WO2015192637A1 - 软件安装包的加固保护方法和装置 - Google Patents

软件安装包的加固保护方法和装置 Download PDF

Info

Publication number
WO2015192637A1
WO2015192637A1 PCT/CN2014/095791 CN2014095791W WO2015192637A1 WO 2015192637 A1 WO2015192637 A1 WO 2015192637A1 CN 2014095791 W CN2014095791 W CN 2014095791W WO 2015192637 A1 WO2015192637 A1 WO 2015192637A1
Authority
WO
WIPO (PCT)
Prior art keywords
code
installation package
file
protection
software installation
Prior art date
Application number
PCT/CN2014/095791
Other languages
English (en)
French (fr)
Inventor
施华国
刘敦俊
杨新权
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201410271094.6A external-priority patent/CN104021321B/zh
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2015192637A1 publication Critical patent/WO2015192637A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]

Definitions

  • the invention relates to the field of data security, and in particular to a method and device for reinforcing and protecting a software installation package.
  • the Android platform has developed rapidly and has gradually become the most popular operating system for mobile terminals. At the same time, the number of software applications based on the platform is also huge. Compared with other mobile terminal operating systems, Android provides more functional interfaces for application developers. Many of the system's low-level interfaces improve the scalability of the system, but also provide convenience for malware. Malware and other malware are also easier to implement. At present, malware for Android can spoof user installation and grant certain permissions by masquerading, and then abuse these permissions to perform certain behaviors in the background, including stealing user privacy and defrauding fees. However, the security problems that have been born with it have not been solved well, security threats are increasing, and the threat level is gradually deepening, which has a negative impact on both developers and users.
  • the encryption measures such as encryption, anti-compilation, and anti-code obfuscation
  • the reinforcement scheme has different solutions.
  • the use of certain reinforcements does not achieve the effect of preventing brute force cracking.
  • an existing reinforcement method first encrypts the executable file dex of the original package, and then extracts the dex file of the four component information generation agents, and dynamically decrypts the original program dex when the program is executed, but such encryption method, encryption package and The original package is separated, the original package is only an encrypted file, and the program can be easily cracked through the memory dump, and the reinforcement effect is limited.
  • the present invention has been made in order to provide a reinforcement protection device for a software installation package and a reinforcement protection method for a corresponding software installation package that overcome the above problems or at least partially solve the above problems.
  • a further object of the present invention is to improve the hardening effect of the software installation package and prevent memory partitioning.
  • Another further object of the present invention is to improve the compatibility and reliability of the software package after the reinforcement.
  • a method of reinforcement protection of a software installation package includes: extracting a global configuration file and an executable file in the software installation package; parsing the executable file to obtain the first code; inserting the protection code into the first code to obtain the second code, and performing the second code Encryption processing; modify the global configuration file according to the entry point of the protection code; repackage the modified global configuration file and the executable file to generate a hardened installation package.
  • the protection code includes code to pack and unpack the executable.
  • the protection code further includes a solution code for unpacking the trigger code and the decompilation tool; inserting the protection code into the first code to obtain the second code includes: placing a solution in each type of code in the first code The shell trigger code and the decompilation tool's crash code.
  • the unpacking trigger code is executed, the unwrapped code is called to decrypt the class.
  • encrypting the second code comprises: extracting at least a portion of the second code for reconstruction; embedding a link library for decrypting the reconstructed code, the link library being loaded by the java local interface during the decryption process.
  • modifying the global configuration file according to the entry point of the protection code includes: checking whether the global configuration file is configured with an application node label; if yes, modifying the application node label according to the entry point of the protection code; if not, creating a new application node label, and following The entry point of the protection code configures the newly created application node label.
  • the method before extracting the global configuration file and the executable file in the software installation package, the method further includes: receiving the software installation package uploaded by the user and setting the reinforcement parameter.
  • the method further includes: signing the hardened installation package.
  • the hardening installation package is signed, and the hardened installation package is signed by the user, or the hardened installation package is signed by using the user-uploaded identity.
  • the software installation package is an Android software installation package
  • the global configuration file is a manifest file
  • the executable file is a dex file.
  • a reinforcement protection device for a software installation package includes: a file extraction module configured to extract a global configuration file and an executable file in the software installation package; a parsing module configured to parse the executable file to obtain a first code; and an encryption module configured to Inserting the protection code into the first code to obtain the second code, and encrypting the second code; configuring the module, configured to modify the global configuration file according to the entry point of the protection code; packaging the module, configured to modify the global configuration file Repackage the executable and generate a hardened installation package.
  • the encryption module is further configured to: insert a decryption code of the unpacking trigger code and the decompilation tool in each type of code in the first code; extract at least a part of the second code for reconstruction; A link library for decrypting the reconstructed code, the link library being loaded by the java local interface during the decryption process.
  • the configuration module is further configured to: check whether the global configuration file is configured with an application node label; if yes, modify the application node label according to the entry point of the protection code; if not, create a new application node label, and follow The entry point of the protection code configures the newly created application node label.
  • the reinforcement protection device of the software installation package further includes: an acquisition module configured to receive the software installation package uploaded by the user and the set reinforcement parameter.
  • the hardening protection device of the software installation package further includes: a signing module configured to sign the hardened installation package.
  • the security protection device of the software installation package is configured to perform reinforcement protection on the Android software installation package, where the global configuration file is a manifest file, and the executable file is a dex file.
  • the method and device for protecting and protecting the software installation package of the present invention directly insert the protection code into the code of the executable file, and correspondingly modify the program entry of the global configuration file, thereby realizing the reconstruction of the executable file, so that when the program is running, first
  • the protection code is executed to perform corresponding decryption processing, and the executable file is directly processed, which increases the flexibility of the executable file protection and further improves the security of the software installation package.
  • the decryption code of the unpacking trigger code and the decompilation tool is placed in each type of code, and the running class is decrypted separately in each type of running. It can effectively prevent the crack tool from performing memory dumping.
  • a computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to execute the software of any of the above described The reinforcement protection method of the installation package.
  • a computer readable medium storing the above computer program is provided.
  • the method and device for protecting and protecting the software installation package of the present invention directly insert the protection code into the code of the executable file, and correspondingly modify the program entry of the global configuration file, thereby realizing the reconstruction of the executable file, so that when the program is running, first
  • the protection code is executed to perform corresponding decryption processing, and the executable file is directly processed, which increases the flexibility of the executable file protection and further improves the security of the software installation package.
  • the decryption code of the unpacking trigger code and the decompilation tool is placed in each type of code, and the running class is decrypted separately in each type of running. It can effectively prevent the crack tool from performing memory dumping.
  • FIG. 1 is a schematic diagram of a reinforcement protection device of a software installation package according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a software installation package method in accordance with one embodiment of the present invention.
  • FIG. 3 is a flow chart of a software installation package reinforcement method according to an embodiment of the present invention.
  • FIG. 4 is an optional flow chart of regenerating an apk file package shown in FIG. 3;
  • FIG. 5 is a schematic diagram of program class loading in a software installation package hardening method according to an embodiment of the present invention
  • Figure 6 is a block diagram schematically showing a computing device for performing a hardened protection method of a software installation package according to the present invention
  • Fig. 7 schematically shows a storage unit for holding or carrying program code implementing a hardening protection method of a software installation package according to the present invention.
  • the security protection device 100 of the software installation package may include: a file extraction module 110, a parsing module 120, an encryption module 130, a configuration module 140, a packaging module 150, an obtaining module 160, and a signature module 170.
  • the above modules can be flexibly configured according to the functions of the security protection device 100 of the software installation package of the embodiment. In some optional cases, one or more of the above modules can be configured, and all modules are not required to be configured at the same time.
  • the file extraction module 110 extracts the global configuration file and the executable file in the software installation package; for the software installation package of the Android system, the global configuration file is Manifest.xml, and the executable file is a dex file.
  • APK is the abbreviation of Android application package file, referred to as APK file, that is, Android installation package, can also be understood as the application software installed on the Android terminal.
  • APK file is actually The ZIP file format, the suffix name is modified to apk, and the internal file structure can be seen by decompressing tools such as Unzip.
  • Table 1 The file structure of the APK file is shown in Table 1:
  • the Android installation package (APK file) is generally downloaded and installed on the mobile phone through the Android application market, and can also be downloaded and installed by a personal computer (PC) through a data line interface such as a USB data line or wireless data transmission.
  • Viruses, Trojans, and other malware on Android that want to enter the user's phone must also be packaged in the form of an APK.
  • an illegal APK file cannot be installed on the user's mobile phone, and it will not harm the user. Based on this, the anti-virus engine can focus on the scanning of the APK file, which greatly improves the scanning efficiency.
  • the Android operating system manages each installed APK through the APK package name.
  • the "package name" is derived from the Java package concept. According to the Java package naming style, for example, the package name of an Android installation package is com.qihoo360.mobilesafe.
  • the Android system requires each application to declare a unique package name. If the package name of the APK to be installed is duplicated with the package name of an existing application on the current mobile phone, the Android system will refuse the installation. Malware on the Android platform also needs to declare a package name, so the package name can be used as an important feature to identify malware.
  • the Android system For security purposes, the Android system requires each APK to contain a digital signature (digital Signature).
  • digital Signature digital Signature
  • the Android system will check whether the digital signature of each file in the APK is consistent with its pre-set digital signature. If it is inconsistent or there is no digital signature, the file is considered to have been tampered with, and the installation and operation of the APK is rejected. Malware on the Android platform is no exception, so the digital signature of the APK file can also be used as an important feature to identify malware.
  • AndroidManifest.xml is a required global description file for each APK file, which lists the entry information for each module applied in the Android installation package.
  • the Android system only the modules listed in AndroidManifest.xml can be called by the system.
  • Trojans on the Android platform tend to pretend to be normal applications or games to trick users into installing. Many Trojans are parasitic in a normal application or game. When the user runs it, it looks like the original software or game. But the Trojan module that is parasitic in it is activated at the right time, infecting the user's mobile phone. And because the Android system requires all modules to be listed in AndroidManifest.xml, this raises important clues for finding parasitic Trojans. Therefore, the information of each module listed in AndroidManifest.xml is also an important feature for identifying malware.
  • Android applications are usually developed in the Java language. After compiling with Android development tools, they become binary bytecodes. These bytecodes are packaged into classes.dex files, which are used by the Dalvik virtual machine on the Android platform. Explain execution.
  • the Android system provides a set of operating environment (Android Framework), the Android application calling system functions are all realized by calling the Android Framework library.
  • the Android system also supports applications running directly through JNI or native executable.
  • the application executes the binary machine code running directly on the CPU. It does not need to be interpreted by the virtual machine. It can directly call the Android library such as libc, WebKit, SQLite, OpenGL/ES to call the system functions. If the Android application is to run via JNI or native executable, you will need to compile the code to be executed into the ELF file format.
  • ELF is an abbreviation of Executable and Linkable Format, which is a file format of executable programs and shared libraries in the Android/Linux operating system.
  • Each Android software installation package contains a Manifest file, which is AndroidManifest.xml, which is stored at the lowest level in the project hierarchy.
  • a manifest can define the structure and metadata of an application and its components.
  • AndroidManifest.xml contains the nodes that make up each component of the application (activities, services, content providers, and broadcast receivers) and uses destination filters and permissions to determine how these components are and how these and other applications are interactive. It also provides various properties to detail the application's metadata (icons or themes) as well as additional security settings and unit tests. Try the top node.
  • the manifest tag contains nodes that define the application components, security settings, and test classes that make up the application.
  • Some common manifest node tags are some common manifest node tags:
  • Application node tag (application), the list usually contains only one application node.
  • the application node uses various properties to specify various metadata for the application (including title, icon, and theme).
  • the application node can also be used as a container containing activities, services, content providers, and broadcast receiver tags to specify application components.
  • Activity node tag (activity) each activity displayed by the application requires an activity tag.
  • service The service node label (service), service tag and activity tag, each service class (Service) used in the application must create a new service tag.
  • the content provider provider is used to describe each content provider in the application.
  • Receiver tag by adding a receiver tag, can register a broadcast receiver (Broadcast Receiver) without first launching the application.
  • the broadcast receiver like the global event listener, makes this process fully automated by registering a broadcast receiver in the declaration. If a matching data transfer (Intent) is broadcast, the application will start automatically and the registered broadcast receiver will start running.
  • the uses-permission as part of the security model, declares those user-defined permissions that are required for proper application execution.
  • Permissions which require a permission label to be defined in the manifest before restricting access to an application component. These permission definitions can be created using the permission tag.
  • Instrumentation the instrumentation class provides a framework for running tests on activities or services while the application is running. They provide methods to monitor an application and its interaction with system resources.
  • the executable file includes a Dex file
  • the Dex file is mainly a classes.dex file in the APK, that is, Dalvik Executable (Dalvik Executable File).
  • Dalvik is a Java virtual machine for the Android platform.
  • the Dalvik VM (Dalvik VM) is one of the core components of the Android mobile device platform. It can support the running of Java applications that have been converted to .dex (Dalvik Executable) format.
  • the .dex format is a compression format designed for Dalvik, suitable for systems with limited memory and processor speed. Dalvik is optimized to allow multiple instances of virtual machines to run simultaneously in limited memory, and each Dalvik application acts as an independent The Linux process is executed.
  • a separate process prevents all programs from being closed when the virtual machine crashes.
  • the virtual machine's threading mechanism, memory allocation and management, etc. are all implemented by relying on the underlying operating system.
  • the dex files contained in the apk file will be optimized at runtime, and the optimized files will be saved in the cache.
  • the executable can also include files with a .jar extension.
  • the JAR file in the Android installation package is also a Dex file, except that its extension is .jar.
  • AndroidManifest.xml describes the application name, version, permissions, referenced library files and other information
  • the Android system first needs to extract the apk file when running the program, and then get the compiled androidmanifest Configure the information in the .xml file and execute the dex program.
  • Apk files convert all bytecode files into dex files (classes.dex) and then use Android packaging tools to combine dex files, resource files and AndroidManifest.xml files into one application package (APK).
  • the file extraction module 110 extracts the global configuration file and the executable file from the software installation package.
  • the parsing module 120 parses the executable file to obtain a first code of the executable file for subsequent reinforcement processing.
  • the encryption module 130 inserts the protection code into the first code to obtain the second code, and encrypts the second code. Inserting a shell trigger code and a crash code of the decompile tool in each type of code in the first code; extracting at least a portion of the second code for reconstruction; implanting a link for decrypting the reconstructed code Library, the link library is loaded by the java local interface during the decryption process.
  • the reinforcement process of the existing Android hardening method is to encrypt the dex file of the original package, parse the original package manifest.xml, and extract the dex file of the component information generating agent; when executing the above-mentioned hardened program, the original program dex needs to be decrypted and used Mirror it into memory using the optimization tool compiled in hardening.
  • the optimization tool and the original package are completely separated.
  • the original package is an encrypted file
  • the dex needs to be restored at one time, so the program can be cracked by the memory interception, and the optimization tool can also be modified by the UPX source code. Shelling is carried out.
  • the reconstruction of the dex file is performed, and the data of each section of the dex file is modified and relocated to generate a new dex, because the dex is directly Processing can increase the flexibility of dex protection, such as memory partitioning and reorganization of dex, which can effectively prevent memory dumps.
  • the configuration module 140 modifies the global configuration file according to the entry point of the protection code.
  • the global configuration file (AndroidManifest.xml) is configured with an application node label (application); if so, modify the application according to the entry point of the protection code Node tag; if not, create a new application node tag and configure the newly created application node tag according to the entry point of the protection code.
  • the protection code is first executed to decrypt the program of the class. Since the protection code can be embedded in each type of code, it is not necessary to restore all the dex all at once, and only when the class is loaded, the execution code of the class needs to be restored, and memory segmentation is realized.
  • the packaging module 150 is configured to repackage the modified global configuration file and the executable file to generate a hardening installation package, and complete the entire reinforcement process.
  • the acquisition module 160 can also receive the software installation package uploaded by the user and the set reinforcement parameters. Because the hardened software installation package may not be scanned statically or dynamically, it may be used by some malicious code. Therefore, you need to perform security scan on the uploaded software installation package first to ensure that the malicious program is not hardened. Develop information and hardening parameters.
  • the security scan for the Android software installation package does not scan all the files in the Android system, but scans the Android installation package for security detection. Since viruses, trojans and other malware on Android want to enter the user's mobile phone, they need to be packaged into an Android installation package. Conversely, if it is not a legitimate Android installation package, it will not be installed on the user's mobile phone, and will not harm the user.
  • the specific scanning method can be performed according to the above file structure analysis of the Android installation package, for example, the package name, the digital signature, the entry information of each module listed in AndroidManifest.xml, the Dex file and the ELF file are checked for security, and the confirmation is performed. After the safety, reinforcement measures are allowed.
  • the specified feature information refers to the important features listed above, such as package name, version number, digital signature, entry information of each module listed in AndroidManifest.xml, Dex MD5 values of files and ELF files, and files in the Android installation package directory.
  • the security identification library includes a security level corresponding to the feature record and the feature record, and each feature record includes a single feature information Or a combination of feature information;
  • the security level corresponding to the found feature record is output, for example, included in the security detection result of the Android installation package; when the found security level is lower than the preset security level, the uploader of the installation package prompts the security detection result. And prompted that no hardening can be done.
  • the signature module 170 is used to sign the hardened installation package. There are two kinds of signature information. One is to send the hardened program installation package to the user, and the user can sign it by himself. The other can also obtain the user's information and sign it directly after hardening.
  • the signature can be User decides.
  • the embodiment of the present invention further provides a method for reinforcing and protecting a software installation package, where the reinforcement protection method of the software installation package can be performed by the reinforcement protection device of any software installation package introduced in the above embodiment, to High software installation package security.
  • 2 is a schematic diagram of a software installation package method according to an embodiment of the present invention. As shown, the software installation package includes the following steps:
  • Step S202 extracting a global configuration file and an executable file in the software installation package
  • Step S204 parsing the executable file to obtain a first code
  • Step S206 inserting the protection code into the first code to obtain the second code, and performing encryption processing on the second code
  • Step S208 modifying the global configuration file according to the entry point of the protection code
  • step S210 the modified global configuration file and the executable file are repackaged to generate a hardened installation package.
  • the protection code may include code for shelling and unpacking the executable file, specifically, for example, a shell trigger code and a crash code of the decompile tool, and correspondingly, the process of adding the code in step S206 may include: in the first code In each type of code, the crash code of the unpacking trigger code and the decompiler tool is placed. When the unpacking trigger code is executed, the unwrapped code is called to decrypt the class.
  • the encrypting the second code includes: extracting at least a part of the second code for reconstruction; and embedding a link library for decrypting the reconstructed code, wherein the link library is in the decryption process by a Java Native Interface (Java Native Interface, referred to as JNI) loading.
  • JNI Java Native Interface
  • the reconstruction of the dex file is performed, and the data of each section of the dex file is modified and relocated to generate a new dex, because the dex is directly Processing can increase the flexibility of dex protection, such as memory partitioning and reorganization of dex, which can effectively prevent memory dumps.
  • step S208 is: checking whether the global configuration file is configured with an application node label; if yes, modifying the application node label according to the entry point of the protection code; if not, creating a new application node label, and following the entry point of the protection code Configure the newly created application node label.
  • the global configuration file (AndroidManifest.xml) is configured with the application node label (application); if so, modify the application node label according to the entry point of the protection code; if not, create a new application node label and follow the protection The entry point of the code configures the newly created application node label.
  • the protection code When parsing, according to the application node tag of the global configuration file, the protection code is first executed to decrypt the program of the class. Since the protection code can be embedded in each type of code, it is not necessary to restore all the dex all at once, and only when the class is loaded, the execution code of the class needs to be restored, and memory segmentation is realized.
  • the software installation package uploaded by the user and the set reinforcement parameters may also be received before step S202.
  • the hardened software installation package may not be statically and dynamically scanned, it may be exploited by some malicious code. Therefore, the uploaded software installation package needs to be scanned first to ensure that the malicious program is not hardened. Obtain relevant development information and hardening parameters for security scanning of software installation packages and timely processing of malicious files.
  • An optional process for security scanning of uploaded software installation packages is:
  • the specified feature information refers to the important features listed above, such as package name, version number, digital signature, entry information of each module listed in AndroidManifest.xml, Dex MD5 values of files and ELF files, and files in the Android installation package directory.
  • the security identification library includes a security level corresponding to the feature record and the feature record, and each feature record includes a single feature information Or a combination of feature information;
  • the security level output corresponding to the found feature record is the security level output corresponding to the found feature record.
  • the uploader of the installation package prompts the security detection result and indicates that the hardening cannot be performed.
  • the hardened installation package also needs to be signed after the hardened installation package is generated.
  • the hardening installation package can be issued by the user in the signature mode.
  • the user can use the ID to sign the hardened installation package.
  • the user can upload the hardened installation package by using the user-uploaded identity.
  • FIG. 3 is a flowchart of a method for hardening a software installation package according to an embodiment of the present invention, and performing the following steps in sequence when performing Android installation package hardening:
  • Step S302 Receive a user's access through a webpage service, and the user may access the security-enhanced webpage to perform related test reinforcement;
  • Step S304 receiving the uploaded apk file package and the reinforcement parameter
  • Step S306 parsing the apk file package and extracting data information such as manifest and dex;
  • Step S308 reconstructing dex, modifying the manifest, and regenerating the apk file package
  • step S310 the hardened apk file package is re-signed.
  • FIG. 4 is an optional flowchart of regenerating the apk file package shown in FIG. 3.
  • Step S402 obtaining data node information that needs to be modified by the manifest, and checking whether the manifest is configured with an application node label (application), and performing corresponding processing, adding the entry point of the reinforcement program to the application node label, so that the application is started from the reinforcement program;
  • Step S404 modifying the resource data to be consistent with the node data of the manifest
  • Step S406 processing the original package dex file, specifically, parsing the original package dex into a code, inserting the protection code into the parsing code of the dex, and the entry point of the protection code has been registered in the manifest in step S402. ;
  • Step S408 implanting a protection module, which is a code of a dynamic link library of .so for decoding the JNI layer, and also implants a dex packet;
  • Step S410 completing encryption of the dex file.
  • the core code is embedded in the protection module to realize the program unpacking during the running process
  • the protection module is placed in the JNI, and the JNI can be used to construct the Java class or execute the Java layer. Methods to get properties and other operations.
  • the software installation package reinforcement method of the embodiment is encrypted by placing a code in the dex, the structure of the apk file itself is not changed, and compatibility is improved.
  • FIG. 5 is a schematic diagram of program class loading in a software installation package hardening method according to an embodiment of the present invention.
  • each class is separately encrypted, and when the class is loaded by the Android system, the class is decrypted, for example, an installation.
  • the key points in the class are hooked, and the JNI can decrypt the first program class and send it back to dex for loading.
  • the system loads the second program class hooks the key points in the class, and the JNI can decrypt the second program class and send it back to dex for loading.
  • all the dex does not exist in the memory, so the Memory interception.
  • the software installation package reinforcement method of the embodiment can implement two or more times of shelling, and dynamic shelling is performed during execution. Compared with the prior art, only one case is obviously more safe, and the prior art is more easily Crack.
  • the data of the first decrypted class can be eliminated. Ensure that the entire memory does not appear in the memory and prevent it from being intercepted by the memory.
  • the technical solution of the embodiment directly inserts the protection code into the code of the executable file, and correspondingly modifies the program entry of the global configuration file, thereby realizing the reconstruction of the executable file, so that when the program runs, the protection code is first executed to perform
  • the corresponding decryption process directly processes the executable file, which increases the flexibility of the executable file protection and further improves the security of the software installation package.
  • the cloud reinforcement method is adopted, and the developer can directly enter the reinforcement security page from the open platform homepage (for example, dev.360.cn), and click “Upload Application” on the webpage.
  • the open platform homepage for example, dev.360.cn
  • click “Upload Application” on the webpage.
  • the application can complete security monitoring and protection in the background; then click “Download Application” to re-sign the downloaded reinforcement package to distribute the most secure products to various application markets.
  • the signature tool may be provided on the page of the embodiment, or the user may be allowed to upload the signature key to automatically sign after the reinforcement is completed.
  • the decryption code of the unpacking trigger code and the decompilation tool is placed in each type of code, and the running class is decrypted separately in each type of runtime, which can effectively prevent the crack tool from performing memory interception (dump) ).
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the components of the device for detecting suspect DNS and the processing system for suspect DNS, in accordance with an embodiment of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 6 illustrates a computing device, such as a personal computer or the like, that can implement a hardened protection method for a software installation package in accordance with the present invention.
  • the computing device conventionally includes a processor 610 and is in the form of a memory 620 A computer program product or computer readable medium.
  • the memory 620 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 620 has a memory space 630 for program code 831 for performing any of the method steps described above.
  • storage space 630 for program code may include various program code 631 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 620 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 631', code that can be read by a processor, such as 610, which, when executed by a server, causes the server to perform various steps in the methods described above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Storage Device Security (AREA)

Abstract

一种软件安装包的加固保护方法和装置。其中，软件安装包的加固保护方法包括：提取软件安装包中的全局配置文件和可执行文件（S202）；解析可执行文件，得到第一代码（S204）；将保护代码插入第一代码中得到第二代码，并对第二代码进行加密处理（S206）；按照保护代码的入口点修改全局配置文件（S208）；将修改后的全局配置文件和可执行文件重新打包生成加固安装包（S210）。方案将保护代码直接插入可执行文件的代码内，相应修改全局配置文件的程序入口，实现了可执行文件的重构，从而在程序运行时，首先执行保护代码，以进行相应解密处理，直接对可执行文件进行处理，增加了可执行文件防护的灵活度，进一步提高了软件安装包的安全性。

Description

软件安装包的加固保护方法和装置 技术领域
本发明涉数据安全领域，特别是涉及一种软件安装包的加固保护方法和装置。
背景技术
安卓(Android)平台发展迅速，已经逐渐成为了移动终端的最普及的操作系统，同时基于该平台的软件应用数目也十分巨大。与其他移动终端操作系统相比，安卓系统为应用开发者提供了更多的功能接口，其中很多系统底层接口，提高了系统的可扩展性，但同时也为恶意软件提供了便利，针对安卓系统的木马等恶意软件也更容易被实现。目前针对安卓系统的恶意软件可以通过伪装的方式，骗取用户安装并授予一定的权限，之后滥用这些权限在后台执行一些特定行为，包括窃取用户隐私骗取资费等行为。然而与之并生的安全问题却始终没有得到良好的解决，安全威胁越来越多，且威胁程度也在逐步加深，无论对开发者还是用户都带来了不良的影响。
而且对于一些正常的安卓系统应用，也存在通过非法拷贝、逆向工程、反编译、调试、破解、二次打包、内存截取等手段来威胁安卓系统的安全，不仅危害了使用用户，也给正常应用开发者造成严重的损害。
基于以上问题，现有技术中出现了多种安卓应用的安全加固方法，通过对安卓应用进行加密、防反编译、防代码混淆等加固措施，然而由于加固方法所采用的方案不同，加固的效果也不同，使用某些加固后并不能达到防止暴力破解的效果。例如现有的一种加固方法首先加密原程序包的可执行文件dex，然后在提取四大组件信息生成代理的dex文件，程序执行时动态解密原程序dex，然而这样的加密方式，加密包和原包分离，原包仅为加密文件，可以轻易地通过内存转存实现程序的破解，加固效果有限。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的软件安装包的加固保护装置和相应的软件安装包的加固保护方法。
本发明一个进一步的目的是要提高软件安装包的加固效果，防止内存分割。
本发明另一个进一步的目的是要提高加固后软件安装包的兼容性和可靠性。
依据本发明的一个方面，提供了一种软件安装包的加固保护方法。该软件安装 包的加固保护方法包括：提取软件安装包中的全局配置文件和可执行文件；解析可执行文件，得到第一代码；将保护代码插入第一代码中得到第二代码，并对第二代码进行加密处理；按照保护代码的入口点修改全局配置文件；将修改后的全局配置文件和可执行文件重新打包生成加固安装包。
可选地，保护代码包括对可执行文件进行加壳和解壳的代码。
可选地，保护代码还包括解壳触发代码和和反编译工具的崩溃代码；将保护代码插入第一代码中得到第二代码包括：在第一代码中的每一类的代码中置入解壳触发代码和反编译工具的崩溃代码，解壳触发代码被执行时，调用解壳的代码对该类进行解密。
可选地，对第二代码进行加密处理包括：抽取第二代码的至少一部分进行重构；植入用于解密重构的代码的链接库，链接库在解密过程中由java本地接口加载。
可选地，按照保护代码的入口点修改全局配置文件包括：检查全局配置文件是否配置有应用节点标签；若是，按照保护代码的入口点修改应用节点标签；若否，新建应用节点标签，并按照述保护代码的入口点配置新建的应用节点标签。
可选地，在提取软件安装包中的全局配置文件和可执行文件之前还包括：接收由用户上传的软件安装包和设置的加固参数。
可选地，在生成加固安装包之后还包括：对加固安装包进行签名。
可选地，对加固安装包进行签名包括：下发加固安装包，由用户使用其身份标识对加固安装包进行签名；或者利用用户上传的身份标识对加固安装包进行签名。
可选地，软件安装包为安卓软件安装包，全局配置文件为manifest文件，可执行文件为dex文件。
根据本发明的另一个方面，还提供了一种软件安装包的加固保护装置。该软件安装包的加固保护装置包括：文件提取模块，配置为提取软件安装包中的全局配置文件和可执行文件；解析模块，配置为解析可执行文件，得到第一代码；加密模块，配置为将保护代码插入第一代码中得到第二代码，并对第二代码进行加密处理；配置模块，配置为按照保护代码的入口点修改全局配置文件；打包模块，配置为将修改后的全局配置文件和可执行文件重新打包生成加固安装包。
可选地，加密模块还被配置为：在第一代码中的每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码；抽取第二代码的至少一部分进行重构；植入用于解密述重构的代码的链接库，链接库在解密过程中由java本地接口加载。
可选地，配置模块还配置为：检查全局配置文件是否配置有应用节点标签；若是，按照保护代码的入口点修改应用节点标签；若否，新建应用节点标签，并按照 保护代码的入口点配置新建的应用节点标签。
可选地，上述软件安装包的加固保护装置还包括：获取模块，配置为接收由用户上传的软件安装包和设置的加固参数。
可选地，上述软件安装包的加固保护装置还包括：签名模块，配置为对加固安装包进行签名。
可选地，上述软件安装包的加固保护装置配置为对安卓软件安装包进行加固保护，其中，全局配置文件为manifest文件，可执行文件为dex文件。
本发明的软件安装包的加固保护方法和装置由于将保护代码直接插入可执行文件的代码内，相应修改全局配置文件的程序入口，实现了可执行文件的重构，从而在程序运行时，首先执行保护代码，以进行相应解密处理，直接对可执行文件进行处理，增加了可执行文件防护的灵活度，进一步提高了软件安装包的安全性。
进一步地，本发明的软件安装包的加固保护方法，每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码，在每一类运行时，单独对运行的类进行解密，可以有效防止破解工具进行内存截取(dump)。
根据本发明的再一个方面，提供了一种计算机程序，其包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行以上介绍的任一项的软件安装包的加固保护方法。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存储了上述计算机程序。
本发明的软件安装包的加固保护方法和装置由于将保护代码直接插入可执行文件的代码内，相应修改全局配置文件的程序入口，实现了可执行文件的重构，从而在程序运行时，首先执行保护代码，以进行相应解密处理，直接对可执行文件进行处理，增加了可执行文件防护的灵活度，进一步提高了软件安装包的安全性。
进一步地，本发明的软件安装包的加固保护方法，每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码，在每一类运行时，单独对运行的类进行解密，可以有效防止破解工具进行内存截取(dump)。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
根据下文结合附图对本发明具体实施例的详细描述，本领域技术人员将会更加明了本发明的上述以及其他目的、优点和特征。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1是根据本发明一个实施例的软件安装包的加固保护装置的示意图；
图2是根据本发明一个实施例的软件安装包方法的示意图；
图3是根据本发明一个实施例的软件安装包加固方法的流程图；
图4是图3中所示的重新生成apk文件包的可选流程图；
图5是根据本发明一个实施例的软件安装包加固方法中程序类加载的示意图；以及
图6示意性地示出了用于执行根据本发明的软件安装包的加固保护方法的计算设备的框图；以及
图7示意性地示出了用于保持或者携带实现根据本发明的软件安装包的加固保护方法的程序代码的存储单元。
具体实施方式
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
图1是根据本发明一个实施例的软件安装包的加固保护装置100的示意图。软件安装包的加固保护装置100一般性地可包括：文件提取模块110、解析模块120、加密模块130、配置模块140、打包模块150、获取模块160、签名模块170。以上模块可以根据本实施例的软件安装包的加固保护装置100的功能进行灵活配置，在一些可选情况下，可以配置以上模块的一个或多个，并不要求同时配置所有模块。
文件提取模块110提取软件安装包中的全局配置文件和可执行文件；对于安卓系统的软件安装包而言，全局配置文件为Manifest.xml，可执行文件为dex文件。
在Android系统上，一个可以安装、运行的应用，需要打包成Android系统的APK文件格式。APK是Android application package file的缩写，简称APK文件，即Android安装包，也可以理解为Android终端上安装的应用软件。APK文件其实是 ZIP文件格式，后缀名被修改为apk，通过Unzip等工具解压可以看到其内部的文件结构。APK文件的文件结构如表1所示：
表1
Figure PCTCN2014095791-appb-000001
Android安装包(APK文件)一般通过Android应用市场下载、安装到手机上，也可以通过USB数据线等数据线接口或无线数据传输的方式由个人计算机(PC)下载安装。Android上的病毒、木马和其他恶意软件想要进入用户的手机，也必须打包成APK的形式。反过来说，一个不合法的APK文件无法安装到用户手机上，也就不会对用户产生危害。基于这一点，杀毒引擎就可以把查杀的目标集中到对APK文件的扫描上，从而大大提高扫描的效率。
那么，Android安装包(APK文件)中的哪些信息可以作为扫描的重点，针对此问题本申请进行了分析，具体如下：
1)包名
Android操作系统通过APK的包名(package name)对各个安装的APK进行管理。“包名”源自于Java的package的概念，按照Java的package的命名风格，例如某个Android安装包的包名是com.qihoo360.mobilesafe。Android系统要求每个应用都声明一个唯一的包名。如果要安装的APK的包名和当前手机上某个已有的应用的包名重复了，那么Android系统会拒绝安装。Android平台下的恶意软件也需要声明一个包名，因此，包名就可以作为识别恶意软件的一个重要特征。
2)数字签名
出于安全性的目的，Android系统要求每个APK都要包含数字签名(digital  signature)。Android系统在安装APK文件的时候会检查APK内部各文件的数字签名是否与其预先设定的数字签名一致，如果不一致，或者没有数字签名，则认为文件已被篡改，拒绝该APK的安装和运行。Android平台下的恶意软件也不例外，所以APK文件的数字签名也可以作为识别恶意软件的一个重要特征。
3)AndroidManifest.xml中列出的各模块的入口信息
AndroidManifest.xml是每个APK文件所必需的全局描述文件，里面列出了Android安装包中应用的每个模块的入口信息。在Android系统中，只有在AndroidManifest.xml中列出了的模块，才能够被系统调用。Android平台下的木马，往往会伪装成正常的应用或游戏来诱骗用户安装，其中有很多木马就是寄生在一个正常的应用或游戏中，用户运行它的时候，看上去是原来的软件或游戏，但寄生在其中的木马模块在合适的时机就被激活，从而感染用户的手机。而因为Android系统要求所有的模块都要在AndroidManifest.xml中列出，这就为寻找寄生的木马提高了重要线索。因此，AndroidManifest.xml中列出的各模块的信息，也是识别恶意软件的重要特征。
4)Dex文件和ELF文件
Android应用通常是用Java语言开发的，它用Android开发工具编译之后变成了二进制的字节码(byte code)，这些字节码被打包成classes.dex文件，由Android平台的Dalvik虚拟机来解释执行。为了能够调用Android系统功能，Android系统提供了一套运行环境(Android Framework)，Android应用调用系统各功能都是通过调用Android Framework的库来实现的。
另一方面，Android系统也支持应用程序通过JNI或者native executable直接运行。此时应用执行的是直接在CPU上运行的二进制机器码，不需要经过虚拟机解释，可以直接调用Android库如libc、WebKit、SQLite、OpenGL/ES等来调用系统各功能。如果Android应用要通过JNI或者native executable运行，就需要将要执行的代码编译成ELF文件格式。ELF是Executable and Linkable Format的缩写，是Android/Linux操作系统中可执行程序、共享库的文件格式。
每一个安卓软件安装包(apk)都包含一个清单(Manifest)文件，也就是AndroidManifest.xml，它存储在项目层次中的最底层。清单可以定义应用程序及其组件的结构和元数据。AndroidManifest.xml包含了组成应用程序的每一个组件(活动、服务、内容提供器和广播接收器)的节点，并使用目的过滤器和权限来确定这些组件之间以及这些组件和其他应用程序是如何交互的。它还提供了各种属性来详细地说明应用程序的元数据(图标或者主题)以及额外的可用来进行安全设置和单元测 试顶级节点。
manifest标签包含了一些节点(node)，它们定义了应用程序组件、安全设置和组成应用程序的测试类。下面列出了一些常用的manifest节点标签：
应用节点标签(application)，清单内一般只包含一个application节点。application节点使用各种属性来指定应用程序的各种元数据(包括标题、图标和主题)。application节点还可以作为一个包含了活动、服务、内容提供器和广播接收器标签的容器，用来指定应用程序组件。
活动节点标签(activity)，应用程序显示的每一个活动(Activity)都要求有一个activity标签。
服务节点标签(service)，service标签和activity标签一样，应用程序中使用的每一个服务类(Service)都要创建一个新的service标签。
内容提供者标签(provider)，provider标签用来说明应用程序中的每一个内容提供器。
接收器标签(receiver)，通过添加receiver标签，可以注册一个广播接收器(Broadcast Receiver)，而不用事先启动应用程序。广播接收器就像全局事件监听器一样，通过在声明中注册一个广播接收器，可以使这个进程实现完全自动化。如果一个匹配的数据传输(Intent)被广播了，则应用程序就会自动启动，并且注册的广播接收器也会开始运行。
用户权限标签(uses-permission)，作为安全模型的一部分，uses-permission标签声明了那些由用户定义的权限，而这些权限是应用程序正常执行所必需的。
许可标签(permission)，许可标签在可以限制访问某个应用程序组件之前，需要在清单中定义一个permission标签。可以使用permission标签来创建这些权限定义。
检测类(instrumentation)，instrumentation类提供一个框架，用来在应用程序运行时在活动或者服务上运行测试。它们提供了一些方法来监控应用程序及其与系统资源的交互。
在本发明的一种优选实施例应用于Android系统中时，可执行文件包括Dex文件，Dex文件主要是APK中的classes.dex文件，即Dalvik Executable(Dalvik虚拟机可执行文件)。公知的是，Dalvik是用于Android平台的Java虚拟机。Dalvik虚拟机(Dalvik VM)是Android移动设备平台的核心组成部分之一。它可以支持已转换为.dex(即Dalvik Executable)格式的Java应用程序的运行，.dex格式是专为Dalvik设计的一种压缩格式，适合内存和处理器速度有限的系统。Dalvik经过优化，允许在有限的内存中同时运行多个虚拟机的实例，并且每一个Dalvik应用作为一个独立 的Linux进程执行。独立的进程可以防止在虚拟机崩溃的时候所有程序都被关闭。虚拟机的线程机制，内存分配和管理，等等都是依赖底层操作系统而实现的，一般包含在apk文件里的dex文件会在运行时被优化，优化后的文件将被保存在缓存中。
可执行文件还可以包括扩展名为.jar的文件。Android安装包中的JAR文件同样为Dex文件，只不过其扩展名为.jar。
根据以上对安卓程序安装包的分析，AndroidManifest.xml描述了应用的名字、版本、权限、引用的库文件等信息，因此，安卓系统在运行程序时首先需要解压apk文件，然后获取编译后的androidmanifest.xml文件中配置信息，执行dex程序。Apk文件在打包过程中，把所有的字节码文件转成dex文件(classes.dex)然后使用安卓打包工具将dex文件，资源文件以及AndroidManifest.xml文件组合成一个应用程序包(APK)
文件提取模块110从软件安装包中提取出全局配置文件和可执行文件。
解析模块120解析可执行文件，得到可执行文件的第一代码，以供后续进行加固处理。
加密模块130将保护代码插入第一代码中得到第二代码，并对第二代码进行加密处理。在第一代码中的每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码；抽取第二代码的至少一部分进行重构；植入用于解密述重构的代码的链接库，链接库在解密过程中由java本地接口加载。
现有的安卓加固方法的加固流程为加密原程序包的dex文件，解析原程序包manifest.xml，提取组件信息生成代理的dex文件；在执行上述加固的程序时，需要解密原程序dex，并用使用加固中编译的优化工具将其镜像到内存。现有技术中优化工具和原程序包是完全分离的，虽然原程序包为加密文件，但是需要一次性还原dex，所以可以通过内存截取进行程序破解，而且优化工具也可以通过对UPX源代码修改进行脱壳。
在本实施例的软件安装包的加固保护装置应用于安卓系统的软件安装包时，对dex文件的重构，将dex文件各个节数据修改重组后重定位并生成新dex，由于直接对dex进行处理，可以增加dex防护的灵活度，如对dex进行内存分割重组，可有效防止内存dump等。
配置模块140按照保护代码的入口点修改全局配置文件，对于安卓程序安卓包，可以检查全局配置文件(AndroidManifest.xml)是否配置有应用节点标签(application)；若是，按照保护代码的入口点修改应用节点标签；若否，新建应用节点标签，并按照保护代码的入口点配置新建的应用节点标签。在进行解析时，根 据全局配置文件的应用节点标签，会首先执行保护代码，以对该类的程序进行解密。由于对每类的代码分别可以植入保护代码，因此，不需要一次性全部还原全部dex，仅在该类被加载时，才需要还原该类的执行代码，实现了内存分割。
打包模块150配置为将修改后的全局配置文件和可执行文件重新打包生成加固安装包，完成整个加固流程。
另外，获取模块160还可以接收由用户上传的软件安装包和设置的加固参数。由于加固后的软件安装包可能无法被静态和动态扫描，有可能会被一些恶意代码利用，因此需要首先对上传的软件安装包进行安全扫描，保证不对恶意程序进行加固处理，此时需要获取相关开发信息和加固参数。
本实施例中提供的针对Android软件安装包的安全扫描，并不是对Android系统中的所有文件进行扫描，而是通过扫描Android安装包来进行安全检测。由于Android上的病毒、木马和其他恶意软件想要进入用户的手机，需要打包成Android安装包的形式。反过来说，如果不是一个合法的Android安装包，它就无法安装到用户手机上，也就不会对用户产生危害。具体的扫描方式，可以根据上述对Android安装包的文件结构分析进行，例如对包名、数字签名、AndroidManifest.xml中列出的各模块的入口信息、Dex文件和ELF文件进行安全检测，在确认其安全性后再允许进行加固措施。
扫描Android安装包的一种可选流程为：
从Android安装包中提取出指定的特征信息；指定的特征信息即指上述列举的各项重要特征，如包名、版本号、数字签名、AndroidManifest.xml中列出的各模块的入口信息、Dex文件和ELF文件、Android安装包目录下各文件的MD5值等。
在预置的安全识别库中查找与指定的单个特征信息或其组合相匹配的特征记录；其中，安全识别库中包含特征记录及特征记录对应的安全级别，每条特征记录中包含单个特征信息或特征信息的组合；
将查找到的特征记录对应的安全级别进行输出，例如包含在Android安装包的安全检测结果中显示；当查找出的安全级别低于预设的安全级别，则安装包的上传者提示安全检测结果，并提示无法进行加固。
签名模块170用于对加固安装包进行签名。签名的信息有两种，一种是将加固后的程序安装包下发给用户，由用户自行进行签名，另外一种也可以获取用户的信息，在加固后直接进行签名，签名的方式可以由用户自行决定。
本发明实施例还提供了一种软件安装包的加固保护方法，该软件安装包的加固保护法可以由以上实施例介绍的任意一种软件安装包的加固保护装置来执行，以提 高软件安装包的安全性。图2是根据本发明一个实施例的软件安装包方法的示意图，如图所示，该软件安装包包括以下步骤：
步骤S202，提取软件安装包中的全局配置文件和可执行文件；
步骤S204，解析可执行文件，得到第一代码；
步骤S206，将保护代码插入第一代码中得到第二代码，并对第二代码进行加密处理；
步骤S208，按照保护代码的入口点修改全局配置文件；
步骤S210，将修改后的全局配置文件和可执行文件重新打包生成加固安装包。
其中保护代码可以包括对可执行文件进行加壳和解壳的代码，具体地可以例如解壳触发代码和和反编译工具的崩溃代码，相应地步骤S206加入代码的流程可以包括：在第一代码中的每一类的代码中置入解壳触发代码和反编译工具的崩溃代码，解壳触发代码被执行时，调用解壳的代码对该类进行解密。其中对第二代码进行加密处理包括：抽取第二代码的至少一部分进行重构；植入用于解密重构的代码的链接库，链接库在解密过程中由java本地接口(Java Native Interface，简称JNI)加载。
在本实施例的软件安装包的加固保护方法应用于安卓系统的软件安装包时，对dex文件的重构，将dex文件各个节数据修改重组后重定位并生成新dex，由于直接对dex进行处理，可以增加dex防护的灵活度，如对dex进行内存分割重组，可有效防止内存dump等。
步骤S208的一种可选流程为：检查全局配置文件是否配置有应用节点标签；若是，按照保护代码的入口点修改应用节点标签；若否，新建应用节点标签，并按照述保护代码的入口点配置新建的应用节点标签。对于安卓程序安卓包，可以检查全局配置文件(AndroidManifest.xml)是否配置有应用节点标签(application)；若是，按照保护代码的入口点修改应用节点标签；若否，新建应用节点标签，并按照保护代码的入口点配置新建的应用节点标签。在进行解析时，根据全局配置文件的应用节点标签，会首先执行保护代码，以对该类的程序进行解密。由于对每类的代码分别可以植入保护代码，因此，不需要一次性全部还原全部dex，仅在该类被加载时，才需要还原该类的执行代码，实现了内存分割。
在步骤S202之前还可以接收由用户上传的软件安装包和设置的加固参数。另外由于加固后的软件安装包可以可能无法被静态和动态扫描，有可能会被一些恶意代码利用，因此需要首先对上传的软件安装包进行安全扫描，保证不对恶意程序进行加固处理，此时需要获取相关开发信息和加固参数，用于对软件安装包进行安全扫描，对恶意文件及时处理。
对上传的软件安装包进行安全扫描的一种可选流程为：
从Android安装包中提取出指定的特征信息；指定的特征信息即指上述列举的各项重要特征，如包名、版本号、数字签名、AndroidManifest.xml中列出的各模块的入口信息、Dex文件和ELF文件、Android安装包目录下各文件的MD5值等。
在预置的安全识别库中查找与指定的单个特征信息或其组合相匹配的特征记录；其中，安全识别库中包含特征记录及特征记录对应的安全级别，每条特征记录中包含单个特征信息或特征信息的组合；
将查找到的特征记录对应的安全级别输出。
当查找出的安全级别低于预设的安全级别，则安装包的上传者提示安全检测结果，并提示无法进行加固。
生成加固安装包之后还需要对加固安装包进行签名。签名的方式可以下发加固安装包，由用户使用其身份标识对加固安装包进行签名；或者可以利用用户上传的身份标识对加固安装包进行签名。
图3是根据本发明一个实施例的软件安装包加固方法的流程图，在进行安卓安装包加固时依次执行以下步骤：
步骤S302，通过网页服务接收用户的访问，用户可以通过访问安全加固的网页进行相关测试加固；
步骤S304，接收上传的apk文件包以及加固参数；
步骤S306，解析apk文件包并提取manifest、dex等数据信息；
步骤S308，重构dex，修改manifest，重新生成apk文件包；
步骤S310，重新签名加固后的apk文件包。
在以上步骤中，S308是加固的核心步骤，图4是图3中所示的重新生成apk文件包的可选流程图，在进行apk加固时，依次执行以下步骤：
步骤S402，获取manifest需要修改的数据节点信息，查看manifest是否配置有应用节点标签(application)，以进行相应的处理，将加固程序的入口点加入应用节点标签，使应用从加固程序启动；
步骤S404，修改资源数据使之与manifest的节点数据一致；
步骤S406，对原包dex文件进行处理，具体地，可以将原包的dex解析为代码，将保护代码插入dex的解析代码中，保护代码的入口点已经在步骤S402中在manifest中进行了注册；
步骤S408，植入保护模块，该保护模块为用于解码的JNI层的.so的动态链接库的代码，同样植入dex包；
步骤S410，完成对dex文件进行加密。
其中，由于未加固的dex文件的安全性太弱，将核心代码植入保护模块可以实现程序在运行过程中实现脱壳，保护模块放入JNI内，利用JNI可以构造Java的类或执行Java层的方法获取属性等操作。
由于本实施例的软件安装包加固方法，通过在dex中置入代码进行加密，没有改变apk文件的本身结构，提高了兼容性。
由于对程序中的类进行分别处理，可以实现在加载的过程中，仅解密加载类，防止出现对整个内存截取。图5是根据本发明一个实施例的软件安装包加固方法中程序类加载的示意图，如图，每一类分别进行加密，在安卓系统加载该类时，对该类进行解密，例如某个安装包中有两个类，第一程序类和第二程序类，当系统加载第一程序类时，钩取该类中关键点，JNI可以对第一程序类进行解密并传回给dex进行加载，类似地当系统加载第二程序类时，钩取该类中关键点，JNI可以对第二程序类进行解密并传回给dex进行加载，此时内存中不存在所有的dex，因此无法进行内存截取。
本实施例的软件安装包加固方法可以实现二次或者多次加壳，在执行时进行动态脱壳，相比于现有技术只有一次加壳明显更具有安全优势，而现有技术更容易被破解。
另外，为了防止破解通过同时加载所有类来进行破解，可以判断所有类的列表中是否有超过阈值的类被加载(例如同时加载70％以上的类时)，可以消除最先解密类的数据，保证内存不会出现全部的数据，防止被内存截取。
本实施例的技术方案，将保护代码直接插入可执行文件的代码内，相应修改全局配置文件的程序入口，实现了可执行文件的重构，从而在程序运行时，首先执行保护代码，以进行相应解密处理，直接对可执行文件进行处理，增加了可执行文件防护的灵活度，进一步提高了软件安装包的安全性。
而且，本实施例采用云端加固方式，开发者可以直接从开放平台首页(例如dev.360.cn)进入加固保页面，在网页上点击“上传应用”。一键上传，自动加固，应用可以在后台完成安全监测和保护；接着点击“下载应用”，把下载的加固包重新签名，即可将最安全的产品分发到各个应用市场。另外，本实施例的页面上还可以提供签名工具，或者允许用户上传签名秘钥在完成加固后自动进行签名。
进一步地，在每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码，在每一类运行时，单独对运行的类进行解密，可以有效防止破解工具进行内存截取(dump)。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的检测可疑DNS的装置和可疑DNS的处理系统中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图6示出了可以实现根据本发明的软件安装包的加固保护方法的计算设备，例如个人计算机等。该计算设备传统上包括处理器610和以存储器620形式的 计算机程序产品或者计算机可读介质。存储器620可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器620具有用于执行上述方法中的任何方法步骤的程序代码831的存储空间630。例如，用于程序代码的存储空间630可以包括分别用于实现上面的方法中的各种步骤的各个程序代码631。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图7所述的便携式或者固定存储单元。该存储单元可以具有与图6的计算设备中的存储器620类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码631’，即可以由例如诸如610之类的处理器读取的代码，这些代码当由服务器运行时，导致该服务器执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
至此，本领域技术人员应认识到，虽然本文已详尽示出和描述了本发明的多个示例性实施例，但是，在不脱离本发明精神和范围的情况下，仍可根据本发明公开的内容直接确定或推导出符合本发明原理的许多其他变型或修改。因此，本发明的范围应被理解和认定为覆盖了所有这些其他变型或修改。

Claims (17)

  1. 一种软件安装包的加固保护方法，包括：
    提取软件安装包中的全局配置文件和可执行文件；
    解析所述可执行文件，得到第一代码；
    将保护代码插入所述第一代码中得到第二代码，并对所述第二代码进行加密处理；
    按照所述保护代码的入口点修改所述全局配置文件；
    将修改后的全局配置文件和可执行文件重新打包生成加固安装包。
  2. 根据权利要求1所述的方法，其中，
    所述保护代码包括对所述可执行文件进行加壳和解壳的代码。
  3. 根据权利要求2所述的方法，其中，
    所述保护代码还包括解壳触发代码和和反编译工具的崩溃代码；
    将保护代码插入所述第一代码中得到第二代码包括：
    在所述第一代码中的每一类的代码中置入解壳触发代码和反编译工具的崩溃代码，所述解壳触发代码被执行时，调用所述解壳的代码对该类进行解密。
  4. 根据权利要求1至3中任一项所述的方法，其中，对所述第二代码进行加密处理包括：
    抽取所述第二代码的至少一部分进行重构；
    植入用于解密所述重构的代码的链接库，所述链接库在解密过程中由java本地接口加载。
  5. 根据权利要求1至4中任一项所述的方法，其中，按照所述保护代码的入口点修改所述全局配置文件包括：
    检查所述全局配置文件是否配置有应用节点标签；
    若是，按照所述保护代码的入口点修改所述应用节点标签；
    若否，新建应用节点标签，并按照所述保护代码的入口点配置新建的应用节点标签。
  6. 根据权利要求1至5中任一项所述的方法，其中，在提取软件安装包中的全局配置文件和可执行文件之前还包括：
    接收由用户上传的所述软件安装包和设置的加固参数。
  7. 根据权利要求1至6中任一项所述的方法，其中，在生成加固安装包之后还包括：
    对所述加固安装包进行签名。
  8. 根据权利要求7所述的方法，其中，对所述加固安装包进行签名包括：
    下发所述加固安装包，由用户使用其身份标识对所述加固安装包进行签名；或者
    利用用户上传的身份标识对所述加固安装包进行签名。
  9. 根据权利要求1至8中任一项所述的方法，其中，
    所述软件安装包为安卓软件安装包，所述全局配置文件为manifest文件，所述可执行文件为dex文件。
  10. 一种软件安装包的加固保护装置，包括：
    文件提取模块，配置为提取软件安装包中的全局配置文件和可执行文件；
    解析模块，配置为解析所述可执行文件，得到第一代码；
    加密模块，配置为将保护代码插入所述第一代码中得到第二代码，并对所述第二代码进行加密处理；
    配置模块，配置为按照所述保护代码的入口点修改所述全局配置文件；
    打包模块，配置为将修改后的全局配置文件和可执行文件重新打包生成加固安装包。
  11. 根据权利要求10所述的装置，其中，所述加密模块还被配置为：
    在所述第一代码中的每一类的代码中置入解壳触发代码和和反编译工具的崩溃代码；
    抽取所述第二代码的至少一部分进行重构；
    植入用于解密述重构的代码的链接库，所述链接库在解密过程中由java本地接口加载。
  12. 根据权利要求10或11所述的装置，其中，所述配置模块还配置为：
    检查所述全局配置文件是否配置有应用节点标签；
    若是，按照所述保护代码的入口点修改所述应用节点标签；
    若否，新建应用节点标签，并按照所述保护代码的入口点配置新建的应用节点标签。
  13. 根据权利要求10至12中任一项所述的装置，还包括：
    获取模块，配置为接收由用户上传的所述软件安装包和设置的加固参数。
  14. 根据权利要求10至13中任一项所述的装置，还包括：
    签名模块，配置为对所述加固安装包进行签名。
  15. 根据权利要求10至14中任一项所述的装置，配置为对安卓软件安装包进行加固保护，其中，所述全局配置文件为manifest文件，所述可执行文件为dex文件。
  16. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1至9中的任一项所述的软件安装包的加固保护方法。
  17. 一种计算机可读介质，其中存储了如权利要求16所述的计算机程序。
PCT/CN2014/095791 2014-06-17 2014-12-31 软件安装包的加固保护方法和装置 WO2015192637A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410271094.6A CN104021321B (zh) 2014-06-17 软件安装包的加固保护方法和装置
CN201410271094.6 2014-06-17

Publications (1)

Publication Number Publication Date
WO2015192637A1 true WO2015192637A1 (zh) 2015-12-23

Family

ID=51438071

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095791 WO2015192637A1 (zh) 2014-06-17 2014-12-31 软件安装包的加固保护方法和装置

Country Status (1)

Country Link
WO (1) WO2015192637A1 (zh)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107609394A (zh) * 2017-08-28 2018-01-19 上海移卓网络科技有限公司 Android安装包的防篡改方法、存储设备及装置
US20180204004A1 (en) * 2015-06-29 2018-07-19 Zte Corporation Authentication method and apparatus for reinforced software
CN109614107A (zh) * 2018-11-01 2019-04-12 同盾控股有限公司 一种软件开发工具包的集成方法和装置
WO2019134272A1 (zh) * 2018-01-05 2019-07-11 武汉斗鱼网络科技有限公司 应用安装包二次打包检测方法、存储介质、设备及系统
CN110276174A (zh) * 2019-06-18 2019-09-24 福州数据技术研究院有限公司 基于安卓的双系统终端防止apk二次打包运行方法
CN110275710A (zh) * 2019-06-10 2019-09-24 天翼电子商务有限公司 一种Java本地接口一致性检查方法及系统、存储介质及终端
CN110896540A (zh) * 2019-11-21 2020-03-20 国网辽宁省电力有限公司电力科学研究院 移动互联网客户端安全评估工具、方法、计算机设备及存储介质
CN111258587A (zh) * 2020-01-17 2020-06-09 苏宁云计算有限公司 一种安卓应用插件化的实现方法、装置、设备及存储介质
CN111459822A (zh) * 2020-04-01 2020-07-28 北京字节跳动网络技术有限公司 系统组件数据的提取方法、装置、设备及可读介质
CN112199645A (zh) * 2020-10-16 2021-01-08 国能日新科技股份有限公司 基于Springboot的Jar包加密方法及装置
CN113377415A (zh) * 2021-06-28 2021-09-10 郑州阿帕斯数云信息科技有限公司 应用发布方法及装置
CN113472828A (zh) * 2020-03-30 2021-10-01 南京南瑞继保电气有限公司 用于远程数据采集和控制的方法、装置及系统
CN118133247A (zh) * 2024-03-05 2024-06-04 北京芯境科技有限责任公司 一种基于Android移动端的软件加固方法及系统

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1749915A (zh) * 2005-10-19 2006-03-22 北京飞天诚信科技有限公司 从软件中提取部分代码至加密装置中的软件版权保护方法
CN1971519A (zh) * 2005-11-24 2007-05-30 富士施乐株式会社 用于生成受保护可执行程序的设备、存储介质和方法
CN101156157A (zh) * 2005-02-11 2008-04-02 辛普雷克斯梅杰有限公司 软件保护方法
US20080163375A1 (en) * 2006-12-28 2008-07-03 Savagaonkar Uday R Embedding and patching integrity information in a program file having relocatable file sections
CN102087605A (zh) * 2011-01-28 2011-06-08 宇龙计算机通信科技(深圳)有限公司 一种基于android平台应用安装控制方法及系统
CN103177210A (zh) * 2013-04-02 2013-06-26 中国人民大学 一种在Android中植入动态污点分析模块的方法
CN103713904A (zh) * 2013-12-26 2014-04-09 北京奇虎科技有限公司 在移动终端工作区内安装应用的方法、相关装置和系统
CN103886230A (zh) * 2014-02-24 2014-06-25 四川长虹电器股份有限公司 android系统的软件版权保护方法及其系统
CN104021321A (zh) * 2014-06-17 2014-09-03 北京奇虎科技有限公司 软件安装包的加固保护方法和装置
CN104239757A (zh) * 2014-09-30 2014-12-24 北京奇虎科技有限公司 应用程序防止逆向的方法及装置、运行方法及终端

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101156157A (zh) * 2005-02-11 2008-04-02 辛普雷克斯梅杰有限公司 软件保护方法
CN1749915A (zh) * 2005-10-19 2006-03-22 北京飞天诚信科技有限公司 从软件中提取部分代码至加密装置中的软件版权保护方法
CN1971519A (zh) * 2005-11-24 2007-05-30 富士施乐株式会社 用于生成受保护可执行程序的设备、存储介质和方法
US20080163375A1 (en) * 2006-12-28 2008-07-03 Savagaonkar Uday R Embedding and patching integrity information in a program file having relocatable file sections
CN102087605A (zh) * 2011-01-28 2011-06-08 宇龙计算机通信科技(深圳)有限公司 一种基于android平台应用安装控制方法及系统
CN103177210A (zh) * 2013-04-02 2013-06-26 中国人民大学 一种在Android中植入动态污点分析模块的方法
CN103713904A (zh) * 2013-12-26 2014-04-09 北京奇虎科技有限公司 在移动终端工作区内安装应用的方法、相关装置和系统
CN103886230A (zh) * 2014-02-24 2014-06-25 四川长虹电器股份有限公司 android系统的软件版权保护方法及其系统
CN104021321A (zh) * 2014-06-17 2014-09-03 北京奇虎科技有限公司 软件安装包的加固保护方法和装置
CN104239757A (zh) * 2014-09-30 2014-12-24 北京奇虎科技有限公司 应用程序防止逆向的方法及装置、运行方法及终端

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180204004A1 (en) * 2015-06-29 2018-07-19 Zte Corporation Authentication method and apparatus for reinforced software
CN107609394A (zh) * 2017-08-28 2018-01-19 上海移卓网络科技有限公司 Android安装包的防篡改方法、存储设备及装置
WO2019134272A1 (zh) * 2018-01-05 2019-07-11 武汉斗鱼网络科技有限公司 应用安装包二次打包检测方法、存储介质、设备及系统
CN109614107B (zh) * 2018-11-01 2022-09-16 同盾控股有限公司 一种软件开发工具包的集成方法和装置
CN109614107A (zh) * 2018-11-01 2019-04-12 同盾控股有限公司 一种软件开发工具包的集成方法和装置
CN110275710A (zh) * 2019-06-10 2019-09-24 天翼电子商务有限公司 一种Java本地接口一致性检查方法及系统、存储介质及终端
CN110275710B (zh) * 2019-06-10 2023-07-14 天翼电子商务有限公司 一种Java本地接口一致性检查方法及系统、存储介质及终端
CN110276174A (zh) * 2019-06-18 2019-09-24 福州数据技术研究院有限公司 基于安卓的双系统终端防止apk二次打包运行方法
CN110896540A (zh) * 2019-11-21 2020-03-20 国网辽宁省电力有限公司电力科学研究院 移动互联网客户端安全评估工具、方法、计算机设备及存储介质
CN111258587A (zh) * 2020-01-17 2020-06-09 苏宁云计算有限公司 一种安卓应用插件化的实现方法、装置、设备及存储介质
CN111258587B (zh) * 2020-01-17 2023-08-22 苏宁云计算有限公司 一种安卓应用插件化的实现方法、装置、设备及存储介质
CN113472828A (zh) * 2020-03-30 2021-10-01 南京南瑞继保电气有限公司 用于远程数据采集和控制的方法、装置及系统
CN113472828B (zh) * 2020-03-30 2024-03-19 南京南瑞继保电气有限公司 用于远程数据采集和控制的方法、装置及系统
CN111459822A (zh) * 2020-04-01 2020-07-28 北京字节跳动网络技术有限公司 系统组件数据的提取方法、装置、设备及可读介质
CN111459822B (zh) * 2020-04-01 2023-10-03 抖音视界有限公司 系统组件数据的提取方法、装置、设备及可读介质
CN112199645A (zh) * 2020-10-16 2021-01-08 国能日新科技股份有限公司 基于Springboot的Jar包加密方法及装置
CN113377415A (zh) * 2021-06-28 2021-09-10 郑州阿帕斯数云信息科技有限公司 应用发布方法及装置
CN118133247A (zh) * 2024-03-05 2024-06-04 北京芯境科技有限责任公司 一种基于Android移动端的软件加固方法及系统

Also Published As

Publication number Publication date
CN104021321A (zh) 2014-09-03

Similar Documents

Publication Publication Date Title
WO2015192637A1 (zh) 软件安装包的加固保护方法和装置
KR101471589B1 (ko) 공통중간언어 기반 프로그램을 위한 보안 제공 방법
CN106778103B (zh) 一种安卓应用程序防逆向破解的加固方法、系统及解密方法
KR101503785B1 (ko) 동적 라이브러리를 보호하는 방법 및 장치
CN108229112B (zh) 一种保护应用程序、应用程序的运行方法以及装置
CN104239757B (zh) 应用程序防止逆向的方法及装置、运行方法及终端
You et al. Taintman: An art-compatible dynamic taint analysis framework on unmodified and non-rooted android devices
CN104392181A (zh) So文件的保护方法、装置及安卓安装包的加固方法和系统
WO2016078130A1 (zh) 一种防逆向apk文件的动态加载方法
You et al. Reference hijacking: Patching, protecting and analyzing on unmodified and non-rooted android devices
CN109255235B (zh) 基于用户态沙箱的移动应用第三方库隔离方法
JPWO2006009081A1 (ja) アプリケーション実行装置及びアプリケーション実行装置のアプリケーション実行方法
KR20120032477A (ko) 화이트박스 암호화를 사용하는 연동 바이너리 보호 방법
CN107430650B (zh) 保护计算机程序以抵御逆向工程
CN105512521A (zh) 一种软件安装包的加固保护方法和系统
KR101695639B1 (ko) 클라우드 기반의 애플리케이션 보안 서비스 제공 방법 및 시스템
Shioji et al. Code shredding: byte-granular randomization of program layout for detecting code-reuse attacks
CN105760721B (zh) 一种软件加固方法和系统
CN105740703A (zh) 一种应用程序的加固方法及装置
EP2492833A1 (en) Method and apparatus for detecting malicious software
Lim et al. Structural analysis of packing schemes for extracting hidden codes in mobile malware
CN112134905B (zh) 基于安卓系统的签名方法、装置以及设备
CN114692134A (zh) 一种基于linux内核进程监控来保护代码及数据的系统和方法
CN108985096B (zh) 一种Android SQLite数据库安全增强、安全操作方法以及装置
El-Harake et al. Blocking advertisements on android devices using monitoring techniques

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14895341

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14895341

Country of ref document: EP

Kind code of ref document: A1