CN111857808B - Renaming method and renaming device for symbols - Google Patents
Renaming method and renaming device for symbols Download PDFInfo
- Publication number
- CN111857808B CN111857808B CN202010575254.1A CN202010575254A CN111857808B CN 111857808 B CN111857808 B CN 111857808B CN 202010575254 A CN202010575254 A CN 202010575254A CN 111857808 B CN111857808 B CN 111857808B
- Authority
- CN
- China
- Prior art keywords
- name
- symbol
- compiling
- target
- renaming
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 58
- 238000004458 analytical method Methods 0.000 claims description 3
- 230000002194 synthesizing effect Effects 0.000 claims 1
- 230000008569 process Effects 0.000 abstract description 12
- 230000006870 function Effects 0.000 description 12
- 238000010586 diagram Methods 0.000 description 3
- 230000008439 repair process Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000001343 mnemonic effect Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/70—Software maintenance or management
- G06F8/73—Program documentation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/40—Transformation of program code
- G06F8/41—Compilation
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Technology Law (AREA)
- Multimedia (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Library & Information Science (AREA)
- Devices For Executing Special Programs (AREA)
Abstract
The invention provides a renaming method and a renaming device of symbols, wherein the renaming method comprises the following steps: acquiring a first compiling name of each symbol under a first executable file; modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation; searching a first incidence relation for each symbol to determine a corresponding first target name; the first compiled name of each symbol is renamed to a corresponding first target name. In the invention, the compiling names of the symbols are renamed, the logical relation among the symbols is hidden, the condition that the program logic is divulged can be prevented, in addition, in the renaming process, the symbols are not directly renamed, the problem that the compiling cannot be carried out after the renaming is avoided, the method is not only suitable for the object-oriented language, but also suitable for the non-object-oriented language, and has wide applicability.
Description
Technical Field
The present invention belongs to the field of network communication, and more particularly, to a renaming method and a renaming apparatus for symbols.
Background
In the technical field of embedded system software, in order to read and encode, the names of source code symbols of a program generally have functional mnemonics, that is, the names of the source code symbols are composed of characters with specific meanings, so that when a large number of source code symbols are combined together in cooperation with a partner, reasonable knocking is carried out, and the situation that the logic of the program is leaked possibly exists. Thus, for published binary executables (including dynamic libraries), it may involve a compromise of program logic if the symbol names are not treated harmlessly.
At present, in order to prevent the program logic from being divulged, symbols on a source code are generally renamed directly to generate a harmless source code, and the source code is compiled to generate a published binary executable file. The method is feasible for a non-object-oriented language (C language), but because the object-oriented language (C + +) has a symbol inheritance relationship and inherited symbols are not visually defined in the class, if the symbols are renamed, the problem of compilation exists, so that compilation is not passed, and a binary file executable file which can be released cannot be generated.
In view of this, overcoming the deficiencies of the prior art products is an urgent problem to be solved in the art.
Disclosure of Invention
The invention provides a renaming method and a renaming device for symbols, aiming at renaming the compilation names of the symbols and hiding the logic relation among the symbols, so that the situation of leakage of program logic can be prevented, and the problem that the symbols cannot be compiled after renaming does not exist in the renaming process, thereby solving the technical problems that the compilation is not passed due to the leakage of the program logic and the direct renaming of source program symbols.
To achieve the above object, according to an aspect of the present invention, there is provided a renaming method of a symbol, the renaming method including:
acquiring a first compiling name of each symbol in a first executable file, wherein the first executable file is an executable file obtained after compiling a source code;
modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation;
for each symbol, searching the first incidence relation to determine the corresponding first target name;
renaming the first compiled name for each symbol to the corresponding first target name.
Preferably, the renaming method further comprises:
obtaining a first symbol content of each symbol of the first executable file;
and establishing association between the first symbol content and the corresponding first compiling name to obtain a second association relation.
Preferably, the renaming method comprises:
acquiring a second compiling name and a second symbol content of each symbol in a second executable file, wherein the second executable file is a patch file of the first executable file;
judging whether a first compiling name which is the same as the second compiling name exists in the second incidence relation or not aiming at each symbol;
if a first compiling name which is the same as the second compiling name exists, judging whether a code corresponding to a symbol is modified or not according to a second symbol content corresponding to the second compiling name and a first symbol content corresponding to the first compiling name;
and when the code corresponding to the symbol is modified, renaming the second compiling name to the first target name through the first incidence relation.
Preferably, the renaming method further comprises:
and when the code corresponding to the symbol is not modified, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first association relation.
Preferably, the renaming method further comprises:
and if the first compiling name which is the same as the second compiling name does not exist, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first incidence relation.
Preferably, the modifying the first compilation name to obtain a first target name includes:
decomposing the first compiling name according to a naming rule of a compiler to obtain an original symbol name, a prefix item and a parameter item carried by the first compiling name;
encrypting the original symbol name to obtain an encrypted target symbol name;
and re-synthesizing the target symbol name, the prefix item and the parameter item to obtain a first target name.
Preferably, the encrypting the original symbol name to obtain the encrypted target symbol name includes:
encrypting the original symbol name by adopting MD5 operation to obtain an encrypted target symbol name;
or the like, or, alternatively,
and encrypting the original symbol name by adopting a character hash superposition mode to obtain an encrypted target symbol name.
Preferably, the obtaining the first symbol content of each symbol of the first executable file comprises:
analyzing a compiling unit under the first executable file, wherein the compiling unit comprises at least one attribute node;
and analyzing the first attribute node to obtain a first symbol content under the first attribute node.
Preferably, the obtaining the first symbol content of each symbol of the first executable file further comprises:
judging whether a next attribute node exists in the compiling unit;
and if so, continuing to analyze the next attribute node to obtain the first symbol content under the next attribute node until the analysis of all the attribute nodes is completed.
According to another aspect of the present invention, there is provided a renaming apparatus comprising at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor programmed to perform the renaming method of the present invention.
Generally, compared with the prior art, the technical scheme of the invention has the following beneficial effects: the invention provides a renaming method and a renaming device for symbols, wherein the renaming method comprises the following steps: acquiring a first compiling name of each symbol in a first executable file, wherein the first executable file is an executable file obtained after compiling a source code; modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation; for each symbol, searching the first incidence relation to determine the corresponding first target name; renaming the first compiled name for each symbol to the corresponding first target name.
In the invention, the compiling names of the symbols are renamed, the logical relation among the symbols is hidden, the condition that the program logic is divulged can be prevented, in addition, in the renaming process, the symbols are not directly renamed, the problem that the compiling cannot be carried out after the renaming is avoided, the method is not only suitable for the object-oriented language, but also suitable for the non-object-oriented language, and has wide applicability.
Drawings
Fig. 1 is a schematic flow chart of a renaming method for a symbol according to an embodiment of the present invention;
FIG. 2 is a flow chart of another renaming method for symbols according to an embodiment of the present invention;
FIG. 3 is a flowchart illustrating step 205 of FIG. 2 according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of a portion of code of an executable file provided by an embodiment of the present invention;
fig. 5 is a schematic structural diagram of a renaming apparatus according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In addition, the technical features involved in the embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated.
In order to facilitate understanding of the aspects of the present invention, first, objects related to the present invention are explained:
the first executable file: the first executable file is an executable file obtained by compiling a source code, and comprises a plurality of symbols, wherein the symbols comprise functions and variables.
The second executable file: the second executable file is a patch file of the first executable file.
First compilation name: the first compilation name is a compilation name of a symbol in the first executable file after compilation, and the first compilation name is used for descriptive convenience and is distinguished from the compilation name of a symbol in the second executable file. In the first executable file, the compiling name of each symbol is indicated and described by the first compiling name, and the values corresponding to the first compiling names of different symbols are different.
Second compilation name: the second compilation name is a compilation name of a symbol under the second executable file after compilation, and the second compilation name is used for descriptive convenience and is distinguished from the compilation name of the symbol under the first executable file. In the second executable file, the compiling name of each symbol is indicated and described by a second compiling name, and the values corresponding to the second compiling names of different symbols are different.
The first target name: in the first executable file, the first target name is a name formed by modifying the first compiling name, the first target name is used for indicating and explaining each symbol, and the values corresponding to the first target names of different symbols are different.
The second target name: in the second executable file, the second target name is a name formed by modifying the second compilation name.
First symbol content: in the first executable file, the symbol content of each symbol is indicated by the first symbol content, where "first" is for descriptive convenience to distinguish from the symbol content of the second executable file.
Second symbol content: in the second executable file, the symbol content of each symbol is indicated by a second symbol content, where "second" is for descriptive convenience to distinguish from the symbol content of the second executable file.
Example 1:
the invention provides a renaming method of symbols, which can prevent the occurrence of the condition of program logic leakage, does not directly rename the symbols in the renaming process, does not have the problem that the symbols cannot be compiled after renaming, is not only suitable for object-oriented languages, but also suitable for non-object-oriented languages, and has wide applicability.
The renaming method of the present embodiment is specifically described below with reference to fig. 1, and the renaming method includes the following steps:
step 101: the method comprises the steps of obtaining a first compiling name of each symbol under a first executable file, wherein the first executable file is an executable file obtained after source codes are compiled.
The first executable file is a result file obtained after source codes are compiled. An executable file refers to a file that can be loaded and executed by an operating system, and the executable program is presented differently under different operating system environments. Under the windows operating system, the executable program can be a type file such as an exe file, a sys file and a com file; under the Linux system, the Format of the Executable file is ELF (Executable and Linkable Format, abbreviated as ELF); under the Mac system, the executable file format is Mach-O (Mach Object, abbreviated as Mach-O). The renaming method of the present embodiment can be applied to the aforementioned executable files.
Wherein the symbols comprise respective functions and respective variables.
Step 102: and modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation.
In this embodiment, for a first executable file, a first compiling name of each symbol is modified to obtain a first target name, and the first compiling name and the corresponding first target name are associated to obtain a first association relationship.
Specifically, the first compiled name may be modified as follows to obtain the first target name:
decomposing the first compiling name according to a naming rule of a compiler to obtain a three-section type representation, wherein the three-section type representation of the first compiling name comprises an original symbol name, a prefix item and a parameter item carried by the first compiling name; encrypting the original symbol name to obtain an encrypted target symbol name; and re-synthesizing the target symbol name, the prefix item and the parameter item to obtain a first target name. The original symbol name corresponds to a symbol name of a symbol in the source code.
During the process of encrypting the original symbol name, the original symbol name may be encrypted by using MD5 operation to obtain an encrypted target symbol name; the original symbol name can also be encrypted by adopting a character hash superposition mode to obtain an encrypted target symbol name. The specific encryption method may be selected according to actual situations, and is not particularly limited.
For example, the first compilation name is "_ ZN3lfa12CandidateLfa15init _ class _ dataEv", and the first compilation name is decomposed to obtain a prefix item of "_ ZN3lfa12 CandidateLfa", an original symbol name of "init _ class _ data", and a suffix item of "Ev". And carrying out unidirectional encryption on the original symbol name 'init _ class _ data' to obtain a target symbol name.
Then, based on the naming rule, the prefix item, the target symbol name and the suffix item are synthesized into a new name, namely the first target name. Because the target symbol name is encrypted, the first target name does not carry definition information of the symbol, and the logic of the program cannot be deduced according to the target name, so that the leakage of the logic of the program can be avoided.
Step 103: and searching the first incidence relation for each symbol to determine the corresponding first target name.
Step 104: renaming the first compiled name for each symbol to the corresponding first target name.
After the first association relation is established, for each symbol, the first compiling name of the symbol is used as a keyword to search and match in the first association relation, and a first target name corresponding to the first compiling name is obtained.
Then, the first compilation name of each symbol is renamed to the corresponding first target name, and specifically, the first compilation name of a symbol can be modified into the first target name by using an OBJCOPY tool of a compilation tool chain.
In an alternative embodiment, the parameters of OBJCOPY may be configured for renaming as follows.
--redefine-sym<old>＝<new>Redefine symbol name<old>to<new>
--redefine-syms<file>--redefine-sym for all symbol pairs
listed in<file>
In an actual application scene, the symbols of the first executable file are renamed and then issued, so that the leakage of program logic can be prevented.
In the embodiment, the compiling names of the symbols are renamed, the logical relation among the symbols is hidden, the situation that the program logic is divulged can be prevented, in addition, in the renaming process, the symbols are not directly renamed, the problem that the compiling cannot be carried out after the renaming does not exist, the method is not only suitable for the object-oriented language, but also suitable for the non-object-oriented language, and the applicability is wide.
Example 2:
in an actual application scenario, in an executable program, it is required to ensure that compiled names after compiling are all different, otherwise, a situation of symbolic renaming occurs, so that the executable program cannot be loaded.
For a function, a compiler generates a compilation name by generating the compilation name of the function according to a function prototype (the function prototype comprises a function name, a return value and a parameter in source code), and is not related to the specific implementation and line number of the function. In addition, when a certain function is patched, the function prototype of the function cannot be modified, so that the compiled name cannot be changed as long as the function prototype is not changed.
With the above reasons, even if the patch code file modifies a certain symbol a in the source code file, after the patch code file is compiled, the compilation name of the symbol a may be the same as the compilation name of the source code file, that is, for the symbol a, the first compilation name is the same as the second compilation name, so that a duplicate name may occur, which may cause an error in the operation of the patch file. Therefore, for a patch file, if the symbols inside the dynamic patch are not processed, the problem of leakage of program logic is involved on one hand, and the problem of renaming is involved on the other hand.
In order to solve the foregoing problem, the present embodiment provides another renaming method, which includes the following steps:
step 201: the method comprises the steps of obtaining a first compiling name of each symbol under a first executable file, wherein the first executable file is an executable file obtained after source codes are compiled.
Step 202: and modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation.
Step 203: and searching the first incidence relation for each symbol to determine the corresponding first target name.
Step 204: renaming the first compiled name for each symbol to the corresponding first target name.
The steps 201 to 204 are the same as the steps 101 to 104 of the foregoing embodiment 1, and are not described herein again.
Step 205: a first symbol content for each symbol of the first executable file is obtained.
Step 206: and establishing association between the first symbol content and the corresponding first compiling name to obtain a second association relation.
The symbol content comprises a file path and a line number corresponding to the symbol, wherein the source code file can be positioned through the file path, and the program code of a certain symbol is found in the source code file through the line number so as to compare the code and determine whether the symbol is modified.
The second executable file has at least the following changes compared with the first executable file: adding new symbols in the mode (1); the mode (2) modifies the code of a certain symbol.
For the mode (1), because the symbol is newly added, renaming may be performed in the manner of the foregoing embodiment 1, and it is only required to ensure that the first target name in the first association relationship is not renamed.
In the case of the method (2), two cases are considered for renaming: a. after modifying the code of a certain symbol a, on one hand, to avoid the leakage of program logic, the compilation name needs to be modified, and on the other hand, to avoid the renaming problem, when modifying the compilation name, it is required to ensure that the target name of the symbol a is different from the first target name in the first executable file. b. After the code of a certain symbol a is modified, the code of the symbol a may involve the reference of the symbol B, and the symbol B is not modified, so that to avoid a program running error, in the second executable file, it is required to ensure that the target name of the symbol B in the second executable file is the same as the corresponding first target name of the symbol B in the first executable file.
In this embodiment, whether a certain symbol is modified or not may be determined according to the content of the symbol, and therefore, for the first executable file, the association relationship between the content of the symbol and the first compilation name also needs to be established according to the foregoing steps 205 and 206. The symbols under the second executable file may be renamed with reference to steps 207 to 212 as described below.
Step 207: and acquiring a second compiling name and a second symbol content of each symbol in a second executable file, wherein the second executable file is a patch file of the first executable file.
In this embodiment, the second compilation name and the second symbol content may be associated to obtain a third association relationship, so as to compare the third association relationship with the second association relationship.
Step 208: and judging whether a first compiling name which is the same as the second compiling name exists in the second incidence relation or not aiming at each symbol.
If the symbol exists, it indicates that the symbol also exists in the source code file, the patch code file modifies the symbol, or the modified symbol refers to the symbol, and further determination is needed according to the following step 210.
If not, the symbol is new, and the symbol is renamed according to step 209.
Step 209: and if the first compiling name which is the same as the second compiling name does not exist, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first incidence relation.
In this embodiment, a specific implementation process of modifying the second compilation name to obtain the second target name is the same as the manner described in step 102 of embodiment 1, and it is sufficient to ensure that the second target name is different from the first target name in the first association relationship, which is not described herein again.
Step 210: and if the first compiling name which is the same as the second compiling name exists, judging whether the code corresponding to the symbol is modified or not according to the second symbol content corresponding to the second compiling name and the first symbol content corresponding to the first compiling name.
In this embodiment, if the second compiled name of a certain symbol also exists in the second association relationship, the code of the symbol needs to be determined according to the content of the symbol, and then whether the code of the symbol is modified is determined.
Specifically, a source code file corresponding to a symbol is determined through a file path in first symbol content, a program code of the symbol is determined in the source code file according to a line number, a patch source code file corresponding to the symbol is determined through a file path in second symbol content, a program code of the symbol is determined in the patch source code file according to the line number, and the program code and the patch source code file are compared to determine whether the code of the symbol is modified.
When the code of the symbol is not modified, it indicates that the symbol is referred by other modified symbols, renames the symbol according to step 211, and needs to look up the first association relationship with a second compilation name as a key value to obtain a corresponding first target name, and renames the second compilation name to the first target name.
When the code of the symbol is modified, it indicates that the symbol is modified, and renames the symbol according to step 212, and modifies the second compiled name to obtain a second target name, where the second target name is different from the first target name in the first association relationship.
In this embodiment, a specific implementation process of modifying the second compilation name to obtain the second target name is the same as the manner described in step 102 of embodiment 1, and it is sufficient to ensure that the second target name is different from the first target name in the first association relationship, which is not described herein again.
Step 211: and when the code corresponding to the symbol is not modified, renaming the second compiling name to the first target name through the first incidence relation.
Step 212: and when the code corresponding to the symbol is modified, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first incidence relation.
In this embodiment, renaming the patch file (second executable file) of the first executable file can avoid the renaming problem.
Here, it should be noted that, for a symbol, for example, a static symbol, which is only applied to the execution file, whether the symbol is modified or not, the compiled name of the symbol needs to be renamed to the second target name.
Before step 208, the following steps are also included: and judging whether the symbol is only applied to the executed file, if so, renaming the compiling name of the symbol to be a second target name, and if not, executing the step 208.
And under the actual application scene, establishing association between the second compiling name and the corresponding target name aiming at the second executable file to obtain a fourth association relation. When the executable file is issued, the first executable file carries the first association relation, and the second executable file carries the fourth association relation. In the process of hot patch repair, for a certain modified symbol, a first target name is used as a key value to search for a first compilation name of the modified symbol under a first executable file in a first incidence relation, and the first compilation name and a second compilation name of the modified symbol are equal, so that a second compilation name of the modified symbol under a second executable file can be determined, and a fourth incidence relation is used as a key value to determine a second target name of the modified symbol under the second executable file in a second incidence relation, and symbol jump is realized to complete patch repair.
Example 3:
with reference to the foregoing embodiment, this embodiment mainly explains how to obtain the symbol content of the symbol, and with reference to fig. 3, the specific implementation process of step 205 is as follows:
step 2051: and analyzing a compiling unit under the first executable file.
In this embodiment, the compiling unit in the first executable file includes at least one attribute node, and the symbol contents of all symbols included in the first executable file can be obtained by analyzing the attribute node, where the symbol contents include a file path and a line number of a symbol. In addition, the compiling name of the symbol can be obtained by analyzing the attribute node.
Step 2052: and analyzing the first attribute node to obtain a first symbol content under the first attribute node.
In this embodiment, a first attribute node is analyzed to obtain a first symbol content under the first attribute node.
Taking fig. 4 as an example, DW _ AT _ name is an original symbol name, DW _ AT _ decl _ line is a line number, DW _ AT _ decl _ file is a file path, the file path points to a source code file corresponding to the symbol, and DW _ AT _ MIPS _ link _ name is a compilation name.
Step 2053: and judging whether a next attribute node exists in the compiling unit.
In this embodiment, it is determined whether a next attribute node exists in the compiling unit, if so, step 2054 is executed, and if not, the symbol content of the symbol and the compiling name of the symbol are recorded so as to establish the second association relationship.
Step 2054: and if so, continuing to analyze the next attribute node to obtain the first symbol content and the compiling name of the symbol under the first attribute node until the analysis of all the attribute nodes is completed.
In an actual application scenario, the executable file is an ELF file, and the process of renaming a symbol is described in detail below.
Firstly, reading and analyzing a compiling unit DW _ TAG _ complex _ unit under the section of debug _ info of the ELF element, and recording all symbol contents related to the compiling unit. Reading the first attribute node, for example, reading the information of the attribute node DW _ TAG _ subparogram and the attribute node DW _ TAG _ variable, and obtaining the compiled name and symbol content in the attribute. Specifically, the file path may be acquired through the DW _ AT _ decl _ file, the symbol name may be acquired through the DW _ AT _ line number, and the compilation name of the symbol may be acquired through the DW _ AT _ MIPS _ link _ name.
In an actual application scenario, the symbol content and the compilation name of the second executable file may be obtained in the manner described above.
Example 4:
referring to fig. 5, fig. 5 is a schematic structural diagram of a renaming apparatus according to an embodiment of the present invention. The renaming means of the present embodiment comprises one or more processors 41 and a memory 42. In fig. 5, one processor 41 is taken as an example.
The processor 41 and the memory 42 may be connected by a bus or other means, and fig. 5 illustrates the connection by a bus as an example.
The memory 42, which is a non-volatile computer-readable storage medium based on a renaming method, may be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, the methods of the above embodiments, and corresponding program instructions. The processor 41 implements the methods of the foregoing embodiments by executing non-volatile software programs, instructions, and modules stored in the memory 42 to thereby execute various functional applications and data processing.
The memory 42 may include, among other things, high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 42 may optionally include memory located remotely from processor 41, which may be connected to processor 41 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
It should be noted that, for the information interaction, execution process and other contents between the modules and units in the apparatus and system, the specific contents may refer to the description in the embodiment of the method of the present invention because the same concept is used as the embodiment of the processing method of the present invention, and are not described herein again.
Those of ordinary skill in the art will appreciate that all or part of the steps of the various methods of the embodiments may be implemented by associated hardware as instructed by a program, which may be stored on a computer-readable storage medium, which may include: a Read Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and the like.
It will be understood by those skilled in the art that the foregoing is only a preferred embodiment of the present invention, and is not intended to limit the invention, and that any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (9)
1. A method for renaming a symbol, the method comprising:
acquiring a first compiling name of each symbol in a first executable file, wherein the first executable file is an executable file obtained after compiling a source code;
modifying the first compiling name to obtain a first target name, and establishing association between the first compiling name and the corresponding first target name to obtain a first association relation; the modifying the first compilation name to obtain the first target name includes: decomposing the first compiling name according to a naming rule of a compiler to obtain an original symbol name, a prefix item and a suffix item carried by the first compiling name; encrypting the original symbol name to obtain an encrypted target symbol name; then based on the naming rule, synthesizing the prefix item, the target symbol name and the suffix item into a new name, namely a first target name; wherein, the original symbol name is the symbol name of the symbol in the source code;
for each symbol, searching the first incidence relation to determine the corresponding first target name;
renaming the first compiled name for each symbol to the corresponding first target name.
2. The renaming method according to claim 1, further comprising:
obtaining a first symbol content of each symbol of the first executable file;
and establishing association between the first symbol content and the corresponding first compiling name to obtain a second association relation.
3. The renaming method according to claim 2, wherein the renaming method comprises:
acquiring a second compiling name and a second symbol content of each symbol in a second executable file, wherein the second executable file is a patch file of the first executable file;
judging whether a first compiling name which is the same as the second compiling name exists in the second incidence relation or not aiming at each symbol;
if a first compiling name which is the same as the second compiling name exists, judging whether a code corresponding to a symbol is modified or not according to a second symbol content corresponding to the second compiling name and a first symbol content corresponding to the first compiling name;
and when the code corresponding to the symbol is modified, renaming the second compiling name to the first target name through the first incidence relation.
4. The renaming method according to claim 3, further comprising:
and when the code corresponding to the symbol is not modified, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first association relation.
5. The renaming method according to claim 3, further comprising:
and if the first compiling name which is the same as the second compiling name does not exist, modifying the second compiling name to obtain a second target name, wherein the second target name is different from the first target name in the first incidence relation.
6. The renaming method according to claim 1, wherein the encrypting the original symbol name to obtain the encrypted target symbol name comprises:
encrypting the original symbol name by adopting MD5 operation to obtain an encrypted target symbol name;
or the like, or, alternatively,
and encrypting the original symbol name by adopting a character hash superposition mode to obtain an encrypted target symbol name.
7. The renaming method according to any one of claims 2 to 5, wherein the obtaining the first symbol content of each symbol of the first executable file comprises:
analyzing a compiling unit under the first executable file, wherein the compiling unit comprises at least one attribute node;
and analyzing the first attribute node to obtain a first symbol content under the first attribute node.
8. The renaming method as claimed in claim 7, wherein said obtaining the first symbol content of each symbol of the first executable file further comprises:
judging whether a next attribute node exists in the compiling unit;
and if so, continuing to analyze the next attribute node to obtain the first symbol content under the next attribute node until the analysis of all the attribute nodes is completed.
9. A renaming device comprising at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor and programmed to perform the renaming method as claimed in any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010575254.1A CN111857808B (en) | 2020-06-22 | 2020-06-22 | Renaming method and renaming device for symbols |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010575254.1A CN111857808B (en) | 2020-06-22 | 2020-06-22 | Renaming method and renaming device for symbols |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111857808A CN111857808A (en) | 2020-10-30 |
| CN111857808B true CN111857808B (en) | 2022-04-26 |
Family
ID=72988011
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010575254.1A Active CN111857808B (en) | 2020-06-22 | 2020-06-22 | Renaming method and renaming device for symbols |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111857808B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114840400A (en) * | 2022-04-14 | 2022-08-02 | 北京字节跳动网络技术有限公司 | Abnormal component identification method, device, equipment, storage medium and program product |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6434742B1 (en) * | 1999-05-10 | 2002-08-13 | Lucent Technologies Inc. | Symbol for automatically renaming symbols in files during the compiling of the files |
| CN101040259A (en) * | 2004-10-12 | 2007-09-19 | 皮克塞(研究)有限公司 | Run time dynamic linking |
| CN103559449A (en) * | 2013-11-15 | 2014-02-05 | 华为技术有限公司 | Detection method and device for code change |
| CN104346150A (en) * | 2013-07-30 | 2015-02-11 | 华为技术有限公司 | Multiple instance business executable file generating method and device |
| CN109711119A (en) * | 2018-12-29 | 2019-05-03 | 360企业安全技术(珠海)有限公司 | The operation method and device of encrypted code, storage medium, terminal |
| US10649744B1 (en) * | 2018-11-30 | 2020-05-12 | The Mathworks, Inc. | Systems and methods for handling renaming of programming constructs in programming environments |
| CN111291397A (en) * | 2020-02-09 | 2020-06-16 | 成都神殿科技有限责任公司 | Webpage data anti-crawling encryption method |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| MY135555A (en) * | 2004-12-14 | 2008-05-30 | Axiomatic Solutions Sdn Bhd | Compile time linking via hashing technique |
| US9116712B2 (en) * | 2013-02-28 | 2015-08-25 | Microsoft Technology Licensing, Llc | Compile based obfuscation |
| US10824442B2 (en) * | 2016-03-01 | 2020-11-03 | 650 Industries, Inc. | Method and apparatus for loading multiple differing versions of a native library into a native environment |
-
2020
- 2020-06-22 CN CN202010575254.1A patent/CN111857808B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6434742B1 (en) * | 1999-05-10 | 2002-08-13 | Lucent Technologies Inc. | Symbol for automatically renaming symbols in files during the compiling of the files |
| CN101040259A (en) * | 2004-10-12 | 2007-09-19 | 皮克塞(研究)有限公司 | Run time dynamic linking |
| CN104346150A (en) * | 2013-07-30 | 2015-02-11 | 华为技术有限公司 | Multiple instance business executable file generating method and device |
| CN103559449A (en) * | 2013-11-15 | 2014-02-05 | 华为技术有限公司 | Detection method and device for code change |
| US10649744B1 (en) * | 2018-11-30 | 2020-05-12 | The Mathworks, Inc. | Systems and methods for handling renaming of programming constructs in programming environments |
| CN109711119A (en) * | 2018-12-29 | 2019-05-03 | 360企业安全技术(珠海)有限公司 | The operation method and device of encrypted code, storage medium, terminal |
| CN111291397A (en) * | 2020-02-09 | 2020-06-16 | 成都神殿科技有限责任公司 | Webpage data anti-crawling encryption method |
Non-Patent Citations (1)
| Title |
|---|
| 基于访问代理的数据加密及搜索技术研究;王国峰;《通信学报》;20180730;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111857808A (en) | 2020-10-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9141408B2 (en) | Method and system for correcting portion of software application | |
| CA2871470C (en) | Method and system for matching unknown software component to known software component | |
| Bruschi et al. | Code normalization for self-mutating malware | |
| KR101861341B1 (en) | Deobfuscation apparatus of application code and method of deobfuscating application code using the same | |
| US11599345B2 (en) | Language interoperability to automate code analysis | |
| US8677149B2 (en) | Method and system for protecting intellectual property in software | |
| CN111857808B (en) | Renaming method and renaming device for symbols | |
| CN111931185A (en) | Java anti-serialization vulnerability detection method and component | |
| JP7040559B2 (en) | Binary patch system for vehicles and how to generate and integrate binary patches. | |
| You et al. | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) | |
| Arcaini et al. | How to optimize the use of SAT and SMT solvers for test generation of boolean expressions | |
| CN109408073B (en) | Android non-invasive application repacking method | |
| Yin et al. | Formal verification by reverse synthesis | |
| CN106709287B (en) | Method and device for application shelling | |
| CN114417347A (en) | Vulnerability detection method, device, equipment, storage medium and program of application program | |
| KR102314829B1 (en) | Method for evaluating risk of data leakage in application, recording medium and device for performing the method | |
| Fornaia et al. | JSCAN: Designing an easy to use LLVM-based Static Analysis Framework | |
| CN110147238B (en) | Program compiling method, device and system | |
| De Ghein et al. | ApkDiff: Matching Android App Versions Based on Class Structure | |
| Singh et al. | Partial evaluation for java malware detection | |
| Cho et al. | Using Obfuscators to Test Compilers: A Metamorphic Experience | |
| Bazhenov et al. | Methodology of software code decomposition analysis | |
| Lviv et al. | Phorms: Pattern Combinator Library for Pharo | |
| Benthin | Classifying malicious Binaries using Code Stylometry | |
| US20220245259A1 (en) | Method for evaluating risk of data leakage in application, recording medium and device for performing the method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |