KR102557007B1 - Method for rebuilding binary file and apparatus thereof - Google Patents

Abstract

The present invention relates to a binary file reconstruction apparatus for safely protecting a binary file from reverse engineering, comprising: a binary analyzer for analyzing the binary file and extracting essential information required for execution of the binary file from the binary file; a binary reconstruction unit for reconstructing a corresponding binary file based on essential information extracted from the binary file; and a security function insertion unit for inserting a code for performing a predetermined security function into the reconstructed binary file.

Description

Method for rebuilding binary file and apparatus thereof

The present invention relates to a method and device capable of safely protecting a binary file, and more particularly, to a method and device capable of reconstructing a binary file by extracting essential information necessary for executing a binary file.

The importance of software security continues to emerge through the ever-increasing threat of hacking and cyber warfare. In the era of the so-called 4th industrial revolution, various IT devices are being used everywhere in our lives, and security flaws in these devices not only directly affect people's lives, but can even threaten people's lives.

In order to analyze the security of software, it is necessary to decompile an executable file (ie, a binary file) of the corresponding software. Decompilation refers to extracting the original source code before compilation from already compiled machine language or assembler code, and various types of decompilation programs have recently been provided. However, there is a limit to guaranteeing the security of software by analyzing only the source code. Therefore, it is necessary to perform binary analysis on software executable files along with source code analysis.

Binary analysis refers to a process of converting binary code in machine language that humans cannot understand into source code that humans can understand, and this is called reverse engineering. For example, as shown in FIG. 1, reverse engineering is a process opposite to compilation, and is an essential and important process for information security and binary analysis technology. There are typically static analysis techniques and dynamic analysis techniques as techniques for analyzing binary codes through such reverse engineering.

Binary analysis is used for a variety of purposes. Hackers analyze target software to create malicious codes or pirated cracks, and security experts analyze malicious codes to find attack patterns or increase security by removing the possibility of an attack from software.

On the other hand, a black hacker may analyze a software binary file through binary analysis, that is, reverse engineering, and acquire source code information for the corresponding binary file in an unfair way. In order to safely protect a binary file from such reverse engineering, conventionally, a technique of removing debugging information of a binary file using a strip utility and additionally encrypting the binary file is used.

However, the conventional binary file protection method has a problem in that it cannot be applied to a specific operating system (eg, Android system) that prohibits the use of a strip utility. In addition, this method has a problem in that information removed by the strip utility is limited, so that some important information may be included in the binary file as it is. In addition, the method has a problem in that the binary file loaded into the memory exists in an unencrypted state for normal execution, and at this time, the unencrypted binary file can be obtained through a memory dump.

An object of the present invention is to provide a binary file reconstruction method and apparatus capable of safely protecting a binary file of software such as a user application program from reverse engineering.

An object of the present invention is to provide a method and apparatus capable of extracting essential information necessary for the execution of a binary file and reconstructing the corresponding binary file based on the extracted essential information.

According to an aspect of the present invention in order to achieve the above or other object, a binary analysis unit for analyzing a binary file and extracting essential information required for execution of the binary file from the binary file; a binary reconstruction unit for reconstructing a corresponding binary file based on essential information extracted from the binary file; and a security function inserting unit for inserting a code for performing a predetermined security function into the reconstructed binary file to protect a binary file from reverse engineering.

According to another aspect of the present invention, analyzing a binary file and extracting essential information required for execution of the binary file from the binary file; Reconstructing a corresponding binary file based on essential information extracted from the binary file; and inserting a code for performing a predetermined security function into the reconstructed binary file to safely protect a binary file from reverse engineering.

According to another aspect of the present invention, the process of analyzing a binary file and extracting essential information required for execution of the binary file from the binary file; Reconstructing a corresponding binary file based on essential information extracted from the binary file; and a computer program stored in a computer-readable recording medium so that a process of inserting a code for performing a predetermined security function into the reconstructed binary file can be executed on a computer.

In addition, the solution to the above problem does not enumerate all the features of the present invention. Various features of the present invention and the advantages and effects thereof will be understood in more detail with reference to specific embodiments below.

A method for reconstructing a binary file according to embodiments of the present invention and effects of the device are described as follows.

According to at least one of the embodiments of the present invention, by extracting only essential information necessary for the execution of a binary file and reconstructing the binary file based on the extracted essential information, the binary file can be safely protected from reverse engineering There are advantages.

However, the effects that can be achieved by the binary file reconstruction method and apparatus according to the embodiments of the present invention are not limited to those mentioned above, and other effects not mentioned are the techniques to which the present invention belongs from the description below. It will be clearly understood by those skilled in the art.

1 is a diagram referenced to explain reverse engineering used in binary analysis;
Figure 2 is a configuration block diagram of a binary file reconstruction device according to an embodiment of the present invention;
3A is a diagram showing the structure of an ELF file that is an executable file of a subsystem for Linux;
3B is a diagram showing the structure of a PE file that is an executable file of a subsystem for Windows;
3C is a diagram showing the structure of a MACH-O file, which is an executable file of a subsystem for MAC;
4 is a flowchart illustrating a binary file reconstruction method according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in this specification will be described in detail with reference to the accompanying drawings, but the same or similar elements are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "unit" for components used in the following description are given or used together in consideration of ease of writing the specification, and do not have meanings or roles that are distinct from each other by themselves. That is, the term 'unit' used in the present invention means a hardware component such as software, FPGA or ASIC, and 'unit' performs certain roles. However, 'part' is not limited to software or hardware. A 'unit' may be configured to reside in an addressable storage medium and may be configured to reproduce one or more processors. Thus, as an example, 'unit' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functionality provided within the components and 'parts' may be combined into a smaller number of elements and 'parts' or further separated into additional elements and 'parts'.

In addition, in describing the embodiments disclosed in this specification, if it is determined that a detailed description of a related known technology may obscure the gist of the embodiment disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, the technical idea disclosed in this specification is not limited by the accompanying drawings, and all changes included in the spirit and technical scope of the present invention , it should be understood to include equivalents or substitutes.

In addition, a file described in this specification contains meaningful information and means a logical unit on a storage device that has a name. Files on a computer are classified into binary files and text files. Among them, a binary file refers to a file encoded in a binary format of 0 and 1 for the purpose of storing and processing data, and a text file refers to a file composed of human-readable strings.

The present invention provides a binary file reconstruction method and apparatus capable of safely protecting a binary file of software such as a user application program from reverse engineering. In addition, the present invention provides a method and apparatus capable of extracting essential information necessary for executing a binary file and reconstructing the binary file based on the extracted essential information.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the drawings.

2 is a configuration block diagram of a binary file reconstruction device according to an embodiment of the present invention.

Referring to FIG. 2 , the binary file reconstruction apparatus 100 according to an embodiment of the present invention may include a binary analysis unit 110, a binary reconstruction unit 120, and a security function insertion unit 130. The components shown in FIG. 2 are not essential to implement the binary file reconstruction device, so the binary file reconstruction device described herein may have more or less components than the components listed above.

The binary analyzer 110 may perform a function of analyzing a binary file of a user application program and extracting only essential information required for execution of the corresponding binary file.

A binary file refers to a file in which information or numeric values used by a user or program are stored as they are without any special 　processing. Therefore, a separate program is required to check the binary file contents.

Binary files may include image files, music files, and executable files. Hereinafter, a binary file described in this embodiment means an executable file, and the executable file corresponds to an Executable and Linkable Format (ELF) file corresponding to an executable file of a subsystem for Linux and an executable file of a subsystem for Windows. There are PE (Portable Executable) files and MACH-O files corresponding to the executable files of subsystems for MAC.

A binary file consists of various information (data) items. And, the information items constituting the binary file are different according to the type of subsystem (or operating system) that executes the file. For example, as shown in FIGS. 3A to 3C, the ELF file used in the subsystem for Linux, the PE file used in the subsystem for Windows, and the MACH-O file used in the subsystem for MAC are different information items It can be seen that it consists of In addition, essential information required to execute a binary file is also different depending on the type of subsystem using the corresponding file. Accordingly, a separate binary file reconstruction device 100 can be constructed for each subsystem. Meanwhile, as another embodiment, a single binary file reconstruction apparatus 100 may be constructed and applied to binary files used in each subsystem.

On the other hand, irrespective of the type of each subsystem, the essential information commonly needed to execute a binary file is largely divided into execution code type information (hereinafter referred to as 'execution code type information') and data type information (hereinafter referred to as 'data type information'). referred to as 'type information').

The binary analyzer 110 may identify the type of binary file and extract two types of essential information, that is, execution code type information and data type information, by analyzing the identified binary file. At this time, the binary analyzer 110 may extract only essential information necessary for executing the corresponding file by analyzing a loader of a subsystem that loads and executes the corresponding binary file into memory.

The binary analyzer 110 can effectively remove information that is not required for binary file execution, such as header information, meta information, debugging information, and symbol information, through this essential information extraction process.

For example, debugging information is information added to analyze the operation of a program corresponding to a binary file, and the debugging information includes the source code name of each source code included in the binary file or each code included in the source code. The line number of , etc. may be included. Debugging information can also be used for forensic about the corresponding file.

Debugging information may be included in a binary file in various ways depending on the type of each binary file, an execution environment, a compilation environment, etc., so it is difficult to extract and remove debugging information from a binary file in batches. Accordingly, the apparatus 100 for reconstructing a binary file may utilize a method of reconstructing a binary file by extracting only essential information necessary for executing the binary file, instead of removing debugging information from the binary file. That is, since debugging information does not correspond to essential information, it is possible to naturally remove debugging information in the process of reconstructing a binary file. Here, in addition to debugging information, header information, meta information, and the like can be removed in the same way.

The binary reconstruction unit 120 may perform a function of reconstructing a corresponding binary file based on essential information extracted from the binary file. At this time, the binary reconstruction unit 120 may reconstruct essential information in a form that can be loaded into a memory. This is because the essential information extracted from the binary file is not in an executable form per se, so it is necessary to reconstruct the essential information in an executable form in memory.

More specifically, the reason for reconstructing the binary file based on the essential information extracted from the binary file is as follows.

First, the executable code must know how the binary file is loaded into memory.

Second, since the execution code and data cannot always be loaded into the same memory, the execution code must know the changed information.

Third, the execution code uses the functions (system call or library) of the operating system (OS), and the information of the functions must be known.

The operation related to the above reason is generally performed by the loader of the subsystem, but since all information related to the operation is removed through the binary analyzer 110, the corresponding operation is directly performed by the binary file reconstruction device 100 It should be done. Therefore, the code for performing the loader function related to the above-described operation needs to be inserted into a new binary file (ie, a reconstructed binary file).

Depending on the embodiment, the binary reconstruction unit 120 may add codes for binary file reconstruction to executable code type information that appears first in the binary file. In this case, the added code can be designed to output the same result as the loaders of each subsystem. In addition, the binary reconstruction unit 120 changes the names of functions included in the execution code type information into a hash form to improve the security of each symbol information included in the reconstructed binary file. can

For example, a function called “_puts” may be included in the execution code type information, and the function called “_puts” may be used by referring to an external library or the like. At this time, the binary reconstruction unit 120 may specify that the address of the function "_puts" should be stored in a specific location on the memory by adding the code of "puts_ptr". In this case, since it is possible to read a function called "_puts" essential for binary file execution from memory without a separate loader, it corresponds to reconstructing essential information into a form that can be loaded into memory. In this way, the binary reconstruction unit 120 can implement functions generally performed by the loader using the reconstructed binary file.

In addition, if a reverse engineering technique is used, it may be indicated to the outside that the corresponding program uses a function called "_puts" from the reconstructed binary file. Therefore, the binary reconstruction unit 120 can prevent functions used in binary files from being exposed to the outside by encrypting and using function names such as “_puts” in a hash form when reconstructing binary files.

The security function insertion unit 130 may generate a code for performing a predetermined loader function and insert it into a new binary file. When a general binary file including header information is loaded into memory, it is possible to extract the corresponding binary file through a memory dump, so even if the binary file is encrypted, it can easily be incapacitated. Therefore, the security function insertion unit 130 inserts a code for performing a loader function into a new binary file to load a binary file that does not include header information into memory, thereby preventing a memory dump. .

The security function insertion unit 130 may perform a function of generating a code for performing a predetermined security function and inserting it into a new binary file. At this time, the security function may vary depending on the operating system, but may basically include the following two functions.

The first security feature is the ability to check whether a binary file has been modified. This function can check whether the binary file has been changed by forgery inspection of the code of the security function and the actual operating code.

The second security feature is the ability to check the execution environment of binary files. The corresponding function may include a function of checking whether a binary file is operated in a safe environment and a function of checking whether a program is being controlled by a debugger or other hacking tool.

In order to protect the essential information extracted from the binary file, the security function insertion unit 130 may additionally insert a code for encrypting and then decrypting the corresponding essential information into a new binary file. At this time, the security function insertion unit 130 may determine whether to decrypt by analyzing the security risk of the operating system before performing encryption/decryption, and in a reliable execution environment, essential information (ie, execution code type information and data type information) may be provided. Security risk analysis is different for each operating system (OS), and in the Android system, it can be a code that detects risks such as rooting and emulator. The decryption code may be an algorithm such as AES (Advanced Encryption Standard) or SEED, and the decryption key may use a hash (HASH) value of an object to be verified (integrity verification).

The security function insertion unit 130 may perform a function of directly loading a final binary file in which codes for performing a predetermined loader function and security function are inserted into memory. Even if the final binary file loaded into the memory is decrypted and exposed on the memory, it is impossible to extract essential information of the corresponding binary file using a memory dump.

As described above, the apparatus for reconstructing a binary file according to an embodiment of the present invention can safely protect a corresponding binary file from reverse engineering by reconstructing the binary file by extracting only essential information necessary for executing the binary file.

4 is a flowchart illustrating a binary file reconstruction method according to an embodiment of the present invention.

Referring to FIG. 4 , the apparatus 200 for reconstructing a binary file according to an embodiment of the present invention may check whether a binary file of a user application program is input (S410).

As a result of checking in step 410, if a binary file is input, the binary file reconstruction apparatus 200 can identify the type of the input binary file (S420).

For example, the binary file reconstruction device 200 may identify an executable file used in which subsystem the corresponding binary file is. That is, the binary file reconstruction device 200 determines whether the binary file is an ELF file used in the subsystem for Linux, a PE file used in the subsystem for Windows, or a MACH-O file used in the subsystem for MAC. can be identified.

The binary file reconstruction device 200 may analyze information (data) items included in the identified binary file (S430). At this time, the binary file reconstruction apparatus 200 may analyze a loader of a subsystem that loads and executes a corresponding binary file into memory. This is because essential information required to execute a binary file differs depending on the type of subsystem using the corresponding file.

The binary file reconstruction device 200 may analyze the binary file and extract (detect) only essential information required for the execution of the binary file (S440). In this case, the essential information may include execution code type information and data type information among a plurality of information items included in the binary file.

The binary file reconstruction device 200 can effectively remove information not necessary for binary file execution, such as header information, meta information, debugging information, and symbol information, through this essential information extraction process.

The binary file reconstruction device 200 may reconstruct the corresponding binary file based on essential information extracted from the binary file (S450). This is to reconstruct the essential information in an executable form on memory since the essential information extracted from the binary file is not in an executable form per se.

The apparatus 200 for reconstructing a binary file may generate a code for performing a predetermined loader function and insert it into the reconstructed binary file (S460). Accordingly, the binary file reconstruction apparatus 200 may directly load a binary file not including header information into memory, thereby preventing a memory dump.

Binary file reconstruction device 200 may generate a code for performing a predetermined security function and insert it into the reconstructed binary file (S470). In this case, the security function may include an encryption/decryption function, a decompilation prevention function, an integrity check function, and the like.

The binary file reconstruction apparatus 200 may output (generate) a new binary file in which codes for performing predetermined loader functions and security functions are inserted (S480).

The binary file reconstruction device 200 may directly load a new binary file into memory and execute the corresponding binary file upon request for execution of the binary file.

As described above, the method for reconstructing a binary file according to an embodiment of the present invention can safely protect a corresponding binary file from reverse engineering by extracting essential information necessary for executing the binary file and reconstructing the binary file.

The above-described present invention can be implemented as computer readable code on a medium on which a program is recorded. The computer-readable medium may continuously store programs executable by the computer or temporarily store them for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or combined hardware, but is not limited to a medium directly connected to a certain computer system, and may be distributed on a network. Examples of the medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROM and DVD, magneto-optical media such as floptical disks, and ROM, RAM, flash memory, etc. configured to store program instructions. In addition, examples of other media include recording media or storage media managed by an app store that distributes applications, a site that supplies or distributes various other software, and a server. Accordingly, the above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the foregoing embodiments and accompanying drawings. It will be clear to those skilled in the art that the components according to the present invention can be substituted, modified, and changed without departing from the technical spirit of the present invention.

100: binary file reconstruction device 110: binary analysis unit
120: binary reconstruction unit 130: security function insertion unit

Claims (10)

In the binary file reconstruction device for protecting binary files from reverse engineering,
a binary analysis unit that analyzes the binary file and extracts essential information required for execution of the binary file from the binary file;
A binary reconstruction unit for reconstructing essential information extracted from the binary file into an executable form on memory and generating a reconstructed binary file; and
To include a security function insertion unit for inserting code for performing a predetermined security function into the reconstructed binary file,
Wherein the binary analysis unit extracts the essential information from the binary file by analyzing a loader of a subsystem that loads and executes the binary file into memory.
According to claim 1,
The binary file is an executable file usable in the subsystem, and includes at least one of an Executable and Linkable Format (ELF) file, a Portable Executable (PE) file, and a MACH-O file.
According to claim 1,
The binary file reconstruction apparatus, characterized in that the essential information includes information of an execution code type and information of a data type among a plurality of information items included in the binary file.
delete delete According to claim 1,
The security function insertion unit inserts a code for encrypting and decrypting the essential information into the reconstructed binary file.
In the binary file reconstruction device for protecting binary files from reverse engineering,
a binary analysis unit that analyzes the binary file and extracts essential information required for execution of the binary file from the binary file;
A binary reconstruction unit for reconstructing essential information extracted from the binary file into an executable form on memory and generating a reconstructed binary file; and
To include a security function insertion unit for inserting code for performing a predetermined security function into the reconstructed binary file,
The binary file reconstruction device, characterized in that the security function insertion unit inserts a code for performing a predetermined loader function into the reconstructed binary file.
According to claim 7,
The binary file reconstruction device, characterized in that the security function inserting unit directly loads the reconstructed binary file into a memory when the execution of the binary file is requested.
In the binary file reconstruction method of the binary file reconstruction device for protecting the binary file from reverse engineering,
analyzing the binary file and extracting essential information required for execution of the binary file from the binary file;
Reconstructing essential information extracted from the binary file into an executable form on memory to generate a reconstructed binary file; and
Including inserting code for performing a predetermined security function into the reconstructed binary file,
In the extracting, the essential information is extracted from the binary file by analyzing a loader of a subsystem that loads the binary file into a memory and executes the binary file.
A computer program stored in a computer readable recording medium so that the method according to claim 9 can be executed on a computer.

Images