KR101197214B1 - System and method of changing link sequence while an executable file is generated - Google Patents

Abstract

The present invention is directed to a system and method for linking a plurality of compiled object files to change their linking order when generating an executable file.
When generating an executable file according to the present invention, the link order changing system includes a reading unit that reads a code of a project file in which a link order of files constituting the executable file is recorded, and analyzes the code of the project file read by the reading unit. An analysis unit for extracting and storing the unit header file name sets recorded in the header area and the unit source file name sets recorded in the source area, respectively, and randomly ordering the order of the unit header file name sets and the order of the unit source file name sets. A mixing section for mixing, and a recording section for recording the unit header file name sets and the unit source file name sets in the header area and the source area of the project file, respectively, in the order of mixing in the mixing section.

Description

SYSTEM AND METHOD OF CHANGING LINK SEQUENCE DURING EXECUTION FILE {SYSTEM AND METHOD OF CHANGING LINK SEQUENCE WHILE AN EXECUTABLE FILE IS GENERATED}

The present invention relates to a system and method for changing the link order when generating an executable file. More particularly, the present invention relates to a system and a method for changing the link order during a build for linking a plurality of compiled object files to generate an executable file.

In general, an executable file refers to a binary file having a PE structure, such as an exe or a dll. The process of generating the executable file is as follows.

First, the programmer writes program source files in a high-level language such as C or Pascal, which includes a number of header files (.h) and a number of source files (.c,. cpp).

Next, when the program source files (.h, .cpp) are created, the compile process compiles the program source files (.h, .cpp) written in a specific program language so that the machine or computer can use them. Create object files (.obj) which are binary files.

After compiling, the link process combines a plurality of compiled object files to generate one executable file (.exe, .dll). The link process establishes a relative position between the instructions or data, and creates a single executable that can be loaded into memory by tying the various instructions and data together. This compilation step and link step are commonly referred to as builds.

Compilation and linking for arbitrary software is usually done by a make utility program. When this make utility is launched on a computer system, the compilation and linking processes are usually performed on a computer system. By running and running as a compile and link, that is, build (build) for the software (for example, security program) specified by the user.

Generally, a 'program' or a 'file' refers to a command set written in order to execute a computer, and a 'process' refers to a program running in the computer. That is, the game program is loaded and executed in the memory of the gamer computer as a game process, and the security program is loaded and executed in the memory of the computer as the security process, and detects and blocks the hacking process that the security process is going to run in the computer. Similarly, a make utility program is executed as a compilation process and a linking process on a computer system, compiling and linking arbitrary source files into a single executable file. Of course, if the executable file thus created is executed on the computer system, it will also be loaded into the computer system's memory and executed as a process.

Meanwhile, the executable file of the security program installed in the computer is also generated through the general executable file generation process as described above. Security programs and hacking programs on computers determine whether the security is successful or the hacking depends on who runs before the other party, who first disables the other party. To do this, security companies and hackers analyze each other's hacking programs and security programs, find their way to neutralize or bypass the other party, and modify their programs.

That is, hackers analyze the security program to find the path to disable or bypass the security program, and modify the hacking program according to the analysis result. Similarly, the security programmer analyzes the hacking program to disable the hacking program and updates the security program according to the analysis result. This increases the efficiency of security by making the modified security program difficult to analyze.

However, even when generating an executable file of the updated function by the conventional executable file generating method, since the compiled header files and the source files are arranged and linked in the same order, the pre-change executable file and the post-change executable file are almost same. Therefore, even if the security program is modified to disable the hacking program, the difference is insignificant. Therefore, hackers who have finished analyzing the executable file before the change can easily analyze the executable files after the change, and easily disable the security program. There is a problem that the efficiency of security is lowered, such as to make a hacking program.

An object of the present invention, which is made to solve the above-mentioned problems of the prior art, is to execute an executable file having high security efficiency and preventing reversal by automatically changing and arranging the arrangement order of a plurality of object files constituting the security program. To provide a system and method for generating.

In order to achieve the above object, a link order changing system in generating an executable file according to an embodiment of the present invention includes a reading unit for reading a code of a project file in which a link order of files constituting the executable file is recorded, and the reading unit. An analysis unit for analyzing the code of the project file read from the unit and extracting and storing the unit header file name sets recorded in the header area, a mixing unit for randomly mixing the order of the unit header file name sets, and the unit header file name And a recording unit for recording sets in the header area of the project file in the order of mixing in the mixing unit.

In addition, the link order change system when generating an executable file according to an embodiment of the present invention, the reading unit for reading the code of the project file recorded the link order of the files constituting the executable file, and the read unit An analysis unit for analyzing the code of the project file and extracting and storing the unit source file name sets recorded in the source area, a mixing unit for randomly mixing the order of the unit source file name sets, and mixing the unit source file name sets with the mixing unit It characterized in that it comprises a recording unit for recording in the source area of the project file in the mixed order.

In addition, the method of changing the link order when generating an executable file according to an embodiment of the present invention, the reading step of the process of reading the code of the project file recorded the link order of the files constituting the executable file, the process is the reading step An analysis step of analyzing the code of the project file read from and extracting and storing the unit header file name sets recorded in the header area, a mixing step of the process randomly mixing the stored order of the unit header file name sets, And the process of recording the unit header file name sets in the mixed order in the header area of the project file.

In addition, the method of changing the link order when generating an executable file according to an embodiment of the present invention, the reading step of the process of reading the code of the project file recorded the link order of the files constituting the executable file, the process is the reading step An analysis step of analyzing the code of the project file read from and extracting and storing the unit source file name sets recorded in the source area, a mixing step of the process randomly mixing the stored order of the unit source file name sets, And a process of recording the unit source file name sets in the mixed order in the source area of the project file.

According to the present invention, since the arrangement order of a plurality of header files and a plurality of source files is automatically changed every time the security program executable file is updated, the data structure of the generated executable file is completely changed, so that a hacker can analyze the security program. This makes it difficult and extends the life of the updated security program executable.

1 illustrates an example code and a code-by-code description of a project file produced with Visual Studio 6.0.
2 is a block diagram illustrating a system for changing a link order when generating an executable file according to the present invention.
3 is a flowchart illustrating a method of changing a link order when generating an executable file according to the present invention.

Hereinafter, a link order changing system and method for generating an executable file according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Typically, executable file generation (build) for software including a security program includes a compile step and a link step. Typically, such compilation and linking are performed by a make utility software program. When the make utility is launched in a conventional manner on a computer, a compilation process and a linking process are loaded into the computer's memory to compile and link with a user-specified software (eg, a security program) to generate an executable file.

The present invention may be operated as a part of the function in addition to the make utility consisting of a conventional compilation step and a link step, or may operate as a separate program from the make utility.

Typically, when linking a plurality of compiled object files, the linking process creates and executes a single executable file by placing and linking the plurality of object files in the order recorded in the compilation's project file.

1 illustrates an example code and a code-by-code description of a project file produced with Visual Studio 6.0. Project files can be created with Visual Studio 2003 or later versions in addition to Visual Studio 6.0, but the basic structure is the same.

The project file consists of a header area and a source area as shown in FIG. The header area is the area from the header area start indication code to the header area end indication code, and the source area is the area from the source area start indication code to the source area end indication code. Within these two areas, the object file is built as an executable file. The information is recorded.

The header file information recorded in the header area is recorded with a set of start codes, file paths, file names, and end codes for all header files linked to the executable file. The start code, file path, file name, and end code for a header file are called a set of unit header file names. In addition, the source file information recorded in the source area is recorded with a set of start codes, file paths, file names, and end codes for all source files linked to the executable file. The start code, file path, file name and end code for a source file are called a set of unit source file names.

For project files created with Visual Studio 6.0, the header region start marker is #Begin Group "Header Files", the header region end marker is #End Group, and the source region start marker is #Begin Group "Source Files" , Source area end indication code #End Group. The start code of the unit header file name set is #Begin Header File, the end code is #End Header File, the start code of the unit source file name set is #Begin Source File, and the unit end code is #End Source File.

For project files created with Visual Studio 2003 or later, the header region start marker is <Filter Name = "Header Files">, the header region end marker is </ Filter>, and the source region begin marker is <Filter Name. = "Source Files">, the source zone exit code is </ Filter>. In addition, the start code of the unit header file name set and the unit source file name set is the same as <File RelativePath>, and the end code is the same as </ File>.

The linking process builds by combining the object files in the order of recording of the unit header file name sets and the unit source file name sets.

2 is a block diagram illustrating a system for changing a link order when generating an executable file according to the present invention. The link order changing system according to the present invention is loaded into a memory of a computer system to execute its function.

The link order changing system 20 according to the present invention analyzes the code of the project file read by the reading unit 21 and the project file read by the reading unit 21 and recorded in the header area. An analysis unit 22 for extracting and storing all the unit header file name sets in the storage unit 23 and extracting and storing all the unit source file name sets recorded in the source area in the storage unit 23 and the storage unit 23. Mixing unit 24 and the mixing unit 24 for randomly mixing the order of the set of the unit header file name sets stored in the storage unit and randomly mixing the order of the unit source file name sets stored in the storage unit 23. The set unit header file name sets in the order in the header area of the project file F, and the unit source file name sets mixed in the mixing unit 24 in the order of the project file F And a recording unit 25 for recording the scan area.

The project file F is composed of a header area and a source area. The header file information must be located in the header area, and the source file information must be located in the source area.

To implement this, the present invention first bundles the unit header file name sets from the header area of the project file and stores them in the storage, then bundles the unit header file name sets and randomly mixes the order, and then the original project file in the mixed order. Write in the header area of. Next, the unit source file name sets are bundled from the source area of the project file and stored in the storage unit. The unit source file name sets are bundled and randomly mixed, and then recorded in the mixed area in the source area of the original project file. Of course, the source file name sets for the source area may be mixed and recorded, and the header file name sets for the header area may be mixed and recorded.

3 is a flowchart illustrating a method of changing a link order when generating an executable file according to the present invention.

The link order changing system according to the present invention is loaded into a computer and driven.

The link order changing system opens the project file (S31) and extracts the header area of the project file (S32). The link order changing system extracts and stores the unit header file name sets described in the header area in that order (S33), then randomly mixes the order of the unit header file name sets (S34), and mixes the unit header file name sets into the mixed set. The data is recorded in the header area of the project file in order (S35).

Next, the source region of the project file is extracted (S36). The link order changing system extracts and stores the unit source file name sets described in the source area in that order (S37), and then randomly mixes the order of the unit source file name sets (S38), and mixes the unit source file name sets into the mixed set. The data is recorded in the source area of the project file in order (S39).

Of course, steps S36 to S39 may be performed after step S31, and steps S32 to S35 may be performed.

F: Project File 20: Link Order Change System
21: reading section 22: analysis section
23: storage unit 24: mixing unit
25: register

Claims (8)

A reading unit which reads the code of the project file in which the link order of the files constituting the executable file is recorded;
An analysis unit for analyzing the code of the project file read by the reading unit to extract and store the set of unit header file names recorded in the header area;
A mixing unit for randomly mixing the order of the unit header file name sets;
And a recorder for overwriting the unit header file name sets in the order of mixing in the mixing unit. A reading unit which reads the code of the project file in which the link order of the files constituting the executable file is recorded;
An analysis unit for analyzing the code of the project file read by the reading unit to extract and store the unit source file name sets recorded in the source area;
A mixing unit for randomly mixing the order of the unit source file name sets;
And a recording unit which overwrites the unit source file name sets in the order of mixing in the mixing unit in the source area of the project file. The apparatus of claim 2, wherein the analysis unit analyzes the code of the project file read by the reading unit, extracts and stores the set of unit header file names recorded in the header area,
The mixing unit randomly mixes the order of the unit header file name sets,
And the recording unit overwrites the unit header file name sets in the header region of the project file in the order of mixing in the mixing unit. A reading step in which the process reads the code of the project file in which the link order of the files constituting the executable file is recorded;
An analysis step in which the process analyzes the code of the project file read in the reading step to extract and store the unit header file name sets recorded in the header area;
A mixing step in which the process randomly mixes the stored unit header file name sets;
And a recording step of the process overwriting the unit header file name sets in the mixed order in the header area of the project file. A reading step in which the process reads the code of the project file in which the link order of the files constituting the executable file is recorded;
An analysis step in which the process analyzes the code of the project file read in the reading step and extracts and stores the set of unit source file names recorded in the source area;
A mixing step of the process randomly mixing the stored unit source file name sets;
And a recording step of the process overwriting the unit source file name sets in the mixed order in the source area of the project file. The unit header file name of claim 5, wherein the process analyzes the code of the project file, extracts and stores the unit header file name sets recorded in the header area, randomly mixes the stored unit header file name sets, and generates the unit header file name. And overriding sets in the header area of the project file in the mixed order. The method according to claim 4 or 5,
The process of changing the link order when generating an executable file, characterized in that the process performs the read step to the write step before the build for generating the executable file. The method according to claim 4 or 5,
And a process of performing the reading step or the writing step after the build to generate the executable file.

Images