WO2016104918A1

WO2016104918A1 - Code conversion method and code conversion device

Info

Publication number: WO2016104918A1
Application number: PCT/KR2015/009483
Authority: WO
Inventors: 박문찬; 이동훈; 석재혁; 이세영
Original assignee: 고려대학교 산학협력단
Priority date: 2014-12-24
Filing date: 2015-09-09
Publication date: 2016-06-30
Also published as: KR101628923B1

Abstract

The present invention relates to a code conversion method and a code conversion device comprising: a protection function selection step (b) of, in order to select a function to be protected, selecting a flattening function, the control flow of which is to be flattened, and an integrity function, the integrity of which is to be guaranteed; and a label generating step (c) of, in order to generate labels to be used in flattening for the flattening function, generating each bounding function to be used in each block of the flattening function. Use of the present invention enables generation of software having modulation resistance and a modulation detection function by utilizing an intermediate language.

Description

Transcoding method and transcoding device

The present invention relates to a code conversion method and a code conversion device, and more particularly, to a code conversion method and a code conversion device for generating software having a modulation resistance and a modulation detection function using an intermediate language.

The field of software protection is the study of how to protect software from malicious software analysis (e.g., software critical logic takeover) or software tampering (e.g., bypassing software license check routines). Among them, software tamper-detection relates to a method of detecting and responding to modulation when the software is tampered with, and software with tamper-resistance makes it difficult to tamper with the software and preemptively blocks it. It is about how to.

Software protection techniques can be classified according to their basis. Hardware-based protection is a technique to protect software based on the stability of hardware that is not accessible from the outside. Software-based protection is a technique that responds to software analysis or modulation without the help of hardware. Hardware-based protection schemes are generally known to be safer, but they require additional hardware, which incurs additional costs, and makes it difficult to adapt to multiple software environments depending on the hardware installed. As such, software-based protection schemes have various advantages over hardware-based protection schemes.

Software-based protection techniques use code conversion techniques to add modulation resistance and / or detection to the software. Code conversion is done at the source code level (eg C, Fortran, etc.) or at the binary code level (eg machine language). However, each of the source code level and binary level code conversion techniques has various limitations.

The source code level code conversion technique has limitations in preserving the code conversion effect due to optimization in the compilation process because the code conversion is performed at the source code level. Binary-level code conversion techniques make it difficult to interpret machine language and modify the machine language itself, which makes it difficult to add resistance and detection while maintaining the normal functioning of the software. In addition, the source code level conversion technique depends on the language in which the source code is written (for example, C, Fortran, etc.), and the binary level code conversion technique depends on the machine language (for example, x86, ARM, etc.). It is not easy to apply the same code conversion technique.

Accordingly, there is a need for a code conversion method and a code conversion device that can apply a software-based protection scheme to provide cost reduction and flexibility while solving various problems known in the software-based protection scheme.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and can easily add the functions of modulation detection and modulation resistance without affecting the original function based on software regardless of the language of the source code and the language type of the machine language. It is an object of the present invention to provide a method and a code conversion device.

A code conversion method for achieving the above object includes (b) selecting a function to be protected, selecting a protection function to flatten the control flow and an integrity function to be guaranteed integrity, and (c) generating labels to be used for flattening the flattening function, the label generating step of generating each branch function to be used in each of the blocks in the flattening function using the integrity function.

In addition, the code conversion apparatus for achieving the above object is a selector for selecting a function to be protected, and selects and flattening function for selecting a smoothing function that is to be flattened the control flow and an integrity function that is to be guaranteed integrity. A label generator for generating labels to be used for the flattening for the flattening, the label generating unit for generating each branch function to be used in each of the blocks in the flattening function using the integrity function.

The code conversion method and the code conversion device according to the present invention as described above can easily add the functions of modulation detection and modulation resistance without affecting the original function based on software regardless of the language of the source code and the language type of the machine language. It has an effect.

1 is a diagram illustrating an exemplary hardware block diagram of a code conversion device.

2 is a diagram illustrating an exemplary control flow for code conversion.

3 is a diagram illustrating an exemplary functional block diagram of a code conversion device.

4 illustrates a CFG for an exemplary planarization function that is a planarization target.

FIG. 5 shows the planarized CFG after applying the planarization treatment to the CFG of FIG. 4.

The above objects, features, and advantages will become more apparent from the following detailed description with reference to the accompanying drawings, and as such, those skilled in the art to which the present invention pertains may share the technical idea of the present invention. It will be easy to implement. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an exemplary hardware block diagram of a code conversion apparatus 100.

According to FIG. 1, the code conversion device 100 includes an input interface 101, an output interface 103, a memory 105, a storage medium 107, a system bus / control bus 111, and a processor 113. It may further include a communication interface 109. The specific hardware block may be omitted according to the use or modification of the code conversion apparatus 100. The code conversion device 100 is a device for converting source code (software) to enable modulation resistance and / or modulation detection. The code conversion apparatus 100 may be, for example, a personal computer used by a programmer or a distributor of a program, a laptop, or a server capable of providing a program's conversion function through an internet network.

Looking briefly at each hardware block of the code conversion apparatus 100, the input interface 101 is an interface for receiving a user input. The input interface 101 includes a mouse, a keyboard and / or a touch panel, and receives a user input for performing code conversion. The received input is delivered to the processor 113 as input data via the system bus / control bus 111.

The output interface 103 includes an LCD module, an LED module and / or a speaker, and is an interface for outputting a result or an intermediate result performed by the code conversion apparatus 100. The output interface 103 makes it possible to know the results for the transcoded software, for example.

Memory 105 includes volatile memory. The memory 105 may temporarily store various data and programs. For example, the memory 105 may be a code conversion program executed in the processor 113 or software that is an input of a code conversion program (or source code, hereinafter, the term 'software' and 'source code' are used interchangeably). Save it temporarily.

The storage medium 107 stores at least a code conversion program executed by the processor 113 and software that is an input target of the code conversion program. The software is organized at the source code level. For example, software is written in programming languages such as C, C ++, Fortran, Java, and so on.

The code conversion program converts the input software into an intermediate language (hereinafter also referred to as 'IR') so that the input software on the intermediate language has modulation resistance and / or modulation detection. The software translated into the designated machine language may be output to the output interface 103, stored in the storage medium 107, or output through the communication interface 109.

The processor 113 includes one or more execution units capable of executing instructions to execute code of a program stored in the storage medium 107. The processor 113 may be referred to as a so-called CPU, MPU, or the like.

In particular, the processor 113 loads the code conversion program stored in the storage medium 107 into the memory 105 and performs a code conversion program to convert the input software to have modulation resistance and / or modulation detectability. The processor 113 preferably adds code to translate the input software into the intermediate language and adds code to have modulation resistance and / or modulation detectability for the input software converted to the intermediate language or convert the input software to the designated machine language.

The processor 113, particularly the code conversion program, will be described in detail with reference to FIGS. 2 and 3.

The system bus / control bus 111 is a bus capable of transmitting and receiving various analog / digital data between hardware blocks. The system bus / control bus 111 may be a parallel bus or a serial bus or a dedicated bus for a particular hardware block. The system bus / control bus 111 may transmit and receive analog or digital data depending on the type of bus.

The communication interface 109 which can be further included is an interface for transmitting and receiving network packets connected to the Internet network. The communication interface 109 includes, for example, a PHY chip for connecting to Wi-Fi or a wired LAN.

2 is a diagram illustrating an exemplary control flow for code conversion. The code conversion control flow of FIG. 2 is performed, for example, on a hardware block diagram of the code conversion apparatus 100 of FIG. The code conversion control flow of FIG. 2 is performed by the processor 113 of the code conversion apparatus 100 and preferably consists of the instruction execution of the processor 113 by the code conversion program.

The code conversion control flow of FIG. 2 starts as the processor 113 of the code conversion apparatus 100 starts to perform the code conversion program stored in the storage medium 107 (S100) and ends as the code conversion program ends. S200).

First, the code conversion apparatus 100 (the processor 113) receives a selection for the software to be converted by the user through the input interface 101 (or the communication interface 109) (S101). In the selective reception of the software, the code conversion apparatus 100 loads the software stored in the storage medium 107 or received via the communication interface 109 into the memory 105 or the like.

Thereafter, the code conversion device 100 converts the loaded source code level software into a representation of an intermediate language (S103). The intermediate language can be, for example, instructions used in the known low level virtual machine (LLVM) compiler platform. The intermediate language of LLVM is an independent language that is independent of any kind of language at the source level and is also a language that is not dependent on machine language. LLVM's intermediate language supports machine-independent labels and can express various execution paths through labels.

In addition, the data based on the software converted into the intermediate language may be output to the output interface 103 by the code conversion apparatus 100. For example, the code conversion apparatus 100 outputs a function list included in the converted software through the output interface 103.

The user provides an input indicating the selection of a function that needs to be protected in the outputted function list through the input interface 101 and the code conversion apparatus 100 selects a function to be protected corresponding to the input according to the reception of the selection input. (S105).

The code conversion apparatus 100 selects a specific type of function from the function list by selecting a function that needs to be protected. In detail, the code conversion device 100 selects a function (hereinafter, referred to as a 'flattening function' or 'FF' (Flattening Function)) to which the control flow is to be flattened to make code analysis difficult. Select the function that is to be guaranteed (hereinafter also referred to as 'integrity function' or 'IF' (Integrity Function)). Furthermore, the code conversion apparatus 100 selects a function (hereinafter, also referred to as an 'encryption function' or an encryption function (EF)) to be encrypted. The selection of one or more functions may be determined by user input. Each type of function can be one or more. In addition, the flattening function is a function that must first be performed on the integrity function and the encryption function, and is set by the code conversion apparatus 100 or guided through the output interface 103.

The flattening function is a target function for flattening the control flow of the function to obfuscate the analysis. During the flattening function of the flattening function, various information for checking the integrity of the integrity function and generating a dynamic key to encrypt the encryption function ( Data) is generated. An integrity function is a target function whose integrity is to be guaranteed. It indicates a function that is not necessarily hidden but must not be tampered with. For example, the integrity function may be an anti-debugging routine or a license check routine. The encryption function is a function that must be protected by encryption, and a function that must be hidden to prevent the analysis itself can be specified. For example, an encryption function may be a fatal function when exposed to the outside including important logic of the software.

It should be noted that in the present invention, it is possible to check the integrity of the integrity function in various flattening processes for the flattening function, and further enable dynamic key generation. This will be described in detail below.

Thereafter, various labels to be used for the flattening for the flattening function selected in step S105 are generated (S107).

To generate a label, the code conversion apparatus 100 converts the selected flattening function into a control flow graph (CFG) and classifies the flattening function into flattenable blocks according to the conversion of the CFG. 4 shows CFG for a particular flattening function and FIG. 5 shows CFG after flattening application according to the invention (BB0 of FIG. 4 corresponds to BBa of FIG. 5 and the other blocks also have the same correspondence). As can be seen in FIG. 4, each block in the CFG is configured such that the code in the block does not branch to other blocks at execution and branches to other blocks after all the code in each block is completed.

Referring to FIG. 4 and FIG. 5, referring to a label generation process according to the present invention, the code conversion apparatus 100 first determines a label (for each block in the CFG of the flattening function).

, In the example of FIG. 5, i is a to f, and the branch function for each block (

) And the function to be used in the switch statement (

)

The label of the block indicates the execution start position of the corresponding block and the label may be represented by a variable. The branch function corresponding to each block is configured to be different from each other.

Branch function of each block

Depends on the branch condition after completion of the block, for example, if there is no branch (i.e., only one subsequent block is performed).

+ mask +

Expressed as ", and if a branch exists"

+ mask +

"Is expressed.

Is a hash function that takes an integrity function mapped to each block as an input argument. here

Represents a hash value of an IF (integrity function) mapped to each block. In the label generation process, the code conversion apparatus 100 determines which IF integrity is checked for each block. For example, the code conversion apparatus 100 randomly maps each block of the flattening function to a specific one IF. here,

Denotes any indicator indicating the starting position (branch position) at which block i starts on the transformed software.

May consist of a combination of numbers, a combination of letters, or a combination of numbers and letters and may be represented by a variable.

The mask is a value for correcting the block to be executed next according to the original function of the input software. Branch function

The branch function is not hardcoded as we will see below.

It is configured to itself (i.e. the code for the calculation of the branch function of each block) with the corresponding block embedded in the software converted to the code block. Accordingly branch function

Is the label value at actual execution of the converted software (

Is safe for static analysis methods.

Denotes the condition of the i block, allowing branching to a particular label according to true (1) or false (0) according to one or more conditions. Function F () has a specific label (

As a function for generating), F () can be expressed as a hash function whose output argument is a branch function. The function F () allows the switch statement to select the exact block position to be executed next time.

Here, the branch function according to the present invention consists of applying a hash function to the integrity function. Thus, if the integrity function is modulated, the hash value produced by the application of the hash function to the integrity function is also different. this is

Is changed and execution of each block does not work normally. If a change due to the modulation of the integrity function can be detected, it can correspond to the modulation. In the present invention, the modulation can be determined by the hash value used in the branch of the smoothing function to the integrity function. This will be described below.

Thereafter, the code conversion apparatus 100 generates a dynamic key for encryption of the encryption function (S109). The dynamic key generated by the present invention is not stored anywhere in the converted software. If the dynamic key is stored in the converted software, the encryption loses its meaning if the dynamic key is found externally.

Instead, the present invention generates a dynamic key using the label generated in the label generation step S107. Specifically, each block (i) of the smoothing function is (

,

) Pairs. Therefore, each and every block of the smoothing function

,

), And the code conversion device 100 generates a dynamic key using these ordered pairs having i as an index.

(or

) Is a value dynamically generated by the branch function B () when the corresponding block is executed, and a particular block of the smoothing function may or may not be executed depending on the condition of the software. Only when the same dynamic key can be derived from the converted software can the normal encrypted encryption function be decrypted and a corresponding solution is required.

The present invention solves this problem by using the known Shamir's Secret Sharing technique ((t, n) -threshold secret sharing). This secret splitting technique is a technique for recovering a secret when t or more splittings are collected among n splittings.

In order to enable dynamic key recovery by applying the secret partitioning scheme, the code conversion apparatus 100 derives the number of all blocks (n, 6 in the example of FIG. 4) through the CFG of the flattening function and the shortest execution path through the CFG. The length t (4 in the example of FIG. 4) is derived. The length t represents the number of blocks on the shortest execution path. The derivation of n and t can be easily performed by the code conversion apparatus 100. The code conversion apparatus 100 generates a secret dynamic key using the derived n and t.

The code conversion apparatus 100 flattens the flattening function using the generated label (S111). FIG. 5 shows the CFG after planarization is performed with respect to the CFG of FIG. 4. As can be seen from FIGS. 4 and 5, the inter-block execution dependency order on the original execution path is flattened through a switch statement. Each block (see BBa, BBb, etc. of FIG. 5) constitutes one code block together with a corresponding branch function (see Ba (), Bb (), etc. of FIG. 5). The branch function is not hardcoded and is coupled to the corresponding block as a function in accordance with the present invention. Therefore, when the converted software is executed and a specific block of the flattening function is executed, the corresponding branch function is executed immediately after completion of the execution of this specific block. The branch function dynamically calculates the labels to branch. Thus, static analysis of the planarization function is not possible.

Flattened code by flattening is the default label (

). The branch function of a particular block generates a branch label (or branch value) by applying a specified function (eg a hash function) to a specific integrity function. Therefore, when the integrity function is modulated, the branch label produced by the branch function also changes. In the present invention, the tampering of the integrity function can be detected using a default label (a label used when there is no matching label). Block of default labels (

) May output the modulation detection result of the software, including a modulation correspondence routine (eg, program termination, modulation detection output, modulation detection output to a designated server, etc.).

After generation of the dynamic key, the code conversion apparatus 100 encrypts the encryption function with the generated dynamic key (S113). The dynamic key according to the invention is not embedded in the software to be converted. Instead, in code execution of the flattened function, the flattened function performs t (shortest execution path length) blocks and branch functions through at least the shortest execution path, and thus transforms the dynamic key using these t branch functions. Software can be restored.

Thereafter, the code conversion device 100 performs an optimization process when necessary and converts the machine language through a compilation and linking process for the machine language designated by the user (S115). The code conversion apparatus 100 stores the converted machine language, that is, the converted software having the modulation resistance and the detection function, in the storage medium 107 (S117) or outputs it through the communication interface 109.

The code conversion method of FIG. 2 may be configured as a computer program that can be stored in a medium. The computer program is stored on a USB, CD, DVD, smart card or removable hard disk, or an internal hard disk. The computer program is executed on the hardware block (s) of FIG. 1, in particular the processor 113.

3 is a diagram illustrating an exemplary functional block diagram of a code conversion apparatus 100.

According to FIG. 3, the code conversion device 100 includes an intermediate language conversion unit 151, a module loader unit 153, a selection unit 155, a label generation unit 157, a dynamic key generation unit 159, and a flattening unit ( 161, an encryption unit 163, an optimizer 165, and a machine language converter 167. Some functional blocks in the functional block diagram of FIG. 3 may be omitted according to design variations. The functional blocks of FIG. 3 are performed on the hardware block diagram of FIG. 1 and are preferably constituted by a code conversion program executed by the processor 113. The code conversion program may be stored and distributed in various storage media 107 and executed by the processor 113 on the hardware block diagram of FIG.

The description of the functional block diagram of FIG. 3 will be described based on the differences from FIG. 2 in consideration of the description of FIG. 2, and the description omitted will be replaced with the corresponding description of FIG. 2.

The functional block diagram of FIG. 3 may constitute one software development platform. For example, the functional block diagram of FIG. 3 is configured within a Low Level Virtual Machine (LLVM) compilation platform to convert source level software to a specific binary level machine language. The known LLVM platform consists of the intermediate language conversion unit 151, the module loader unit 153, the optimization unit 165, and the machine language conversion unit 167. The known LLVM platform converts software into an intermediate level intermediate language. It is then translated into machine language.

3, the intermediate language converter 151 converts the input software selected by the user into a representation of the intermediate language. The intermediate language conversion unit 151 outputs software in the expression of the converted intermediate language. The output intermediate software is then transmitted to the module loader unit 153 or the like.

The module loader unit 153 loads various program modules to be used for software conversion according to the present invention. For example, the module loader 153 loads an encryption module, a hash function module, and a secret partition module. Such an encryption module, hash function module, secret division module and the like are included in the converted software at the time of software conversion. Then, when the converted software is executed, such a module is also performed as necessary to enable the original function of the software. The module loader section 153 preferably links these modules to software in an intermediate language representation. The modules loaded also consist of intermediate language representations.

The selector 155 selects a function to be protected. The selector 155 selects at least one flattening function that is an object to flatten the control flow and at least one integrity function whose integrity is to be guaranteed. In addition, the selector 155 selects one or more encryption functions to be encrypted. The flattening function may be a function preceding a particular one or more integrity functions and a particular one or more cryptographic functions.

The label generator 157 generates labels to be used in flattening for the flattening function. The label generator 157 generates a CFG for the flattening function and generates each branch function to be used in each block in the CFG. The particular branch function for a particular block contains a specified function whose argument is a mapped integrity function. This specified function can be a hash function, for example.

The dynamic key generation unit 159 generates a dynamic key to encrypt the encryption function using the branch functions. The dynamic key is generated using a secret partitioning technique that utilizes the length of the shortest execution path of the flattening function and the total number of blocks. The dynamic key is recoverable using branch functions of the length (number) of the shortest execution path of the smoothing function on the transformed software.

The flattening unit 161 flattens the selected flattening function. The planarization unit 161 configures one code block with each branch function corresponding to each of the blocks of the planarization function. The code in the flattened function thus dynamically executes the branch function after execution of the block, and the branch function dynamically calculates the label to branch to later with dynamic execution.

The code of the flattening function generated in the flattening unit 161 includes a default label, and the default label is configured to detect tampering of the software.

The encryption unit 163 encrypts the encryption function with the dynamic key generated by the dynamic key generation unit 159.

The optimizer 165 optimizes the intermediate language software generated or converted through each block. The optimization here is such that the code conversion result is maintained even after the application of the code conversion technique according to the invention.

The machine language converter 167 performs a link process using compilation or library of a designated or selected machine language. By converting the software of the intermediate language by the machine language conversion unit 167 into machine language, the converted software having the modulation resistance and the detection function is generated.

The converted software can be stored in the storage medium 107 or output via the communication interface 109.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

Claims

(b) selecting a function to be protected, selecting a protection function to be flattened for the control flow and an integrity function to be guaranteed for integrity; And

(c) generating labels to be used for flattening the flattening function, the label generating step of generating each branch function to be used in each of the blocks in the flattening function using the integrity function;

How to transcode.
The method of claim 1,

Before the step (b), (a) further converting the input software into the intermediate language;

(B) and (c) are performed on software converted into the intermediate language,

Each of the branch functions comprises a designated function whose argument is an integrity function mapped to a block;

How to transcode.
The method of claim 1,

Step (b) further selects an encryption function to be encrypted,

The code conversion method comprises the steps of: (d) generating a dynamic key to encrypt the encryption function using branch functions; And (f) encrypting the encryption function using the dynamic key;

The dynamic key is recoverable using branch functions of the number of blocks of the shortest execution path of the flattening function,

How to transcode.
The method of claim 1,

(e) flattening the flattening function, wherein each of the blocks constitutes one code block with each corresponding branch function;

The branch function dynamically calculates a label to branch at runtime,

How to transcode.
The method of claim 4, wherein

The code of the flattening function of step (e) includes a default label,

The default label is configured to detect tampering with the software,

How to transcode.
A computer program coupled to hardware and stored on a medium for executing each step of the code conversion method of claim 1.
A selection unit for selecting a function to be protected, the selection unit selecting a flattening function as an object to flatten the control flow and an integrity function as an object to be guaranteed;

A label generator for generating labels to be used for flattening the flattening function, the label generating unit generating each branch function to be used in each of the blocks in the flattening function using the integrity function;

Transcoding device.
The method of claim 7, wherein

An intermediate language conversion unit converting input software into an intermediate language and outputting the converted intermediate language software to the selection unit;

Each of the branch functions comprises a designated function whose argument is an integrity function mapped to a block;

Transcoding device.
The method of claim 7, wherein

The selection unit further selects an encryption function to be encrypted,

The code conversion device may include a dynamic key generation unit generating a dynamic key to encrypt the encryption function using branch functions; And an encryption unit for encrypting the encryption function using the dynamic key.

The dynamic key is recoverable using branch functions of the number of blocks of the shortest execution path of the flattening function,

Transcoding device.
The method of claim 7, wherein

And a flattening unit to flatten the flattening function such that each branch function corresponding to each of the blocks is composed of one code block.

The branch function dynamically calculates a label to branch at runtime,

Transcoding device.
The method of claim 10,

The code of the flattening function generated by the flattener includes a default label,

The default label is configured to detect tampering with the software,

Transcoding device.