software code guard method according to claim 1, is characterized in that, removes that install or integrated described self-defined API Hook Function when described destination application exits.
7. software code guard method according to claim 1, is characterized in that, described hardware encipher equipment is encryption lock or USB flash disk lock.
8. software code guard method according to claim 1; it is characterized in that, described self-defined API Hook Function is revised by importing table or the mode of Registry Modifications is installed in the described destination application under windows operating system or linux operating system.
CN201510845479.3A 2015-11-26 2015-11-26 Software code guard method Active CN105303073B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510845479.3A CN105303073B (en) 2015-11-26 2015-11-26 Software code guard method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510845479.3A CN105303073B (en) 2015-11-26 2015-11-26 Software code guard method

Publications (2)

Publication Number Publication Date
CN105303073A true CN105303073A (en) 2016-02-03
CN105303073B CN105303073B (en) 2018-07-06

Family

ID=55200335

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510845479.3A Active CN105303073B (en) 2015-11-26 2015-11-26 Software code guard method

Country Status (1)

Country Link
CN (1) CN105303073B (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106407800A (en) * 2016-09-20 2017-02-15 腾讯科技(深圳)有限公司 A hook method and a terminal device
CN107122631A (en) * 2017-04-26 2017-09-01 北京洋浦伟业科技发展有限公司 The transparent encryption method and device of a kind of script file
CN107784231A (en) * 2016-08-24 2018-03-09 北京花甲科技有限公司 The execution of instruction and on-the-flier compiler method, apparatus and electronic equipment
CN108228411A (en) * 2016-12-14 2018-06-29 北京国双科技有限公司 A kind of method and mobile terminal of the monitoring of APP interfaces
WO2019000736A1 (en) * 2017-06-30 2019-01-03 武汉斗鱼网络科技有限公司 File encryption method and device, computer readable storage medium and apparatus
WO2019000737A1 (en) * 2017-06-30 2019-01-03 武汉斗鱼网络科技有限公司 File decryption method and device, computer readable storage medium and apparatus
CN109409033A (en) * 2018-09-11 2019-03-01 平安科技(深圳)有限公司 Code encryption method, apparatus, computer installation and storage medium
CN110688161A (en) * 2018-07-06 2020-01-14 英研智能移动股份有限公司 Peripheral hardware operation method and system
CN112395597A (en) * 2019-08-15 2021-02-23 奇安信安全技术(珠海)有限公司 Method and device for detecting website application vulnerability attack and storage medium

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090094601A1 (en) * 2006-04-27 2009-04-09 Vstovskiy Vladimir Nikitich Method and device for protecting software from unauthorized use
CN103413074A (en) * 2013-07-08 2013-11-27 北京深思数盾科技有限公司 Method and device for protecting software through API
CN104252593A (en) * 2013-06-27 2014-12-31 贝壳网际(北京)安全技术有限公司 Script monitoring method and device

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090094601A1 (en) * 2006-04-27 2009-04-09 Vstovskiy Vladimir Nikitich Method and device for protecting software from unauthorized use
CN104252593A (en) * 2013-06-27 2014-12-31 贝壳网际(北京)安全技术有限公司 Script monitoring method and device
CN103413074A (en) * 2013-07-08 2013-11-27 北京深思数盾科技有限公司 Method and device for protecting software through API

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107784231A (en) * 2016-08-24 2018-03-09 北京花甲科技有限公司 The execution of instruction and on-the-flier compiler method, apparatus and electronic equipment
CN107784231B (en) * 2016-08-24 2021-06-08 顶象科技有限公司 Instruction execution and dynamic compiling method and device and electronic equipment
CN106407800A (en) * 2016-09-20 2017-02-15 腾讯科技(深圳)有限公司 A hook method and a terminal device
CN108228411A (en) * 2016-12-14 2018-06-29 北京国双科技有限公司 A kind of method and mobile terminal of the monitoring of APP interfaces
CN107122631A (en) * 2017-04-26 2017-09-01 北京洋浦伟业科技发展有限公司 The transparent encryption method and device of a kind of script file
WO2019000736A1 (en) * 2017-06-30 2019-01-03 武汉斗鱼网络科技有限公司 File encryption method and device, computer readable storage medium and apparatus
WO2019000737A1 (en) * 2017-06-30 2019-01-03 武汉斗鱼网络科技有限公司 File decryption method and device, computer readable storage medium and apparatus
CN110688161A (en) * 2018-07-06 2020-01-14 英研智能移动股份有限公司 Peripheral hardware operation method and system
CN109409033A (en) * 2018-09-11 2019-03-01 平安科技(深圳)有限公司 Code encryption method, apparatus, computer installation and storage medium
CN112395597A (en) * 2019-08-15 2021-02-23 奇安信安全技术(珠海)有限公司 Method and device for detecting website application vulnerability attack and storage medium

Also Published As

Publication number Publication date
CN105303073B (en) 2018-07-06

Similar Documents

Publication Publication Date Title
CN105303073A (en) Protecting method for software codes
US10853270B2 (en) Cryptographic pointer address encoding
CN102043932B (en) Method for preventing Java program from being decompiled
CN105683990B (en) Method and apparatus for protecting dynamic base
CN103324872B (en) Based on the guard method of Android application program and the system of order confusion
US20160203087A1 (en) Method for providing security for common intermediate language-based program
CN104680039B (en) A kind of data guard method and device of application program installation kit
US20160239671A1 (en) Method and device for protecting an application and method and device for executing a protected application thus protected
US20160210216A1 (en) Application Control Flow Models
Arzt et al. Instrumenting android and java applications as easy as abc
US20170024230A1 (en) Method, apparatus, and computer-readable medium for ofuscating execution of an application on a virtual machine
US9336383B2 (en) Mitigating just-in-time spraying attacks in a network environment
Coppens et al. Feedback-driven binary code diversification
CN103745141A (en) Method for preventing application program in intelligent terminal android system from being decompiled
CN110414261A (en) A kind of data desensitization method, device, equipment and readable storage medium storing program for executing
CN110717181B (en) Non-control data attack detection method and device based on novel program dependency graph
US10579791B2 (en) Technologies to defeat secure enclave side-channel attacks using fault-oriented programming
Feichtner et al. Automated binary analysis on ios: A case study on cryptographic misuse in ios applications
CN104915594B (en) Application program operation method and device
US8738931B1 (en) Method for determining and protecting proprietary source code using mnemonic identifiers
WO2015058639A1 (en) Application program protecting system and method
CN105447398A (en) Data safety protection method and device
CN102855439A (en) Executable file self-checking method and device
CN104751026A (en) Software protection method and software application method of android system, and related devices
EP3040895A1 (en) System and method for protecting a device against return-oriented programming attacks

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information

Address after: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing

Applicant after: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd.

Address before: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing

Applicant before: BEIJING SHENSI SHUDUN TECHNOLOGY Co.,Ltd.

COR Change of bibliographic data
CB02 Change of applicant information

Address after: 100193 Beijing, Haidian District, East West Road, No. 10, East Hospital, building No. 5, floor 5, layer 510

Applicant after: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd.

Address before: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing

Applicant before: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd.

COR Change of bibliographic data
GR01 Patent grant
GR01 Patent grant
CP01 Change in the name or title of a patent holder
CP01 Change in the name or title of a patent holder

Address after: 100193 5th floor 510, No. 5 Building, East Yard, No. 10 Wangdong Road, Northwest Haidian District, Beijing

Patentee after: Beijing Shendun Technology Co.,Ltd.

Address before: 100193 5th floor 510, No. 5 Building, East Yard, No. 10 Wangdong Road, Northwest Haidian District, Beijing

Patentee before: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd.