KR101845155B1 - Method and system for providing application package and method and system for executing application - Google Patents

Abstract

A method and system for providing an application package, and a method and system for executing an application are disclosed. A method for providing an application package includes: generating a first section including obfuscation information for at least one symbol included in executable code of the application package; adding the generated first section to the application package And adjusting the offset of the second section such that a second section, which is predefined in the section header table of the application package, comprises identification information for the symbol, points to the added first section have.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and system for providing an application package, a method and system for executing an application,

The following description relates to a method and system for providing an application package, and a method and system for executing an application.

An intermediate language (Intermediate Language or InterLanguage, IL) can refer to a language that goes through an intermediate language when a source language program is translated into a compiler to create a target language program. For example, if you change a high-level language program into an assembly language and then assemble it to create a machine language program, then the intermediate assembly language can be an intermediate language.

Korean Patent Laid-Open No. 10-2007-0067953 relates to an apparatus and method for converting an intermediate language of a mobile platform, which converts a mobile platform source code developed in C or C ++ into an intermediate language code required by an interpreter of a mobile communication terminal C / C ++ compiler and an intermediate language assembler for converting intermediate language codes into a format that is executed in an interpreter of a mobile communication terminal.

The code of an application that is converted to such an intermediate language is vulnerable to decompile due to its nature. For example, the code of an application written in a programming language such as Java is vulnerable to decompilation due to the conversion to an intermediate language, so that important code is easily exposed and is very vulnerable to code manipulation. As a more specific example, code written in Java is generally compiled into an extension ".class" file for each class, while for Android, code written in Java is called a "dex" file ("classes.dex" (Bytecode), which is a binary code as intermediate language code in which Java code is compiled. Bytecode is a compiled form of a Java program that can be transferred over the network when it is converted to bytecode and executed by a virtual machine (VM).

For example, files compiled in the form of intermediate language code can be provided to the electronic device from the server, and the electronic device can be executed with files compiled in the form of intermediate language code through the supporting virtual machine. Therefore, in the electronic device, it is possible to decompile files compiled in the form of an intermediate language code according to the characteristic of the intermediate language, to obtain and modify the original code, and to recompile the modified code in the form of an intermediate language code. There is a problem that it can be forged.

In order to solve such a problem, in the prior art, an obfuscation or encryption technique for an intermediate language file is applied in order to protect an intermediate language file such as a Dex file. Or use a dynamic library written in C or C ++ language that is difficult to decompile and analyze against Java, or apply obfuscation or encryption techniques to such a dynamic library. This conventional obfuscation method uses a method of dynamically restoring and executing executable code when a program is executed.

However, even though there are various methods of obfuscating executable code and dynamically restoring obfuscated code at the time of program execution, there is a technical limitation that binary code can be obtained by extracting recovered code from memory do. In this way, it is practically very difficult to prevent extraction of the recovered code from the memory.

The obfuscation method of manipulating the symbol information of the format of a program or a library makes it impossible to normally check symbols on a debugger or a disassemble even if a user who intends to forgive an application extracts recovered code through the memory Thereby providing an application package providing method and system and an application execution method and system that can make analysis difficult.

A method of providing an application package, the method comprising: generating a first section including obfuscation information for at least one symbol included in executable code of the application package; Adding the generated first section to the application package; And adjusting an offset of the second section such that a second section, which is predefined in the section header table of the application package, includes identification information for the symbol, points to the added first section And a method for providing an application package.

A server for providing an application package, the server comprising: at least one processor implemented to execute a computer-readable instruction, the at least one processor having an obfuscation for at least one symbol contained in executable code of the application package, A second section including identification information for the symbol, which is predefined in the section header table of the application package, is added to the application package, And adjusts the offset of the second section to point to the added first section.

A computer program stored in a computer-readable recording medium for executing an application execution method in combination with an electronic device embodied in a computer, the method comprising the steps of: dynamically modifying at least one symbol included in an execution code of the application package Referring to a second section including identification information for the symbol, which is predefined in the section header table of the application package for linking; Loading the obfuscation information in a first section including obfuscation information for the symbol added to the application package according to an offset included in the second section; And identifying the symbol using the obfuscation information. ≪ RTI ID = 0.0 > [0002] < / RTI >

The obfuscation method of manipulating the symbol information of the format of a program or a library makes it impossible to normally check symbols on a debugger or a disassemble even if a user who intends to forgive an application extracts recovered code through the memory Thereby making the analysis difficult.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.
2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention.
3 is a block diagram illustrating an example of components that a processor of a server may include in one embodiment of the present invention.
4 is a flowchart illustrating an example of a method that a server according to an embodiment of the present invention can perform.
5 is a diagram showing an example of an ELF format in an embodiment of the present invention.
6 is a diagram showing an example of obfuscation in an embodiment of the present invention.
7 is a diagram illustrating an example of an obfuscation process in an embodiment of the present invention.
8 is a diagram illustrating an example of an obfuscated session in an embodiment of the present invention.
9 illustrates an example of disassembly for an obfuscated symbol in an embodiment of the present invention.
10 is a diagram illustrating an example of debugging a symbol-obfuscated file according to an embodiment of the present invention.
11 is a block diagram illustrating an example of components that a processor of an electronic device may include, in an embodiment of the present invention.
12 is a flowchart illustrating an example of a method that an electronic device according to an embodiment of the present invention can perform.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. 1 shows an example in which a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170 are included. 1, the number of electronic devices and the number of servers are not limited to those shown in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of electronic devices 110, 120, 130 and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants) ), And tablet PCs. For example, although FIG. 1 illustrates the shape of a smartphone as an example of the electronic device 110, in embodiments of the present invention, other electronic devices 120 (for example, , 130, 140) and / or servers 150, 160. In addition,

The communication method is not limited, and may include a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, as well as a short-range wireless communication between the devices. For example, the network 170 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. The network 170 may also include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

Each of the servers 150 and 160 is a computer device or a plurality of computers that communicate with a plurality of electronic devices 110, 120, 130 and 140 through a network 170 to provide commands, codes, files, Lt; / RTI > devices. For example, the server 150 may be a system that provides a first service to a plurality of electronic devices 110, 120, 130, 140 connected through a network 170, 170, and 140 to the first and second electronic devices 110, 120, 130, and 140, respectively. As a more specific example, the server 150 may be a system that provides an application package as a first service to a plurality of electronic devices 110, 120, 130, 140, and the server 160 may execute an application A system for providing a second service such as a game, an SNS, and a content streaming linked to a corresponding application by a plurality of electronic devices 110, 120, 130, 140.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention. 2 illustrates an internal configuration of the electronic device 1 (110) and the server 150 as an example of the electronic device. Other electronic devices 120, 130, 140 and server 160 may also have the same or similar internal configuration as electronic device 1 110 or server 150 described above.

The electronic device 1 110 and the server 150 may include memories 211 and 221, processors 212 and 222, communication modules 213 and 223 and input / output interfaces 214 and 224. The memories 211 and 221 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. Here, the ROM and the non-decaying large capacity recording device may be included as separate permanent storage devices separately from the memories 211 and 221. [ The memory 211 and the memory 221 are provided with an operating system and at least one program code (for example, a program installed in the electronic device 1 (110) and used for a browser or an application installed in the electronic device 1 Code) can be stored. These software components may be loaded from a computer readable recording medium separate from the memories 211 and 221. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into memory 211, 221 via communication modules 213, 223 rather than a computer readable recording medium. For example, at least one program is a program (e.g., a program) installed by files provided by a file distribution system (e.g., server 150) that distributes installation files of developers or applications via network 170 May be loaded into the memory 211, 221 based on the above-described application.

Processors 212 and 222 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processors 212 and 222 by the memories 211 and 221 or the communication modules 213 and 223. For example, the processor 212, 222 may be configured to execute a command received in accordance with a program code stored in a recording device, such as a memory 211, 221.

The communication modules 213 and 223 may provide functions for the electronic device 1 110 and the server 150 to communicate with each other through the network 170 and may be provided to the electronic device 1 110 and / May provide a function for communicating with another electronic device (e.g., electronic device 2 120) or another server (e.g., server 160). The request generated by the processor 212 of the electronic device 1 110 according to the program code stored in the recording device such as the memory 211 is transmitted to the server 170 via the network 170 under the control of the communication module 213 150 < / RTI > Conversely, control signals, commands, contents, files, and the like provided under the control of the processor 222 of the server 150 are transmitted to the communication module 223 of the electronic device 110 via the communication module 223 and the network 170 213 to the electronic device 1 (110). For example, control signals, commands, contents, files, and the like of the server 150 received through the communication module 213 can be transmitted to the processor 212 or the memory 211, (The above-mentioned persistent storage device), which may further include a storage medium 110.

The input / output interface 214 may be a means for interfacing with the input / output device 215. For example, the input device may include a device such as a keyboard or a mouse, and the output device may include a device such as a display. As another example, the input / output interface 214 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 215 may be composed of the electronic device 1 (110) and one device. The input / output interface 224 of the server 150 may be a means for interfacing with the server 150 or an interface with a device (not shown) for input or output that the server 150 may include. More specifically, the processor 212 of the electronic device 1 (110) uses the data provided by the server 150 or the electronic device 2 (120) in processing commands of the computer program loaded in the memory 211 A service screen or contents can be displayed on the display through the input / output interface 214. [

Also, in other embodiments, electronic device 1 110 and server 150 may include more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, electronic device 1 110 may be implemented to include at least a portion of input / output devices 215 described above, or may be implemented with other components such as a transceiver, Global Positioning System (GPS) module, camera, Elements. More specifically, when the electronic device 1 (110) is a smart phone, it may be an acceleration sensor, a gyro sensor, a camera, various physical buttons, buttons using a touch panel, input / output ports, Etc. may be further included in the electronic device 1 (110).

FIG. 3 is a block diagram illustrating an example of a component that a processor of a server may include in an embodiment of the present invention. FIG. 4 is a block diagram of a method that a server can perform according to an embodiment of the present invention. Fig.

The server 150 may be a system for providing an application package to a client (e.g., a plurality of electronic devices 110, 120, 130, 140 described with reference to FIG. 1) or a separate file distribution system. 3, the processor 222 of the server 150 includes an application package receiving unit 310, an application package storing unit 320, a first section generating unit 330, a first section adding unit 340, An offset adjusting unit 350, an application package regenerating unit 360, and an application package transmitting unit 370. The components of the processor 222 and the processor 222 may perform the steps 410 to 470 included in the application package providing method of FIG. At this point, the components of the processor 222 and the processor 222 may be implemented to execute instructions in accordance with the code of the operating system or the code of at least one program that the memory 221 contains. Here, the components of processor 222 may be representations of different functions of processor 222 performed by processor 222 in accordance with the control instructions provided by the code stored in server 150 . For example, the application package receiver 320 may be used as a functional representation of the processor 222 that controls the server 150 to cause the processor 222 to receive the application package in accordance with the control command described above.

In step 410, the application package receiving unit 310 may control the server 150 to receive the application package through the network 170. [ For example, the developer of the application may access the server 150 via the network 170 using the developer terminal. At this time, the developer can upload the application package for the application to the server 150, and the application package receiving unit 310 can control the server 150 to receive the application package uploaded to the server 150. The application package may be received by the server 150 in the form of a file (for example, an APK (Android application package) file).

In step 420, the application package storage unit 320 may control the server 150 to store the received application package in the repository of the server 150. [ The repository of the server 150 may include persistent storage that the server 150 may include and the application package store 320 may store the application package received at step 410 in a persistent store, (150).

In step 430, the first section generator 330 may generate a first section including obfuscation information for at least one symbol included in the executable code of the application package. Here, the symbols may include functions and objects included in the executable code. To this end, the first section generator 330 may invoke and obfuscate the identification information in the second section including the identification information for the symbol, and may generate the first section including the obfuscated identification information. Here, the second section may be a predefined section in the section header table of the application. For example, a dynamic string (.dynstr) section included in the Executable and Linking Format (ELF) format can include the names of symbols, such as functions and objects, contained in executable code in the form of strings. The first section generator 330 may search the dynamic string (.dynstr) section in the binary file having the ELF format of the application package and retrieve the identification information about the symbol.

In this case, for example, the first section generator 330 applies the retrieved identification information as a parameter of a one-way function such as a hash function, and outputs an operation result (for example, a hash value of the identification information) And can be generated as identification information. As another example, the first section generator 330 may generate obfuscated identification information by randomly replacing the string of the retrieved identification information.

In step 440, the first section adder 340 may add the generated first section to the application package. For example, the first section adder 340 may add the first section to the application package stored in the repository of the server 150 at step 420. As a more specific example, the first section adder 340 may add a first section between the program header table and the section header table in a binary file having the ELF format of the application package.

In step 450, the offset adjuster 350 adjusts the offset of the second section to point to the first section to which the second section, which is predefined in the section header table of the application package, contains the identification information for the symbol . For example, assuming that the second section is a dynamic string (.dynstr) section included in the ELF format described above, an electronic device (for example, electronic device 1 (110) You can refer to the dynamic string section for dynamic linking to symbols such as objects. At this time, the offset adjustment unit 350 may adjust the offset of the dynamic string section to point to the first section so that the dynamic string section does not provide identification information for the normal symbol, and can provide the obfuscated identification information. In this case, the electronic device referring to the dynamic string section refers to the obfuscated identification information of the first section. Therefore, even if a person who intends to falsify the application obtains the recovered code from the memory, the debugger or the disassembler can obtain the obfuscated identification information about the function or the object, which makes it difficult to analyze the acquired code.

In step 460, the application package regenerator 360 may regenerate the application package to which the first section is added and the offset of the second section is adjusted. In other words, in step 420, an application package different from the stored application package is created. The regenerated application package may be stored and managed in the repository of the server 150.

In step 470, the application package transmitter unit 370 may control the server 150 to transmit the regenerated application package through the network. For example, the server 150 may be a file distribution system that distributes application packages by itself. In this case, the server 150 can directly transmit the regenerated application package to a plurality of electronic apparatuses 110, 120, 130, and 140 that want to install and execute the application. On the other hand, the server 150 may simply be the entity that converts the application package. At this time, the server 150 may transmit the regenerated application package to the developer or may transmit the regenerated application package to a separate file distribution server. In this case, the regenerated application package may be distributed to a plurality of electronic devices 110, 120, 130, and 140 through a developer or a separate file distribution server.

5 is a diagram showing an example of an ELF format in an embodiment of the present invention. 5 shows an example of the ELF format 500 in the form of a block diagram. Since the general ELF format is well known, a full and detailed description of the ELF format is omitted.

The ".dynstr" section 510 shown in FIG. 5 may include a string representing a name associated with an entry in the symbol table (such as the functions and objects described above) as a section with strings needed for dynamic linking. The server 150 can create a new section to include the obfuscated information (obfuscated identification information) of this string, and add the generated section to the application package. The "New.dynstr" section 520 shown in FIG. 5 shows an example of a section added to the ELF format 500 to include this obfuscated information. At this time, the offset of the section header table 530 may be changed as the "New.dynstr" section 520 is added as shown in FIG. Meanwhile, the ELF header (ELF Header) 540 included in the ELF format 500 may include an "SH_Offset" section 550 for managing the offset of the section header table 530. The server 150 may adjust the "SH_Offset" section 550 to indicate the offset of the changed section header table 530 as the offset of the section header table 530 changes. Therefore, in the electronic device that has installed the application package and runs the application, it is possible to access the section header table 530 whose offset has been changed using the "SH_Offset" section 550. Further, when the electronic device refers to the ".dynstr" section 510 to obtain the identification information of the symbol, it refers to the "New.dynstr" section 520 through the offset included in the & , And refers to the obfuscated identification information for the symbol. Thus, even if the user of the electronic device obtains the recovered code for the program through the memory, it becomes difficult to analyze the code obtained by the obfuscated identifying information referenced.

6 is a diagram showing an example of obfuscation in an embodiment of the present invention. FIG. 6 shows an example in which the ".dynstr" section 510 described with reference to FIG. 5 includes a string such as the name of the functions as shown in the first dashed box 610. 6 also shows an example where the "New.dynstr" section 520 described with reference to FIG. 5 includes the names of the obfuscated functions as shown in the second dashed box 620. quot; New dynstr "section 510 will contain an offset to point to the" New.dynstr "section 520, As shown in the dashed box 620, obfuscation makes it difficult for those who intend to forge applications to analyze the program due to obfuscated function names.

7 is a diagram illustrating an example of an obfuscation process in an embodiment of the present invention. The example screen 700 of FIG. 7 shows an example of obfuscating identification information indicating an existing symbol to generate obfuscated identification information. For example, the first line of the screen example 700 shows an example of obfuscating the identification information "_ZN23zxGameGooglePlayControl16setBestScoreSyncEii" for the symbol to generate obfuscated identification information "338ecb ".

8 is a diagram illustrating an example of an obfuscated session in an embodiment of the present invention. 8 is a diagram showing an example of a value that the "New.dynstr" section 510 generated by obfuscating the identification information of the ".dynstr" section 510 can include.

9 illustrates an example of disassembly for an obfuscated symbol in an embodiment of the present invention. The screen example 900 of FIG. 9 performs obfuscation on an ELF format file such as ".so Library ", and then displays the obfuscated" .so Library "using the IDA de- . In the screen example 900, it is difficult to analyze the program because the function names that are difficult to understand are displayed.

10 is a diagram illustrating an example of debugging a symbol-obfuscated file according to an embodiment of the present invention. A screen example 1000 of FIG. 10 shows a part of a debugging screen in which a function or object called at runtime is obfuscated when a code is dynamically analyzed using a GDB debugger. As described above, in the screen example 1000, the name of the function or the object called at the runtime is obfuscated, making it difficult to analyze the program.

Figure 11 is a block diagram illustrating an example of components that a processor of an electronic device may include in an embodiment of the present invention, Fig. 2 is a flowchart showing an example of a method. Fig.

The electronic device 1 110 may be a client system that installs an application package and executes an application. 11, the processor 212 of the electronic device 1 110 includes an application package receiving unit 1110, an application installing unit 1120, a second section referring unit 1130, an obfuscation information reading unit 1140, A symbol identifying unit 1150, and a service providing unit 1160. The components of the processor 212 and the processor 212 may perform the steps 1210 to 1260 included in the application execution method of FIG. At this time, the components of the processor 212 and the processor 212 may be implemented to execute instructions according to code of the operating system or code of at least one program that the memory 211 contains. Herein, the components of the processor 212 are representations of different functions of the processor 212 performed by the processor 212 in accordance with control commands provided by the code stored in the electronic device 110 . For example, the application package receiver 1110 may be used as a functional representation of the processor 212 that controls the electronic device 1 (110) to cause the processor 212 to receive the application package in accordance with the control command described above.

In step 1210, the application package receiving unit 1110 may control the first electronic device 110 to receive the application package via the network. For example, the electronic device 1 (110) can receive an application package containing the obfuscated symbol described above via the server 150 or via another path (developer's system or a separate file distribution system) . As already described, the received application package may include a first section (e.g., the "New.dynstr" section 520 described with reference to FIG. 6) that contains the obfuscation information for the symbol.

In step 1220, the application installing unit 1120 can install the application on the first electronic device 110 using the received application package. The application package may be created to include a module for installing the corresponding application in the electronic device 110 and the application installing unit 1120 may install the electronic device 110 in order to install the application using the module Can be controlled.

In step 1230, the second section reference unit 1130 includes identification information for a symbol, which is predefined in the section header table of the application package for dynamic linking of at least one symbol included in the executable code of the application package The second section may be referred to. The second section (e.g., the ".dynstr" section 510) may be a section pre-stored in the application package to include identification information such as a name for the symbols, Section 1130 may refer to the second section to obtain identification information for the symbol.

In step 1240, the obfuscation information leading unit 1140 may retrieve the obfuscation information in the first section including the obfuscation information on the symbol added to the application package according to the offset included in the second section. As described above, the second section, such as the ".dynstr" section 510, may include an offset to the first section, and the obfuscation information leading section 1140 may, based on control of the application, 1 section to access the observer information to control the electronic device 1 (110).

In step 1250, the symbol identifier 1150 may identify the symbol using the obfuscation information. Since the obfuscation information of the symbol is also changed to make it difficult for a person to understand the meaning of the obfuscation information, the symbol identifying unit 1150 uses the identification information of the obfuscated symbol to include information for identifying the corresponding symbol Identify the symbol, and execute code for executing the application.

In step 1260, the service providing unit 1160 may provide services according to the application using functions and objects according to the identified symbols. The service providing unit 1160 can provide the predetermined service through the electronic device 1 (110) by executing the application codes according to the control of the application. At this time, the service providing unit 1160 identifies the function or the object using the identification information of the obfuscated symbol rather than the identification information of the symbol before the obfuscation. Therefore, even if the user of the electronic device 1 (110) debugs or disassembles the code acquired from the memory, the identification information of the obfuscated symbol whose meaning is unknown can be obtained. Therefore, the analysis of the program may become difficult, and the forgery and falsification of the application may become difficult.

As described above, according to the embodiments of the present invention, even if a user who intends to forge or forgive an application extracts a recovered code through a memory by manipulating symbol information on the format of a program or a library, the debugger or the disassembler it is possible to make the analysis difficult by making it impossible to normally identify the symbol on the disassemble.

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (15)

A method of providing an application package,
Generating a first section including obfuscation information generated by obfuscating identification information of at least one symbol included in executable code of the application package;
Adding the generated first section to the application package; And
The application package includes an identification information for the symbol defined in the section header table of the application package so that the symbol of the obfuscated identification information is dynamically linked to the execution code when the application is executed using the application package Adjusting an offset of the second section such that a second section of the second section points to the added first section
The method comprising the steps of: The method according to claim 1,
Wherein the symbol comprises a function and an object contained in the executable code,
And the identification information for the symbol includes a string indicating the name of the function and the object. The method according to claim 1,
Wherein generating the first section including the obfuscation information comprises:
And the first section is generated by obfuscating the identification information included in the second section and including the obfuscated identification information. The method of claim 3,
Wherein generating the first section including the obfuscation information comprises:
And applying the loaded identification information as a parameter of the one-way function to generate an operation result according to the one-way function as the obfuscated identification information. The method of claim 3,
Wherein generating the first section including the obfuscation information comprises:
And the obfuscated identification information is generated by randomly replacing the string of the loaded identification information. The method according to claim 1,
Wherein the step of adding the generated first section to the application package comprises:
And adjusting a section header offset included in the header of the application package so as to indicate an offset of the section header table changed by adding the first section to the application package. The method according to claim 1,
Regenerating an application package to which the first section is added and the offset of the second section is adjusted; And
Transmitting the regenerated application package through a network
The method comprising the steps of: A server for providing an application package,
At least one processor configured to execute computer readable instructions,
Lt; / RTI >
Wherein the at least one processor comprises:
Generating a first section including obfuscation information generated by obfuscating identification information of at least one symbol included in executable code of the application package,
Adding the generated first section to the application package,
The application package includes an identification information for the symbol defined in the section header table of the application package so that the symbol of the obfuscated identification information is dynamically linked to the execution code when the application is executed using the application package Adjusting the offset of the second section such that a second section of the second section points to the added first section
Lt; / RTI > 9. The method of claim 8,
Wherein the symbol comprises a function and an object contained in the executable code,
Wherein the identification information for the symbol includes a string indicating the name of the function and the object. 9. The method of claim 8,
Wherein the at least one processor is further configured to generate a first section containing the obfuscation information,
And the second section generates the first section including the obfuscated identification information by obfuscating the identification information included in the second section. 9. The method of claim 8,
Wherein the at least one processor is further configured to add the generated first section to the application package,
And adjusts a section header offset included in the header of the application package to indicate an offset of the section header table changed by adding the first section to the application package. 9. The method of claim 8,
Wherein the at least one processor comprises:
Regenerating an application package in which the first section is added and the offset of the second section is adjusted,
Controlling the server to transmit the regenerated application package over a network
Lt; / RTI > A computer program stored in a computer-readable medium for executing an application execution method in combination with a computer-implemented electronic apparatus,
The application execution method includes:
Referring to a second section predefined in the section header table of the application package and containing identification information for the symbol, for dynamic linking of at least one symbol contained in executable code of the application package;
Loading the obfuscation information in a first section including obfuscation information for the symbol added to the application package according to an offset included in the second section; And
Identifying the symbol using the obfuscation information
And a computer program product. 14. The method of claim 13,
Wherein the symbol comprises a function and an object contained in the executable code,
Wherein the identification information for the symbol comprises a string indicating the name of the function and the object. 14. The method of claim 13,
Wherein the first section including the obfuscation information includes information obfuscating the identification information included in the second section.

Images