JP7015120B2 - How and system to provide application packages, how and system to run applications - Google Patents

Description

The following description relates to methods and systems for providing application packages, and methods and systems for running applications.

An intermediate language (Intermediate Language or InterLanguage: IL) means a language that goes through an intermediate stage when a primitive language program is translated by a compiler to generate a target language program. For example, when a high-level language program is changed to assembly language and then assembled to generate a machine language program, the intermediate assembly language becomes the intermediate language.

Patent Document 1 relates to an intermediate language converter for a mobile platform and a method thereof, and converts a mobile platform source code developed in C or C ++ language into an intermediate language code required by an interpreter of a mobile communication terminal. It discloses a / C ++ compiler and an intermediate language assembler that converts an intermediate language code into a format executed by an interpreter of a mobile communication terminal.

The application code that undergoes such conversion to an intermediate language is vulnerable to decompilation due to its characteristics. For example, the code of an application written in a programming language such as Java (registered trademark) is vulnerable to decompilation due to its characteristic of undergoing conversion to an intermediate language, so important code is easily exposed. In addition to being afraid, it is extremely vulnerable to code operations. As a more specific example, code written in Java is generally compiled into a file with the extension ".class" for each class, and on Android (Android®), code written in Java is ". It is compiled into a dex file (bytecode which is a binary code as an intermediate language code in which Java code is compiled) composed of headers and data such as "classes.dex". Bytecode is a compiled form of a Java program, and once the Java program is converted to bytecode, it can be sent over the network and executed by a virtual machine (VM). ..

For example, a file compiled in the form of an intermediate language code can be provided from a server to an electronic device, and the electronic device can execute a file compiled in the form of an intermediate language code through a supporting virtual machine. Therefore, in electronic devices, based on the characteristics of the intermediate language, the file compiled in the form of the intermediate language code is decompiled to obtain and modify the original code, and the modified code is returned to the form of the intermediate language code. Since it is possible to compile, there is a problem that the application can be forged or altered.

In order to solve such a problem, in the prior art, techniques such as obfuscation and encryption are applied to the intermediate language file in order to protect the intermediate language file such as a dex file. Alternatively, use dynamic libraries written in the C or C ++ language, which are more difficult to decompile and analyze than Java, or apply techniques such as obfuscation and encryption to such dynamic libraries. ing. Such an existing obfuscation method uses a method of dynamically recovering and executing the execution code when the program is executed.

However, despite the fact that there are various ways to obfuscate the executable code and dynamically recover the obfuscated code at the time of program execution, the recovered code can be extracted from memory and analyzed as binary code. There is a technical limitation that can be obtained. As described above, there is a problem that it is extremely difficult in reality to prevent the extraction of the code recovered from the memory.

Korean Published Patent No. 10-2007-0067953

Even if a person who tries to forge or alter an application extracts the code recovered from the memory due to the obfuscation of the method of manipulating the symbol information in the format of the program or library, it is on the debugger (debugger) or disassembler (disassemble). Provides application package delivery methods and systems, application execution methods and systems that can be made difficult to analyze by disabling the symbols properly in.

A method of providing an application package, in which the server generates a first section containing obfuscated information about at least one symbol contained in the execution code of the application package, and the generated first section is the application package. In the second section, the second section containing the identification information about the symbol, which is predefined in the section header table of the application package, and the stage in which the server is added indicates the added first section. Provided is a method of providing an application package including a step of adjusting an offset by the server .

A server that provides an application package that includes at least one processor implemented to execute a computer-readable instruction, said at least one processor being at least one included in the execution code of the application package. Generates a first section containing obfuscated information about a symbol, adds the generated first section to the application package, and contains pre-defined identification information about the symbol in the section header table of the application package. Provided is a server that adjusts the offset of the second section so that the second section indicates the added first section.

It is a computer program stored in a computer-readable recording medium in order to execute an application execution method in combination with an electronic device realized by a computer, and the application execution method is described in an execution code of an application package. A step of referencing a second section containing identification information about the symbol, predefined in the section header table of the application package for dynamic linking to at least one symbol included, to the offset included in the second section. Therefore, a computer program including a step of reading the obfuscated information from the first section including the obfuscated information about the symbol added to the application package and a step of identifying the symbol by using the obfuscated information is provided.

Even if the code recovered from the memory is extracted by a person who tries to fake or alter the application due to the obfuscation of the method of manipulating the symbol information in the format of the program or library, it is on the debugger (debugger) or disassembler (disassemble). By making it impossible to confirm the symbol normally with, the analysis can be made difficult.

It is a figure which showed the example of the network environment in one Embodiment of this invention. It is a block diagram for demonstrating the internal structure of the electronic device and the server in one Embodiment of this invention. It is a block diagram which showed the example of the component which the processor of a server can include in one Embodiment of this invention. It is a flowchart which showed the example of the method which a server can execute in one Embodiment of this invention. It is a figure which showed the example of the ELF format in one Embodiment of this invention. It is a figure which showed the example of obfuscation in one Embodiment of this invention. It is a figure which showed the example of the obfuscation process in one Embodiment of this invention. It is a figure which showed the example of the obfuscated session in one Embodiment of this invention. It is a figure which showed the example of the disassembly for the file which obfuscated the symbol in one embodiment of this invention. It is a figure which showed the example of the bagging for the file which obfuscated a symbol in one Embodiment of this invention. It is a block diagram which showed the example of the component which can include the processor of the electronic device in one Embodiment of this invention. It is a flowchart which showed the example of the method which the electronic device can perform in one Embodiment of this invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram showing an example of a network environment according to an embodiment of the present invention.

The network environment of FIG. 1 shows an example including a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170. Such FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited as in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be fixed terminals or mobile terminals realized by a computer device. Examples of the plurality of electronic devices 110, 120, 130, 140 include smartphones, mobile phones, navigation systems, computers, notebook pancons, digital broadcasting terminals, PDAs (Personal Digital Assistants), PMPs (Portable Multimedia Players), tablets, and the like. There is. As an example, FIG. 1 shows the shape of a smartphone as an example of the electronic device 1 (110), but in the embodiment of the present invention, a wireless or wired communication method is substantially used, and the other is via the network 170. It may mean one of a variety of devices capable of communicating with the electronic devices 120, 130, 140 and / or the servers 150, 160.

The communication method is not limited, and not only the communication method utilizing the communication network (for example, mobile communication network, wired Internet, wireless Internet, broadcasting network) that can be included in the network 170, but also the short distance between devices. Wireless communication may be included. For example, the network 170 includes a PAN (personal area network), a LAN (local area network), a CAN (campus area network), a MAN (metropolitan area network), a WAN (wise Internet) network, etc. It may include any one or more of the networks. Further, the network 170 may include any one or more of network topologies, including bus networks, star networks, ring networks, mesh networks, star-bus networks, trees or hierarchical networks, etc. It is not limited to these.

Each of the servers 150 and 160 is realized by a computer device or a plurality of computer devices that communicate with a plurality of electronic devices 110, 120, 130, 140 via a network 170 to provide instructions, codes, files, contents, services, and the like. You can do it. For example, the server 150 may be a system that provides the first service to a plurality of electronic devices 110, 120, 130, 140 connected via the network 170, and the server 160 may also be a plurality of systems connected via the network 170. It may be a system that provides a second service to electronic devices 110, 120, 130, 140. As a more specific example, the server 150 may be a system that provides an application package to a plurality of electronic devices 110, 120, 130, 140 as a first service, and the server 160 may be a plurality of applications executed through the application package. The electronic device 110, 120, 130, 140 may be a system that provides a second service such as a game, SNS, or content streaming linked to the corresponding application.

FIG. 2 is a block diagram for explaining an internal configuration of an electronic device and a server according to an embodiment of the present invention. In FIG. 2, the internal configuration of the electronic device 1 (110) and the internal configuration of the server 150 will be described as an example for the electronic device. Further, the other electronic devices 120, 130, 140 and the server 160 may have the same or similar internal configuration as the above-mentioned electronic device 1 (110) or the server 150.

The electronic device 1 (110) and the server 150 may include memories 211, 221s, processors 212, 222, communication modules 213, 223, and input / output interfaces 214, 224. The memory 211 and 221 are computer-readable recording media and include a RAM (random access memory), a ROM (read only memory), and a permanent mass storage device such as a disk drive. It's fine. Here, the ROM and the permanent large-capacity storage device may be included as another permanent storage device separated from the memories 211 and 221. Further, the memories 211 and 221 include an operating system, a browser installed and driven by the electric device 1 (110) as an example, and an electronic device 1 (110) for providing a specific service. Code for applications installed in) may be stored. Such software components may be loaded from a computer-readable recording medium other than the memories 211 and 221. Such computer-readable recording media may include computer-readable recording media such as floppy (registered trademark) drives, discs, tapes, DVD / CD-ROM drives, and memory cards. In other embodiments, the software components may be loaded into memory 211, 221 through communication modules 213, 223, which are not computer readable recording media. For example, at least one program is a program installed by a file provided by a file distribution system (eg, server 150) that distributes a developer or application installation file (eg, the application described above) over network 170. May be loaded into memory 211, 221 based on.

Processors 212 and 222 may be configured to process instructions in a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to processor 212, 222 by memory 211, 221 or communication modules 213, 223. For example, the processors 212 and 222 may be configured to execute instructions received according to a program code stored in a recording device such as memories 211 and 221.

The communication modules 213 and 223 may provide a function for the electronic device 1 (110) and the server 150 to communicate with each other via the network 170, and the electronic device 1 (110) and / or the server 150 may provide other functions. A function for communicating with an electronic device (for example, electronic device 2 (120)) or another server (for example, server 160) may be provided. As an example, a request generated by the processor 212 of the electronic device 1 (110) according to a program code stored in a recording device such as a memory 211 is transmitted to the server 150 via the network 170 under the control of the communication module 213. It's okay. On the contrary, control signals, instructions, contents, files, etc. provided according to the control of the processor 222 of the server 150 are electronic devices through the communication module 223, the network 170, and the communication module 213 of the electronic device 1 (110). It may be received at 1 (110). For example, the control signal, instruction, content, file, etc. of the server 150 received through the communication module 213 may be transmitted to the processor 212, the memory 211, and the content, the file, etc. may be further included in the electronic device 1 (110). It may be stored in a storage medium (permanent storage device described above) that can be stored.

The input / output interface 214 may be a means for an interface with the input / output device 215. For example, the input device may include a device such as a keyboard or mouse, and the output device may include a device such as a display. As another example, the input / output interface 214 may be a means for an interface with a device that integrates functions for input and output, such as a touch screen. The input / output device 215 may be composed of an electronic device 1 (110) and one device. Also, the input / output interface 224 of the server 150 may be a means for interfacing with a device (not shown) for input or output that can be linked to or included in the server 150. As a more specific example, the processor 212 of the electronic device 1 (110) utilizes the data provided by the server 150 and the electronic device 2 (120) in processing the instruction of the computer program loaded in the memory 211. The configured service screens and contents may be displayed on the display through the input / output interface 214.

Also, in other embodiments, the electronic device 1 (110) and the server 150 may include more components than the components of FIG. However, most prior art components need not be clearly shown in the figure. For example, the electronic device 1 (110) may be realized to include at least a part of the above-mentioned input / output device 215, a transceiver, a GPS (Global Positioning System) module, a camera, various sensors, and a database. It may further include other components such as. As a more specific example, when the electronic device 1 (110) is a smartphone, an accelerometer, a gyro sensor, a camera, various physical buttons, buttons using a touch panel, and input / output, which are generally included in the smartphone, are included. Various components such as ports, vibrators for vibrations, etc. may be realized to be further included in the electronic device 1 (110).

FIG. 3 is a block diagram showing an example of components that can be included in the processor of the server in one embodiment of the present invention, and FIG. 4 is a block diagram of what the server executes in one embodiment of the present invention. It is a flowchart which showed the example of the possible method.

The server 150 may be a system for providing an application package to a client (for example, a plurality of electronic devices 110, 120, 130, 140 described with reference to FIG. 1) or another file distribution system. As shown in FIG. 3, the processor 222 of such a server 150 includes an application package receiving unit 310, an application package storage unit 320, a first section generation unit 330, a first section addition unit 340, an offset adjustment unit 350, and an application package. It may include a regeneration unit 360 and an application package transmission unit 370. Such processors 222 and the components of the processor 222 may perform steps 410-470 included in the application package providing method of FIG. At this time, the processor 222 and the components of the processor 222 may be realized to execute an instruction by the code of the operating system included in the memory 221 or the code of at least one program. Here, the components of the processor 222 may be representations of different functions of the processor 222 that are executed by the processor 222 according to the control instructions provided by the code stored in the server 150. For example, the application package receiver 320 may be used as a functional representation of the processor 222 that controls the server 150 so that the processor 222 receives the application package in accordance with the control instructions described above.

At step 410, the application package receiver 310 may control the server 150 to receive the application package over the network 170. For example, it is assumed that the developer of the application connects to the server 150 via the network 170 by using the developer terminal. At this time, the developer may upload the application package for the application to the server 150, and the application package receiving unit 310 may control the server 150 to receive the application package uploaded to the server 150. The application package may be received by the server 150 in the form of a file (for example, an APK (Android application package) file).

At step 420, the application package storage unit 320 may control the server 150 to store the received application package in the storage of the server 150. The storage of the server 150 may include a permanent storage device that can be included in the server 150, and the application package storage unit 320 controls the server 150 to store the application package received in the step 410 in the permanent storage device. It's okay.

At step 430, the first section generator 330 may generate a first section containing obfuscated information about at least one symbol contained in the executable code of the application package. Here, the symbol may include functions and objects contained in the executable code. For this purpose, the first section generation unit 330 may read the identification information from the second section including the identification information regarding the symbol and obfuscate it, and generate the first section including the obfuscated identification information. Here, the second section may be a section predefined in the section header table of the application. For example, the dynamic string (.dynstr) section contained in the ELF (Executable and Linking Form) format may contain the same symbol names as the functions and objects contained in the executable code in the form of strings. The first section generator 330 may find the dynamic string (.dynstr) section from the binary file having the ELF format of the application package and read the identification information about the symbol.

Here, as an example, the first section generation unit 330 applies the read identification information as a parameter of a one-way function such as a hash function, and the calculation result by the one-way function (as an example, the hash value of the identification information). ) May be generated as obfuscated identification information. As another example, the first section generation unit 330 can randomly replace the read identification information character string to generate the obfuscated identification information.

At step 440, the first section adder 340 may add the generated first section to the application package. For example, the first section addition unit 340 may add the first section to the application package stored in the storage of the server 150 in step 420. As a more specific example, the first section addition unit 340 may add the first section between the program header table and the section header table in the binary file having the ELF format of the application package.

At step 450, the offset adjuster 350 adjusts the offset of the second section to indicate the first section to which the second section containing the identification information about the symbol is added, which is predefined in the section header table of the application package. You can do it. For example, assuming that the second section is a dynamic string (.dynstr) section contained in the ELF format described above, it will be executed on the electronic device (for example, electronic device 1 (110)) in which the application package is installed. You may refer to the dynamic string section for dynamic linking to symbols such as functions and objects in your code. At this time, the offset adjustment unit 350 indicates that the offset of the dynamic string section indicates the first section so that the dynamic string section does not provide the identification information regarding the normal symbol but provides the obfuscated identification information. It may be adjusted as follows. In this case, the electronic device that refers to the dynamic string section will refer to the obfuscated identification information in the first section. Therefore, even if a person who tries to forge or alter an application obtains the code recovered from memory, only the obfuscated identification information for the function or object can be obtained by the debugger or disassembler. It can make the analysis difficult.

At step 460, the application package regenerator 360 may regenerate the application package with the first section added and the offset of the second section adjusted. In other words, an application package different from the application package stored in step 420 will be generated. The regenerated application package may be stored and managed in the server 150 vault.

At step 470, the application package transmitter 370 may control the server 150 to transmit the regenerated application package over the network. For example, the server 150 may be a file distribution system that distributes application packages by itself. In this case, the server 150 may directly send the regenerated application package to the plurality of electronic devices 110, 120, 130, 140 where the application is to be installed and executed. On the other hand, the server 150 may simply be the main body that converts the application package. In this case, the server 150 may propagate the regenerated application package to the developer or may send it to another file distribution server. In this case, the regenerated application package may be distributed to a plurality of electronic devices 110, 120, 130, 140 via a developer or another file distribution server.

FIG. 5 is a diagram showing an example of an ELF format in one embodiment of the present invention. FIG. 5 shows an example of ELF format 500 in the form of a block diagram. Since the general ELF format is well known, the overall and specific description of the ELF format will be omitted.

The ".dynstr" section 510 shown in FIG. 5 is a section having the strings required for dynamic linking, and is a string displaying the names associated with the entries in the symbol table (the same symbols as the functions and objects described above). May include. The server 150 may generate new sections of such strings to include obfuscated information (obfuscated identification information) and may add the generated sections to the application package. The "New.dynstr" section 520 shown in FIG. 5 shows an example of a section added to the ELF format 500 to include such obfuscated information. Here, as shown in FIG. 5, the offset of the section header table (Section Header Table) 530 may be changed by adding the "New.dynstr" section 520. On the other hand, the ELF Header 540 included in the ELF format 500 may include an "SH_Offset" section 550 that manages the offset of the section header table 530. The server 150 may adjust the "SH_Offset" section 550 to indicate the changed offset of the section header table 530 by changing the offset of the section header table 530. Therefore, in the electronic device in which the application package is installed and the application is driven, the "SH_Offset" section 550 can be used to access the section header table 530 whose offset has been changed. Also, if the electronic device references the ".dynstr" section 510 to obtain identification information about the symbol, the offset included in the ".dynstr" section 510 will also refer to the "New.dynstr" section 520 for the symbol. It comes to refer to the obfuscated identification information. Therefore, even if the user of the electronic device obtains the recovered code for the program from the memory, the obfuscated identification information referred to makes it difficult to analyze the obtained code.

FIG. 6 is a diagram showing an example of obfuscation in one embodiment of the present invention. FIG. 6 shows an example in which the “.dynstr” section 510 described with reference to FIG. 5 contains the same string as the name of the function, as shown in the first dotted box 610. Further, FIG. 6 shows an example in which the "New.dynstr" section 520 described with reference to FIG. 5 contains the name of the obfuscated function, as shown in the second dotted box 620. The ".dynstr" section 510 will include an offset to indicate the "New.dynstr" section 520, but if such an offset causes the "New.dynstr" section 520 to be referenced, the function name will be. Since it is obfuscated as shown in the second dotted line box 620, it is difficult for a person who tries to forge or modify the application to analyze the program due to the obfuscated function name.

FIG. 7 is a diagram showing an example of an obfuscation process in one embodiment of the present invention. The screen example 700 of FIG. 7 shows an example in which the identification information indicating an existing symbol is obfuscated and the obfuscated identification information is generated. For example, the first line of the screen example 700 shows an example in which the identification information “_ZN23zxGameGooglePlayControl16setBestScoreSyncEii” related to the symbol is obfuscated and the obfuscated identification information “338ecb” is generated.

FIG. 8 is a diagram showing an example of an obfuscated session in one embodiment of the present invention. The screen example 800 of FIG. 8 is a diagram showing an example of the value included in the “New.dynstr” section 520 generated by obfuscating the identification information of the “.dynstr” section 510.

FIG. 9 is a diagram showing an example of disassembly for a file in which symbols are obfuscated in one embodiment of the present invention. In the screen example 900 of FIG. 9, the obfuscated “.so Library” is disassembled by the IDA disassembler after obfuscating the ELF format file such as “.so Library”. Some are shown. In the screen example 900, it can be seen that the analysis of the program is made difficult by displaying the function names having meanings that are difficult to understand.

FIG. 10 is a diagram showing an example of debugging for a file in which symbols are obfuscated in one embodiment of the present invention. The screen example 1000 of FIG. 10 shows a part of a debugging screen in which functions and objects called from the runtime stage are obfuscated when the code is dynamically analyzed by using the GDB debugger. As described above, in the screen example 1000, it can be seen that the analysis of the program is made difficult by obfuscating even the names of the functions and objects called from the runtime stage.

FIG. 11 is a block diagram showing an example of components that can be included in a processor of an electronic device according to an embodiment of the present invention, and FIG. 12 is a block diagram showing an example of a component that can be included in the processor of the electronic device. It is a flowchart which showed the example of the possible method.

The electronic device 1 (110) may be a client system that installs an application package and executes an application. As shown in FIG. 11, the processor 212 of the electronic device 1 (110) has an application package receiving unit 1110, an application installing unit 1120, a second section reference unit 1130, an obfuscated information reading unit 1140, and a symbol identification unit 1150. And the service provider 1160 may be included. Such a processor 212 and components of the processor 212 may perform steps 1210 to 1260 included in the application execution method of FIG. At this time, the processor 212 and the components of the processor 212 may be realized to execute an instruction by the code of the operating system included in the memory 211 or the code of at least one program. Here, the component of the processor 212 may be an expression of different functions of the processor 212 executed by the processor 212 according to the control instruction provided by the code stored in the electronic device 1 (110). .. For example, the application package receiving unit 1110 may be used as a functional representation of the processor 212 that controls the electronic device 1 (110) so that the processor 212 receives the application package in accordance with the control instructions described above.

At step 1210, the application package receiving unit 1110 may control the electronic device 1 (110) to receive the application package over the network. For example, the electronic device 1 (110) may receive the application package containing the above-mentioned obfuscated symbol via the server 150, or may use another route (developer's system or another file distribution system). ) May be received. As mentioned above, the received application package may include a first section containing obfuscated information about the symbol (as an example, the "New.dynstr" section 520 described with reference to FIG. 6).

At step 1220, the application installation unit 1120 may install the application on the electronic device 1 (110) using the received application package. The application package may be generated to include a module for installing the application in the electronic device 1 (110), and the application installation unit 1120 electronically installs the application by using the module. The device 1 (110) may be controlled.

At step 1230, the second section reference unit 1130 contains identifying information about the symbols predefined in the application package section header table for dynamic linking to at least one symbol contained in the application package executable code. See the second section. The second section (as an example, the ".dynstr" section 510) may be a section pre-stored in the application package to include identification information such as the name of a symbol, and is subject to control of the installed application. The second section reference unit 1130 may refer to the second section to obtain identification information about the symbol.

At step 1240, the obfuscated information reading unit 1140 may read obfuscated information from the first section, which includes obfuscated information about the symbol added to the application package, according to the offset included in the second section. As mentioned above, a second section, such as the ".dynstr" section 510, may include an offset to the first section, which is difficult for the obfuscated information reading section 1140 to control the application. The electronic device 1 (110) may be controlled to access the first section shown and read the obfuscated information.

At step 1250, the symbol identification unit 1150 may use obfuscated information to identify the symbol. The obfuscated information of the symbol is also changed so that it is difficult for humans to understand the meaning of the obfuscated information, and includes information for identifying the corresponding symbol. Therefore, the symbol identification unit 1150 performs the obfuscated symbol. The identification information of may be used to identify the symbol and execute the code for executing the application.

At stage 1260, service provider 1160 may provide services by the application using functions and objects with identified symbols. The service providing unit 1160 may provide a preset service to the electronic device 1 (110) by executing the code of the application according to the control of the application. Here, the service providing unit 1160 identifies a function or an object by using the identification information about the obfuscated symbol instead of the identification information about the symbol before obfuscation. Therefore, even if the user of the electronic device 1 (110) debags or disassembles the code acquired from the memory, the identification information regarding the obfuscated symbol that has no meaning can be obtained. Therefore, it is possible to make the analysis of the program difficult, and it is possible to make it difficult to forge or modify the application.

As described above, according to the embodiment of the present invention, it is assumed that a person who tries to disassemble or alter the application extracts the code recovered from the memory by obfuscation of the method of manipulating the symbol information in the format of the program or library. Also, the analysis can be made difficult by making it impossible to confirm the symbol normally on the debugger (debugger) or the disassembler (disassemble).

The system or device described above may be implemented by a hardware component, a software component, or a combination of a hardware component and a software component. For example, the apparatus and components described in the embodiments include, for example, a processor, a controller, an ALU (arithmetic logic unit), a digital signal processor, a microprocessor, an FPGA (field programgate array), a PLU (programmable log unit), and a micro. It may be implemented utilizing one or more general purpose computers or special purpose computers, such as a processor or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on said OS. The processing device may also respond to the execution of the software, access the data, store, manipulate, process, and generate the data. For convenience of understanding, one processing device may be described as being used, but one of ordinary skill in the art may include a plurality of processing elements and / or a plurality of types of processing elements. You can understand. For example, the processing device may include multiple processors or one processor and one controller. Also, other processing configurations such as parallel processors are possible.

The software may include computer programs, codes, instructions, or a combination of one or more of these, configuring the processing equipment to operate at will, or instructing the processing equipment independently or collectively. You may do it. The software and / or data is any kind of machine, component, physical device, virtual device, computer storage medium or device, or to provide instructions or data to the processing device or to be interpreted based on the processing device. It may be permanently or temporarily embodied in the transmitted signal wave. The software is distributed on a computer system connected by a network and may be stored or executed in a distributed state. The software and data may be stored on a recording medium readable by one or more computers.

The method according to the embodiment may be realized in the form of program instructions that can be executed by various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for embodiments, or may be usable, known to those skilled in the art of computer software. Examples of computer-readable recording media include hard disks, floppy (registered trademark) discs, magnetic media such as magnetic tapes, optical media such as CD-ROMs and DVDs, and floptic discs. Optical magnetic media such as, and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, etc. are included. Examples of program instructions include machine language code, such as those generated by a compiler, as well as high-level language code, which is executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operation of the embodiment, and vice versa.

As described above, the embodiments have been described based on the limited embodiments and drawings, but those skilled in the art will be able to make various modifications and modifications from the above description. For example, the techniques described may be performed in a different order than the methods described, and / or components such as the systems, structures, devices, circuits described may be in a different form than the methods described. Appropriate results can be achieved even if they are combined or combined, and confronted or replaced by other components or equivalents.

Therefore, even if the embodiments are different, they belong to the attached claims as long as they are equivalent to the claims.

110, 120, 130, 140: Electronic device 150, 160: Server 170: Network

Claims (15)

How to provide an application package
The stage where the server generates a first section containing obfuscated information about at least one symbol contained in the executable code of the application package.
The step of adding the generated first section to the application package by the server , and the addition of the second section containing the identification information about the symbol predefined in the section header table of the application package. A method of providing an application package, comprising the step of adjusting the offset of the second section by the server to indicate one section. The symbol includes the functions and objects contained in the executable code.
The application package providing method according to claim 1, wherein the identification information relating to the symbol includes a string indicating the name of the function and the object. The stage at which the server generates the first section containing the obfuscated information is
The application package providing method according to claim 1, wherein the identification information included in the second section is read and obfuscated, and the first section including the obfuscated identification information is generated. The stage at which the server generates the first section containing the obfuscated information is
The application package providing method according to claim 3, wherein the read identification information is applied as a parameter of the one-way function, and the calculation result by the one-way function is generated as the obfuscated identification information. The stage at which the server generates the first section containing the obfuscated information is
The method for providing an application package according to claim 3, wherein the obfuscated identification information is generated by randomly replacing the read identification information character string. The stage at which the server adds the generated first section to the application package is
The application package provided according to claim 1, wherein the section header offset included in the header of the application package is adjusted to indicate the offset of the section header table modified by adding the first section to the application package. Method. The stage in which the server regenerates the application package to which the first section is added and the offset of the second section is adjusted, and the stage in which the server transmits the regenerated application package via the network. The application package providing method according to claim 1, further comprising. A server that provides application packages
Includes at least one processor implemented to execute computer-readable instructions, including
The at least one processor
Generate a first section containing obfuscated information about at least one symbol contained in the executable code of the application package.
The generated first section is added to the application package, and the second section containing the identification information about the symbol defined in the section header table of the application package indicates the added first section. To adjust the offset of the second section,
server. The symbol includes the functions and objects contained in the executable code.
The server according to claim 8, wherein the identification information regarding the symbol includes a string indicating the name of the function and the object. Because the at least one processor produces the first section containing the obfuscated information,
The server according to claim 8, wherein the identification information contained in the second section is read and obfuscated, and the first section including the obfuscated identification information is generated. The at least one processor adds the generated first section to the application package.
The server of claim 8, wherein the section header offset included in the header of the application package is adjusted to indicate the offset of the section header table modified by adding the first section to the application package. The at least one processor
Regenerate the application package with the first section added and the offset of the second section adjusted.
The server of claim 8, which controls the server to transmit the regenerated application package over a network. A computer program stored on a computer-readable recording medium that is combined with an electronic device realized by a computer to execute an application execution method.
The application execution method is
A step of referencing a second section containing identifying information about the symbol, predefined in the section header table of the application package for dynamic linking to at least one symbol contained in the executable code of the application package.
Includes a step of reading the obfuscated information from the first section containing obfuscated information about the symbol added to the application package by the offset included in the second section, and a step of identifying the symbol using the obfuscated information. Computer program. The symbol includes the functions and objects contained in the executable code.
13. The computer program of claim 13, wherein the identification information about the symbol comprises a string indicating the name of the function and the object. The computer program according to claim 13, wherein the first section including the obfuscated information includes information in which the identification information contained in the second section is obfuscated.

Images