JP5416623B2 - Self-rewriting processing device, self-rewriting processing method, and program - Google Patents

Description

  The present invention relates to a self-rewriting processing device, a self-rewriting processing method, and a program.

  Conventionally, a method for making it difficult to analyze and falsify a protection target program has been proposed (see, for example, Patent Document 1). Patent Document 1 discloses a self-rewriting technique as a technique for making it difficult to analyze and falsify a program to be protected. In the self-rewriting shown in this Patent Document 1, an instruction described in a protection target program is disguised with a fake instruction.

Japanese Patent Laid-Open No. 2004-192068

  In general, a program describes not only instructions but also data. Here, the data includes, for example, a statically defined numerical value, a master key used for encryption, and the like.

  In the method disclosed in Patent Document 1 described above, among the information described in the protection target program, instructions can be camouflaged, but data including important information such as a master key cannot be camouflaged.

  Therefore, the present invention has been made in view of the above-described problems, and for the self-rewriting processing device, the self-rewriting processing method, and the program that make it difficult to analyze and falsify a protection target program, not only instructions but also data are impersonated. The purpose is to do.

  The present invention proposes the following matters in order to solve the above problems.

  (1) The present invention provides a storage means for storing a protection target program (for example, equivalent to the cache 20 in FIG. 1) and a selection means for selecting at least one of instructions or data described in the protection target program. (For example, corresponding to the CPU 10 in FIG. 1) and processing (for example, corresponding to the processing C1, C2, and C3 in FIG. 6) referring to the data selected by the selection unit are detected from the protection target program. The detection unit (e.g., corresponding to the CPU 10 in FIG. 1) and the instruction selected by the selection unit are replaced with a dummy instruction, and for the processing detected by the detection unit, the data referred to in the processing is dummy And a dummy instruction replaced by the disguise means (for example, equivalent to the CPU 10 in FIG. 1) and the original instruction. A first restoration process (for example, equivalent to the restoration process 52 in FIG. 7) and a second restoration process (for example, the restoration process 63 in FIG. 8) that replaces the dummy data replaced by the disguise means with the original data. A first insertion means (for example, equivalent to the CPU 10 in FIG. 1) and a first instruction for replacing the original instruction replaced by execution of the first restoration process with a dummy instruction. 1 camouflage process (for example, equivalent to camouflage process 53 in FIG. 7) and a second camouflage process (for example, camouflage process in FIG. 8) that replaces original data replaced by execution of the second restoration process with dummy data And a second insertion means (for example, equivalent to the CPU 10 of FIG. 1) for inserting the program into the protection target program.

  According to this invention, the self-rewriting processing apparatus is provided with the storage means, the selection means, the detection means, the camouflage means, the first insertion means, and the second insertion means. Then, the storage target program is stored by the storage means. Further, at least one of instructions or data described in the protection target program is selected by the selection means. In addition, the process of referring to the data selected by the selection unit is detected from the protection target program by the detection unit. Further, the camouflage means replaces the instruction selected by the selection means with a dummy instruction, and replaces the data referenced in this process with dummy data for the process detected by the detection means. Also, a first restoration process for replacing the dummy instruction replaced by the camouflage means with the original instruction by the first insertion means, and a second restoration process for replacing the dummy data replaced by the camouflage means with the original data Was inserted into the protected program. Further, the second insertion means replaces the original instruction replaced by execution of the first restoration process with a dummy instruction, and the original data replaced by execution of the second restoration process is replaced with a dummy The second disguise process that replaces data is inserted into the protection target program.

  For this reason, the self-rewriting processing device selects an instruction described in the protection target program by the selection means, and replaces the instruction selected by the selection means with a dummy instruction by the impersonation means. Therefore, the self-rewriting processing device can disguise instructions described in the protection target program, and can make it difficult to analyze and falsify the protection target program.

  In addition, the self-rewriting processing device selects data described in the protection target program by the selection unit, and detects a process of referring to the data selected by the selection unit from the protection target program by the detection unit. . According to this, it is possible to grasp which data is referred to in which process in the protection target program. Then, the self-rewrite processing device replaces the data referred to in this process with dummy data for the process detected by the detection means by the camouflage means. According to the above, the self-rewrite processing device can disguise the data described in the protection target program by replacing the data referred to in the processing described in the protection target program with dummy data, Analysis and alteration of the program to be protected can be made more difficult.

  The self-rewriting processing device inserts the first restoration process and the second restoration process by the first insertion means and the second insertion means by the second insertion means with respect to the protection target program in which the instructions and data are impersonated by the impersonation means. Insert 1 impersonation process and 2nd impersonation process. Therefore, the dummy instruction can be returned to the original instruction by executing the first restoration process, and the process of referring to the dummy data is referred to by executing the second restoration process. The process can be returned to, and the protection target program can be executed correctly. Also, by executing the first camouflage process, the processed instruction can be replaced with a dummy instruction to impersonate, and by executing the second camouflage process, the original data after the process is referred to The processing can be disguised by replacing the processing with reference to dummy data. According to the above, the instruction can be read correctly only during the period from the execution of the first restoration process to the execution of the first impersonation process, and the instruction cannot be read out correctly outside the above-described period. In addition, data can be read correctly only during the period from the execution of the second restoration process to the execution of the second camouflage process, and the data cannot be read correctly outside the above-described period. Therefore, analysis and falsification of the protection target program can be made more difficult.

  (2) The present invention relates to the self-rewriting processing device according to (1), wherein the first insertion means performs a first instruction to perform a dummy instruction (for example, a replacement of the protection target program by the impersonation means). , Corresponding to the dummy instruction 51A in FIG. 7), and the second restoration process is performed by referring to the dummy data replaced by the impersonation means in the protection target program (for example, FIG. 8 is equivalent to the process 62A referring to the dummy of the data selected in step S14), and the second insertion means performs the first impersonation process by the impersonation means in the protection target program. It is inserted behind the replaced dummy instruction (for example, equivalent to the dummy instruction 51A in FIG. 7), and the second impersonation process is performed on the protection target process. The ram is inserted after the process of referring to the dummy data replaced by the camouflage means (for example, the process 62A referring to the dummy of the data selected in step S14 in FIG. 8). Has proposed a self-rewriting processor.

  According to the present invention, in the self-rewriting processing device of (1), the first insertion means inserts the first restoration process ahead of the dummy instruction replaced by the camouflage means in the protection target program, The second restoration process is inserted ahead of the process of referring to the dummy data replaced by the camouflage means in the protection target program. The second inserting means inserts the first camouflage process behind the dummy instruction replaced by the camouflage means in the protection target program, and the second camouflage process in the protection target program. It was decided to insert it behind the process of referring to the dummy data replaced by.

  For this reason, after the first restoration process is executed and the correct instruction is executed, the first impersonation process is executed. Further, after the second restoration process is executed and the process for referring to correct data is executed, the second disguise process is executed. According to this, an effect similar to the effect mentioned above can be produced.

  (3) The present invention relates to the self-rewriting processing device of (1) or (2), selection by the selection means, detection by the detection means, replacement by the impersonation means, and insertion by the first insertion means. A self-rewriting processing device is proposed in which the insertion by the second insertion means is repeated a predetermined number of times (for example, corresponding to the number of repetitions N in FIG. 3).

  According to the present invention, in the self-rewriting processing device of (1) or (2), selection by the selection means, detection by the detection means, replacement by impersonation means, insertion by the first insertion means, and second insertion means It was decided to repeat the insertion by a predetermined number of times.

  For this reason, by setting a value of 1 or more as the above-mentioned predetermined number of times, it is possible to replace a command or data with a dummy multiple times. Multiple counterfeiting can be performed. Therefore, it is possible to make it more difficult to analyze and falsify the protection target program.

(4) The present invention includes selection means (for example, equivalent to the CPU 10 in FIG. 1), detection means (for example, equivalent to the CPU 10 in FIG. 1), impersonation means (for example, equivalent to the CPU 10 in FIG. 1), first insertion means. (For example, equivalent to the restoration process 52 of FIG. 7) and a self-rewrite processing method in a self-rewrite processing device comprising a second insertion means (for example, equivalent to the restoration process 52 of FIG. 7), wherein the selection means comprises: A first step (for example, corresponding to step S14 in FIG. 3) for selecting at least one of instructions or data described in the protection target program, and the detection means refer to the data selected in the first step the process of the second step of detecting from the protected program (e.g., corresponding to steps S13 and S15 in FIG. 3) and, the impersonation means The instruction selected in the first step is replaced with a dummy instruction, and the data detected in the second step is replaced with dummy data for the process detected in the second step (for example, FIG. 3). And a first restoration process (for example, equivalent to the restoration process 52 in FIG. 7) in which the first insertion unit replaces the dummy instruction replaced in the third step with the original instruction. A fourth step (for example, FIG. 8) for inserting a second restoration process (for example, equivalent to the restoration process 63 in FIG. 8) for replacing the dummy data replaced in the third step with the original data. 3 corresponds to step S17 in), the second insertion means, first disguised to replace the original instruction substituted in the dummy instruction by executing the first restoration processing (E.g., equivalent to the camouflage process 53 of FIG. 7) and a second camouflage process (for example, the camouflage process 64 of FIG. 8) that replaces the original data replaced by the execution of the second restoration process with dummy data. And a fifth step (for example, equivalent to step S18 in FIG. 3) of inserting the above into the protection target program.

  According to the present invention, at least one instruction or data described in the protection target program is selected, and a process for referring to the selected data is detected from the protection target program. Then, the selected instruction is replaced with a dummy instruction, and for the detected process, the data referred to in this process is replaced with dummy data. Also, a first restoration process that replaces the dummy instruction with the original instruction and a second restoration process that replaces the dummy data with the original data are inserted into the protection target program. Also, a first camouflage process that replaces the original instruction with a dummy instruction and a second camouflage process that replaces the original data with dummy data are inserted into the protection target program. According to this, an effect similar to the effect mentioned above can be produced.

  (5) The present invention provides a first step (for example, corresponding to step S14 in FIG. 3) for selecting at least one of instructions or data described in the protection target program, and the data selected in the first step. A second step (for example, equivalent to step S13 and step S15 in FIG. 3) for detecting the process referring to the protection target program, and replacing the instruction selected in the first step with a dummy instruction. For the processing detected in the second step, the third step (for example, corresponding to step S16 in FIG. 3) for replacing the data referred to in the processing with dummy data, and the dummy for replacement in the third step A first restoration process (for example, equivalent to the restoration process 52 in FIG. 7) for replacing the instruction with the original instruction; The fourth step (for example, the step of FIG. 3) of inserting the second restoration process (for example, equivalent to the restoration process 63 in FIG. 8) for replacing the dummy data replaced in the step with the original data, into the protection target program. S17), a first disguise process (for example, equivalent to the disguise process 53 of FIG. 7) for replacing the original instruction replaced by the execution of the first restore process with a dummy instruction, and the second restore process A fifth disguise process (for example, equivalent to the disguise process 64 in FIG. 8) for replacing the original data replaced by the execution of the dummy data with a fifth step (for example, FIG. 3). The program for causing a computer to execute the program is proposed.

  According to this invention, by causing a computer to execute a program, a process of selecting at least one of instructions or data described in the protection target program and referring to the selected data is performed from the protection target program. To detect. Then, the selected instruction is replaced with a dummy instruction, and for the detected process, the data referred to in this process is replaced with dummy data. Also, a first restoration process that replaces the dummy instruction with the original instruction and a second restoration process that replaces the dummy data with the original data are inserted into the protection target program. Also, a first camouflage process that replaces the original instruction with a dummy instruction and a second camouflage process that replaces the original data with dummy data are inserted into the protection target program. According to this, an effect similar to the effect mentioned above can be produced.

  According to the present invention, not only instructions described in the protection target program but also data can be camouflaged, and analysis and falsification of the protection target program can be made difficult.

It is a block diagram which shows the structure of the self-rewriting processing apparatus which concerns on one Embodiment of this invention. It is a flowchart of the 1st process in the said self-rewriting processing apparatus. It is a flowchart of the 2nd process in the said self-rewriting processing apparatus. It is a figure for demonstrating a said 2nd process. It is a figure for demonstrating a said 2nd process. It is a figure for demonstrating a said 2nd process. It is a figure for demonstrating a said 2nd process. It is a figure for demonstrating a said 2nd process.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the constituent elements in the following embodiments can be appropriately replaced with existing constituent elements, and various variations including combinations with other existing constituent elements are possible. Accordingly, the description of the following embodiments does not limit the contents of the invention described in the claims.

[Configuration of Self-Rewriting Processing Device 1]
FIG. 1 is a block diagram showing a configuration of a self-rewriting processing device 1 according to an embodiment of the present invention. The self-rewriting processing device 1 includes a CPU (Central Processing Unit) 10 that performs various arithmetic processes, and a cache 20 that stores a protection target program.

  The self-rewriting processing device 1 executes only the instructions described in the protection target program by executing the second process (see FIG. 3) described later after executing the first process (refer to FIG. 2) described later. And disguise the data, making it difficult to analyze and tamper with the protected program.

[First processing]
FIG. 2 is a flowchart of the first process described above.

  In step S1, the CPU 10 selects an area to be protected from the protection target programs stored in the cache 20, and proceeds to step S2. Note that the protection target program in step S1 is described in a high-level language such as C language or Java (registered trademark). In addition, it is assumed that the area to be protected is determined from the protection target program by the user of the self-rewriting processing apparatus 1, for example.

  In step S2, the CPU 10 acquires an assembler description for the area selected in step S1 among the protection target programs stored in the cache 20, and ends the first process. In this step, for example, the above-mentioned selected area of the protection target program is compiled and converted into an assembly program.

[Second processing]
FIG. 3 is a flowchart of the second process described above.

  In step S11, the CPU 10 initializes the variable M by substituting “0” for the variable M, and proceeds to step S12.

  In step S12, the CPU 10 sets the number of iterations N (N is an integer satisfying N ≧ 0), and proceeds to step S13.

  In step S13, the CPU 10 analyzes the control structure of the protection target program of the assembler description acquired in step S2, and then proceeds to step S14. The analysis of the control structure of the protection target program will be described below with reference to FIGS.

  FIGS. 4 and 5 are diagrams showing the protection target program 100 in the assembler description obtained by the process of step S2. The protection target program 100 includes an area 110 in which data is described and an area 120 in which instructions are described.

  As shown in FIG. 5, in the area 120 where the instruction is described, an instruction that performs processing such as calculation and assignment and a branch instruction that determines whether or not the condition is satisfied are described. When the process of step S13 is performed on the protection target program 100, first, branch instructions are respectively determined in the area 120 where the instructions are described, and the process is decomposed. Next, a path that includes one or more processes executed continuously and does not include a branch is detected. FIG. 5 shows that paths A1, A2, A3, A4, and A5 are detected.

  As described above, when the process of step S13 is performed, a path that includes one or more processes that are continuously executed and does not include a branch is detected for the area in which the instruction is described in the protection target program.

  Returning to FIG. 3, in step S14, the CPU 10 selects an instruction or data to be camouflaged from the protection target programs of the assembler description whose control structure is analyzed in step S13, and proceeds to step S15.

  In step S15, the CPU 10 detects processing referring to the data selected in step S14 from the protection target program of the assembler description whose control structure is analyzed in step S13, and proceeds to step S16. The detection of the process referring to the data selected in step S14 will be described below with reference to FIGS.

  For example, assume that data B1 is selected in step S14 as shown in FIG. Then, a process referring to the data B1 is detected from the paths A1 to A5 in FIG. Here, if the data B1 is referred to in each of the processes C1, C2, and C3 in FIG. 6, when the process of step S15 is performed, these processes C1 to C3 are detected.

  If an instruction is selected in step S14, the process proceeds to step S16 without performing the above-described detection.

  Returning to FIG. 3, in step S16, the CPU 10 replaces the instruction selected in step S14 or the data referenced in the process detected in step S15 with a dummy, and proceeds to step S17. Specifically, when an instruction is selected in step S14, this instruction is replaced with a dummy instruction. If data is selected in step S14, the data referenced in the process detected in step S15 is replaced with dummy data.

  In step S17, the CPU 10 inserts a restoration process into the protection target program that has undergone the process of step S16, and then proceeds to step S18. The restoration process is a process for returning the dummy instruction and the dummy data replaced in step S16 to the original instruction and the original data, respectively. The position where this restoration process is inserted will be described below.

  When an instruction is selected in step S14, a restoration process is inserted in front of the protected program that has been subjected to the process in step S16 before the above-described instruction is replaced with a dummy in step S16 (FIG. 7 described later). reference). According to this, since the restoration process is described ahead of the dummy instruction in the protection target program, this instruction is executed after being restored from the dummy.

  On the other hand, when data is selected in step S14, the process of referring to the above-described data in the protection target program that has performed the process of step S16 is ahead of the reference data replaced with a dummy in step S16. Then, a restoration process is inserted (see FIG. 8 described later). According to this, in the protection target program, the restoration process is described ahead of the process of referring to the dummy data. Therefore, the process of referring to the dummy data returns the reference data from the dummy to the original. Will be executed.

  In step S18, the CPU 10 inserts a camouflage process into the protection target program that has performed the process of step S17, and then proceeds to step S18. The camouflage process is a process of replacing the original instruction and the original data replaced by the execution of the restoration process with a dummy instruction and dummy data, respectively. The position where this impersonation process is inserted will be described below.

  When an instruction is selected in step S14, an impersonation process is inserted behind the protection target program that has undergone the process of step S17 after the above-described instruction is replaced with a dummy in step S16 (FIG. 7 described later). reference). According to this, since the impersonation process is described behind the dummy instruction in the protection target program, after this instruction is executed, the impersonation process is executed, and this instruction is impersonated. Become.

  On the other hand, when data is selected in step S14, the process of referring to the above-described data in the protection target program that has performed the process of step S17 is behind the replacement of the referenced data with the dummy in step S16. Then, a camouflage process is inserted (see FIG. 8 described later). According to this, in the protection target program, the camouflage process is described behind the process of referring to the dummy data. Therefore, after this process is executed, the camouflage process is executed, and the process is referred to by this process. Data to be impersonated.

  In step S19, the CPU 10 adds 1 to the variable M and proceeds to step S20.

  In step S20, the CPU 10 determines whether or not the variable M is equal to or less than the number of iterations N. If the variable M is equal to or smaller than the number of iterations N, that is, if the number of times the above steps S14 to S19 are repeated is equal to or smaller than the number of iterations N, the process returns to step S14. On the other hand, if the variable M is larger than the number of iterations N, that is, if the number of times the above-described steps S14 to S19 are repeated is greater than the number of iterations N, the second process is terminated.

  FIG. 7 is a diagram showing protection target programs before and after performing the processing of steps S15 to S18 when an instruction is selected in step S14.

  The protection target program 50 indicates the protection target program after performing the process of step S14. In the protection target program 50, the area P to be protected selected in step S1 is defined, and the instruction 51 selected in step S14 is described in the area P to be protected in the protection target program 50.

  The protection target program 50A is obtained by performing the processes of steps S15 to S18 on the protection target program 50 described above. In the area P to be protected of the protection target program 50A, a dummy instruction 51A in which the instruction 51 selected in step S14 is replaced in step S16 is described. Further, the restoration process 52 inserted in step S17 is described in front of the dummy instruction 51A. Further, the camouflage process 53 inserted in step S18 is described behind the dummy instruction 51A.

  A case where the above protection target program 50A is executed will be described below. First, the restoration process 52 is executed. According to this, the dummy instruction 51A returns to the instruction 51 selected in step S14 which is the original instruction.

  Next, the instruction 51 selected in step S <b> 14, which has been restored by the execution of the restoration process 52 described above, is executed.

  Next, a camouflage process 53 is executed. According to this, after execution of the instruction 51 selected in step S14, this instruction 51 is replaced with a dummy.

  According to the above, in the protection target program 50A, the instruction 51 selected in step S14 that is the original instruction is correctly read out only during the period from the execution of the restoration process 52 to the execution of the impersonation process 53. During this period, only dummy instructions can be read out even if the instruction 51 is read out.

  FIG. 8 is a diagram showing the protection target program before and after performing the processing of steps S15 to S18 when data is selected in step S14.

  The protection target program 60 indicates the protection target program after performing the process of step S14. In the protection target program 60, the area Q to be protected selected in step S1 is defined. In the protection target program 60, the data 61 selected in step S14 and the data 61 are stored in the area Q to be protected. Processing 62 to be referred to is described.

  The protection target program 60A is obtained by performing the processing of steps S15 to S18 on the above protection target program 60. In the area Q to be protected in the protection target program 60A, the data 61 selected in step S14 and the process 62A for referring to the dummy of the data 61 are described. Here, the process 62A for referring to the dummy of the data 61 refers to the process of referring to the data 61 in which the data to be referred to is replaced with the dummy data from the data 61 in step S16. In addition, the restoration process inserted in step S17 is described in front of the process 62A referring to the dummy of the data 61. Further, the disguise process 64 inserted in step S18 is described behind the process 62A that refers to the dummy of the data 61.

  A case where the above protection target program 60A is executed will be described below. First, the restoration process 63 is executed. According to this, the process 62A for referring to the dummy of the data 61 returns to the process 62 for referring to the data 61.

  Next, a process 62 that refers to the data 61 that has been restored by the execution of the above-described restoration process 63 is executed.

  Next, a camouflage process 64 is executed. According to this, after the process 62 that refers to the data 61 is executed, the process 62 that refers to the data 61 is replaced with a process that refers to the dummy of the data 61.

  As described above, the protection target program 60A correctly reads the data 61 selected in step S14, which is the original data, only during the period from the execution of the restoration process 63 to the execution of the impersonation process 64. During this period, only dummy data can be read out even if the data 61 is read out.

  According to the self-rewriting processing device 1 described above, the following effects can be obtained.

  The self-rewrite processing device 1 performs the process of step S2 to acquire the assembler description of the protection target program, and then performs the process of step S16 to replace the instruction with a dummy instruction or perform a process of referring to data as a dummy. Or a process that refers to the data of. Therefore, the self-rewriting processing device can disguise not only the instructions described in the protection target program but also the data, and can make it difficult to analyze and falsify the protection target program.

  Further, the self-rewrite processing device 1 inserts the restoration process by the process of step S17 and the forgery process by the process of step S18 for the protection target program that has performed the process of step S16 and impersonates the instruction and data. To do. Therefore, by executing the restoration process, the dummy instruction and dummy data can be returned to the original instruction and the original data, and the protection target program can be executed correctly. Further, by executing the camouflage process, it is possible to perform the camouflage by replacing the processed instruction and data with a dummy instruction or dummy data. According to the above, it is possible to correctly read the instruction and data only during the period from the execution of the restoration process to the execution of the impersonation process, and the instruction and data cannot be correctly read outside the above period. Therefore, analysis and falsification of the protection target program can be made more difficult.

  Further, the self-rewriting processing device 1 repeats the processes of steps S14 to S19 for the number of repetitions N set in step S12. For this reason, since the instructions and data described in the protection target program can be subjected to multiple disguises that are disguised multiple times, analysis and falsification of the protection target program can be made more difficult.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

  For example, in the above-described embodiment, the impersonation process is inserted in step S18. Therefore, when the inserted camouflage process is executed, the original instruction and the original data are replaced with the dummy instruction and the dummy data, respectively. Here, the dummy instruction and the dummy data replaced by the execution of the camouflage process may be the same as or different from the dummy instruction and the dummy data replaced in step S16, respectively.

  In the above-described embodiment, after the restoration process is inserted in step S17, the impersonation process is inserted in step S18. However, the present invention is not limited to this. For example, the restoration process may be inserted after the impersonation process is inserted.

  In the above-described embodiment, the number of iterations N is set in step S12. Here, as the number of iterations N is increased, it is possible to improve the difficulty of analyzing and falsifying the protection target program. On the other hand, when executing the protection target program processed by the self-rewrite processing device 1 Performance is degraded. For this reason, the number of iterations N is determined in consideration of the degree of difficulty in analyzing and falsifying the protection target program and the performance when the protection target program processed by the self-rewrite processing device 1 is executed. Is preferred.

DESCRIPTION OF SYMBOLS 1 ... Self-rewriting processing apparatus 10 ... CPU
20: Cache 50, 50A, 60, 60A, 100 ... Protection target program 52, 63 ... Restoration processing 53, 64 ... Impersonation processing

Claims (5)

Storage means for storing the protection target program;
Selecting means for selecting at least one of instructions or data described in the protection target program;
Detecting means for detecting processing referring to the data selected by the selecting means from the protection target program;
Disguise means for replacing the instruction selected by the selection means with a dummy instruction and replacing the data referred to in the processing with dummy data for the processing detected by the detection means;
A first restoration process that replaces the dummy instruction replaced by the impersonation means with the original instruction and a second restoration process that replaces the dummy data replaced by the impersonation means with the original data First insertion means for inserting into the program;
A first disguise process for replacing the original instruction replaced by execution of the first restoration process with a dummy instruction; and a second for replacing original data replaced by execution of the second restoration process with dummy data. A self-rewriting processing apparatus comprising: a second insertion unit that inserts a camouflage process into the protection target program. The first insertion means inserts the first restoration processing ahead of the dummy instruction replaced by the camouflage means in the protection target program, and the second restoration processing is performed on the protection target program. Among them, inserted before the process of referring to the dummy data replaced by the disguise means,
The second insertion means inserts the first camouflage process behind the dummy instruction replaced by the camouflage means in the protection target program and the second camouflage process of the protection target program. 2. The self-rewriting processing apparatus according to claim 1, wherein the self-rewriting processing device is inserted behind the processing of referring to the dummy data replaced by the camouflage means.   The selection by the selection means, the detection by the detection means, the replacement by the impersonation means, the insertion by the first insertion means, and the insertion by the second insertion means are repeated a predetermined number of times. The self-rewriting processing device according to claim 1 or 2. A self-rewrite processing method in a self-rewrite processing device comprising a selection means, a detection means, a camouflage means, a first insertion means, and a second insertion means,
A first step in which the selecting means selects at least one of instructions or data described in the protection target program;
A second step of detecting, from the protection target program, a process in which the detecting means refers to the data selected in the first step;
A third step in which the camouflage means replaces the instruction selected in the first step with a dummy instruction, and replaces data referred to in the process with dummy data for the process detected in the second step; ,
The first insertion means replaces the dummy instruction replaced in the third step with the original instruction, and the second recovery replaces the dummy data replaced in the third step with the original data. A fourth step of inserting a process into the protected program;
The second insertion means replaces the original instruction replaced by the execution of the first restoration process with a dummy instruction, and the original data replaced by the execution of the second restoration process is a dummy. A self-rewriting processing method, comprising: a second disguise process for replacing the data with a fifth step of inserting into the protection target program. A first step of selecting at least one of instructions or data described in the protection target program;
A second step of detecting a process referring to the data selected in the first step from the protection target program;
A third step of replacing the instruction selected in the first step with a dummy instruction and replacing the data referenced in the process with the dummy data for the process detected in the second step;
A first restoration process that replaces the dummy instruction replaced in the third step with the original instruction, and a second restoration process that replaces the dummy data replaced in the third step with the original data. A fourth step to insert into the program;
A first disguise process for replacing the original instruction replaced by execution of the first restoration process with a dummy instruction; and a second for replacing original data replaced by execution of the second restoration process with dummy data. A program for causing a computer to execute a disguise process and a fifth step of inserting the impersonation process into the protection target program.

Images