WO2021232311A1 - 文件处理方法、文件处理装置、存储介质与电子设备 - Google Patents

文件处理方法、文件处理装置、存储介质与电子设备 Download PDF

Info

Publication number
WO2021232311A1
WO2021232311A1 PCT/CN2020/091375 CN2020091375W WO2021232311A1 WO 2021232311 A1 WO2021232311 A1 WO 2021232311A1 CN 2020091375 W CN2020091375 W CN 2020091375W WO 2021232311 A1 WO2021232311 A1 WO 2021232311A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
processed
packed
section
executable
Prior art date
Application number
PCT/CN2020/091375
Other languages
English (en)
French (fr)
Inventor
郭子亮
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to PCT/CN2020/091375 priority Critical patent/WO2021232311A1/zh
Priority to CN202080095222.XA priority patent/CN115039096A/zh
Publication of WO2021232311A1 publication Critical patent/WO2021232311A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation

Definitions

  • the present disclosure relates to the field of computer technology, and in particular to a file processing method, file processing device, computer-readable storage medium, and electronic equipment.
  • the present disclosure provides a file processing method, a file processing device, a computer-readable storage medium, and electronic equipment, thereby improving file security at least to a certain extent.
  • a file processing method including: obtaining a file to be processed and a packed file corresponding to the file to be processed; Section information, transform the packed file to obtain a first intermediate file; encrypt the file to be processed to obtain a second intermediate file; fuse the first intermediate file with the second intermediate file To generate an executable file corresponding to the file to be processed.
  • a file processing device including: a file acquisition module for acquiring a file to be processed and a packed file corresponding to the file to be processed; a file modification module for obtaining a file to be processed according to the The section information of the file and the section information of the packed file are modified to obtain the first intermediate file; the file encryption module is used to encrypt the file to be processed to obtain the second intermediate file File; a file fusion module for fusing the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned file processing method is realized.
  • an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions Perform the above file processing method.
  • the packed file is transformed to obtain the first intermediate file; the file to be processed is encrypted to obtain the second intermediate file; the first intermediate file and the second intermediate file are merged to generate an executable file corresponding to the file to be processed.
  • this exemplary embodiment proposes a new file processing method to modify the packed file, and merge the modified packed file with the file to be processed to generate the file to be processed
  • the corresponding executable file can effectively prevent the static decompilation of the file to be processed; on the other hand, the generated executable file, whether in the file form or in the memory, the packed file and the file to be processed are in a highly integrated state. It is difficult to restore it to the original and complete file to be processed, which ensures the security of the file to be processed; on the other hand, before file fusion is performed in this exemplary embodiment, the file to be processed is also encrypted, which further improves the generated executable file. The safety and reliability.
  • Fig. 1 shows a schematic diagram of a system architecture of this exemplary embodiment
  • Figure 2 shows a schematic diagram of a file processing method in the related art
  • FIG. 3 shows a flowchart of a file processing method of this exemplary embodiment
  • Fig. 4 shows a schematic diagram of a chain view of this exemplary embodiment
  • FIG. 5 shows a schematic diagram of an execution view of this exemplary embodiment
  • Fig. 6 shows a sub-flow chart of a file processing method of this exemplary embodiment
  • FIG. 7 shows a sub-flow chart of another file processing method of this exemplary embodiment
  • Fig. 8 shows a structural block diagram of a file processing device of this exemplary embodiment.
  • Exemplary embodiments of the present disclosure provide an electronic device for implementing a file processing method.
  • the electronic device includes at least a processor and a memory.
  • the memory is used to store executable instructions of the processor, and the processor is configured to execute the file processing method by executing the executable instructions.
  • Electronic devices can be implemented in various forms, such as mobile phones, tablet computers, notebook computers, personal digital assistants (PDAs), navigation devices, wearable devices, drones and other mobile devices, as well as desktop computers, Fixed equipment such as smart TVs.
  • PDAs personal digital assistants
  • FIG. 1 the structure of the electronic device will be exemplarily described below.
  • the configuration in FIG. 1 can also be applied to fixed-type equipment.
  • the mobile terminal 100 may include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the interface connection relationship between the components is only schematically shown, and does not constitute a structural limitation of the mobile terminal 100.
  • the mobile terminal 100 may also adopt a different interface connection manner from that in FIG. 1, or a combination of multiple interface connection manners.
  • the mobile terminal 100 may specifically include: a processor 110, an internal memory 121, an external memory interface 122, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, Battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 171, receiver 172, microphone 173, earphone interface 174, sensor module 180, display screen 190, camera module 191, indicator 192, motor 193, button 194, Subscriber Identification Module (SIM) card interface 195, etc.
  • the sensor module 180 may include a depth sensor 1801, a pressure sensor 1802, a gyroscope sensor 1803, an air pressure sensor 1804, and the like.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (Image Signal Processor, ISP), controller, video codec, digital signal processor (Digital Signal Processor, DSP), baseband processor and/or Neural-Network Processing Unit (NPU), etc.
  • AP application processor
  • modem processor GPU
  • image signal processor ISP
  • controller Video codec
  • DSP Digital Signal Processor
  • NPU Neural-Network Processing Unit
  • the different processing units may be independent devices or integrated in one or more processors.
  • the controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of reading instructions and executing instructions.
  • a memory may also be provided in the processor 110 to store instructions and data.
  • the memory can store instructions for implementing six modular functions: detection instructions, connection instructions, information management instructions, analysis instructions, data transmission instructions, and notification instructions, and the processor 110 controls the execution.
  • the memory in the processor 110 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. Repeated accesses are avoided, the waiting time of the processor 110 is reduced, and the efficiency of the system is improved.
  • the processor 110 may include one or more interfaces.
  • Interfaces can include integrated circuit (Inter-Integrated Circuit, I2C) interface, integrated circuit built-in audio (Inter-Integrated Circuit Sound, I2S) interface, pulse code modulation (Pulse Code Modulation, PCM) interface, universal asynchronous transceiver (Universal Asynchronous) Receiver/Transmitter, UART) interface, Mobile Industry Processor Interface (MIPI), General-Purpose Input/Output (GPIO) interface, Subscriber Identity Module (SIM) interface and/ Or Universal Serial Bus (Universal Serial Bus, USB) interface, etc. Connections are formed with other components of the mobile terminal 100 through different interfaces.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM Pulse Code Modulation
  • UART Universal Asynchronous transceiver
  • MIPI Mobile Industry Processor Interface
  • GPIO General-Purpose Input/Output
  • SIM Subscriber Identity Module
  • USB Universal Serial Bus
  • the USB interface 130 is an interface that complies with the USB standard specification, and specifically may be a MiniUSB interface, a MicroUSB interface, a USBTypeC interface, and the like.
  • the USB interface 130 can be used to connect a charger to charge the mobile terminal 100, can also connect to earphones to play audio through the earphones, and can also be used to connect the mobile terminal 100 to other electronic devices, such as computers, peripherals, and the like.
  • the charging management module 140 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the charging management module 140 may receive the charging input of the wired charger through the USB interface 130.
  • the charging management module 140 may receive the wireless charging input through the wireless charging coil of the mobile terminal 100. While the charging management module 140 charges the battery 142, it can also supply power to the electronic device through the power management module 141.
  • the power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110.
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the display screen 190, the camera module 191, and the wireless communication module 160.
  • the power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle times, and battery health status (leakage, impedance). In some other implementation manners, the power management module 141 may also be provided in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may also be provided in the same device.
  • the wireless communication function of the mobile terminal 100 can be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, and the baseband processor.
  • the antenna 1 and the antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in the mobile terminal 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • Antenna 1 can be multiplexed as a diversity antenna for a wireless LAN.
  • the antenna can be used in combination with a tuning switch.
  • the mobile communication module 150 may provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the mobile terminal 100.
  • the mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), and the like.
  • the mobile communication module 150 can receive electromagnetic waves by the antenna 1, filter, amplify, etc. the received electromagnetic waves, and transmit them to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic waves for radiation via the antenna 1.
  • at least part of the functional modules of the mobile communication module 150 may be provided in the processor 110.
  • at least part of the functional modules of the mobile communication module 150 and at least part of the modules of the processor 110 may be provided in the same device.
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal.
  • the demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the application processor outputs a sound signal through an audio device (not limited to the speaker 171, the receiver 172, etc.), or displays an image or video through the display screen 190.
  • the modem processor may be an independent device.
  • the modem processor may be independent of the processor 110 and be provided in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 160 can provide applications on the mobile terminal 100 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), and global navigation satellites. System (Global Navigation Satellite System, GNSS), Frequency Modulation (FM), Near Field Communication (NFC), Infrared Technology (Infrared, IR) and other wireless communication solutions.
  • the wireless communication module 160 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110.
  • the wireless communication module 160 may also receive a signal to be sent from the processor 110, perform frequency modulation, amplify, and convert it into electromagnetic waves to radiate through the antenna 2.
  • the antenna 1 of the mobile terminal 100 is coupled with the mobile communication module 150, and the antenna 2 is coupled with the wireless communication module 160, so that the mobile terminal 100 can communicate with the network and other devices through wireless communication technology.
  • Wireless communication technologies can include Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), and broadband code division. Multiple Access (Wideband Code Division Multiple Access, WCDMA), Time Division Code Division Multiple Access (Time Division-Synchronous Code Division Multiple Access, TD-SCDMA), Long Term Evolution (LTE), New Radio (NR) , BT, GNSS, WLAN, NFC, FM, and/or IR technology, etc.
  • GSM Global System for Mobile communications
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA Time Division Code Division Multiple Access
  • LTE Long Term Evolution
  • NR New Radio
  • GNSS can include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), Beidou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (Quasi-Zenith Satellite System, QZSS) and/or Satellite Based Augmentation Systems (SBAS).
  • GPS Global Positioning System
  • GLONASS Global Navigation Satellite System
  • BDS Beidou Navigation Satellite System
  • QZSS Quasi-Zenith Satellite System
  • SBAS Satellite Based Augmentation Systems
  • the mobile terminal 100 implements a display function through a GPU, a display screen 190, an application processor, and the like.
  • the GPU is an image processing microprocessor, which is connected to the display screen 190 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations and is used for graphics rendering.
  • the processor 110 may include one or more GPUs that execute program instructions to generate or change display information.
  • the display screen 190 is used to display images, videos, and the like.
  • the display screen 190 includes a display panel.
  • the display panel can be a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), Active-Matrix Organic Light-Emitting Diode, or Active-Matrix Organic Light-Emitting Diode (Active-Matrix Organic Light-Emitting Diode).
  • Emitting Diode, AMOLED Flexible Light Emitting Diode (Flexlight-Emitting Diode, FLED), Miniled, MicroLed, Micro-oLed, Quantum Dot Light Emitting Diodes (QLED), etc.
  • the mobile terminal 100 may include one or N display screens 190, and N is a positive integer greater than one.
  • the mobile terminal 100 may implement a shooting function through an ISP, a camera module 191, a video codec, a GPU, a display screen 190, and an application processor.
  • the ISP is used to process the data fed back from the camera module 191. For example, when taking a picture, the shutter is opened, and the light is transmitted to the photosensitive element of the camera through the lens, the light signal is converted into an electrical signal, and the photosensitive element of the camera transmits the electrical signal to the ISP for processing, which is converted into an image visible to the naked eye.
  • ISP can also optimize the image noise, brightness, and skin color. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene.
  • the ISP may be provided in the camera module 191.
  • the camera module 191 is used to capture still images or videos.
  • the object generates an optical image through the lens and is projected to the photosensitive element.
  • the photosensitive element may be a Charge Coupled Device (CCD) or a Complementary Metal-Oxide-Semiconductor (CMOS) phototransistor.
  • CCD Charge Coupled Device
  • CMOS Complementary Metal-Oxide-Semiconductor
  • the photosensitive element converts the optical signal into an electrical signal, and then transfers the electrical signal to the ISP to convert it into a digital image signal.
  • ISP outputs digital image signals to DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other formats of image signals.
  • the mobile terminal 100 may include 1 or N camera modules 191, and N is a positive integer greater than 1. If the mobile terminal 100 includes N cameras, one of the N cameras is the main camera.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the mobile terminal 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the energy of the frequency point.
  • Video codecs are used to compress or decompress digital video.
  • the mobile terminal 100 may support one or more video codecs. In this way, the mobile terminal 100 can play or record videos in multiple encoding formats, such as: Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, and so on.
  • MPEG Moving Picture Experts Group
  • MPEG2 MPEG2, MPEG3, MPEG4, and so on.
  • the external memory interface 122 may be used to connect an external memory card, such as a Micro SD card, so as to expand the storage capacity of the mobile terminal 100.
  • the external memory card communicates with the processor 110 through the external memory interface 122 to realize the data storage function. For example, save music, video and other files in an external memory card.
  • the internal memory 121 may be used to store computer executable program code, and the executable program code includes instructions.
  • the internal memory 121 may include a storage program area and a storage data area.
  • the storage program area can store an operating system, an application program (such as a sound playback function, an image playback function, etc.) required by at least one function, and the like.
  • the data storage area can store data (such as audio data, phone book, etc.) created during the use of the mobile terminal 100.
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (Universal Flash Storage, UFS), and the like.
  • the processor 110 executes various functional applications and data processing of the mobile terminal 100 by running instructions stored in the internal memory 121 and/or instructions stored in a memory provided in the processor.
  • the mobile terminal 100 can implement audio functions through the audio module 170, the speaker 171, the receiver 172, the microphone 173, the earphone interface 174, and an application processor. For example, music playback, recording, etc.
  • the audio module 170 is used to convert digital audio information into an analog audio signal for output, and is also used to convert an analog audio input into a digital audio signal.
  • the audio module 170 can also be used to encode and decode audio signals.
  • the audio module 170 may be provided in the processor 110, or part of the functional modules of the audio module 170 may be provided in the processor 110.
  • the speaker 171 also called “speaker” is used to convert audio electrical signals into sound signals.
  • the mobile terminal 100 can listen to music through the speaker 171, or listen to a hands-free call.
  • the receiver 172 also called “earpiece” is used to convert audio electrical signals into sound signals.
  • the mobile terminal 100 answers a call or voice message, it can receive the voice by bringing the receiver 172 close to the human ear.
  • the microphone 173, also called “microphone” or “microphone”, is used to convert sound signals into electrical signals.
  • the user can approach the microphone 173 through the mouth to make a sound, and input the sound signal to the microphone 173.
  • the mobile terminal 100 may be provided with at least one microphone 173.
  • the mobile terminal 100 may be provided with two microphones 173, which can implement noise reduction functions in addition to collecting sound signals.
  • the mobile terminal 100 may also be provided with three, four or more microphones 173 to collect sound signals, reduce noise, identify sound sources, and realize directional recording functions.
  • the earphone interface 174 is used to connect wired earphones.
  • the earphone interface 174 may be a USB interface 130, or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, or a cellular Telecommunications Industry Association (Cellular Telecommunications Industry Association of the USA, CTIA) standard interface.
  • OMTP Open Mobile Terminal Platform
  • CTIA Cellular Telecommunications Industry Association
  • the depth sensor 1801 is used to obtain depth information of the scene.
  • the depth sensor may be provided in the camera module 191.
  • the pressure sensor 1802 is used to sense pressure signals and can convert the pressure signals into electrical signals.
  • the pressure sensor 1802 may be provided on the display screen 190.
  • the gyro sensor 1803 may be used to determine the movement posture of the mobile terminal 100.
  • the angular velocity of the mobile terminal 100 around three axes ie, x, y, and z axes
  • the gyro sensor 1803 can be used for image stabilization.
  • the gyroscope sensor 1803 detects the shake angle of the mobile terminal 100, calculates the distance that the lens module needs to compensate according to the angle, and allows the lens to counteract the shake of the mobile terminal 100 through reverse movement to achieve anti-shake.
  • the gyro sensor 1803 can also be used for navigation and somatosensory game scenes.
  • the air pressure sensor 1804 is used to measure air pressure. In some embodiments, the mobile terminal 100 calculates the altitude based on the air pressure value measured by the air pressure sensor 1804 to assist positioning and navigation.
  • sensors with other functions can be set in the sensor module 180, such as magnetic sensors, acceleration sensors, distance sensors, proximity light sensors, fingerprint sensors, temperature sensors, touch sensors, ambient light sensors, bone conduction sensors, etc. Wait.
  • the button 194 includes a power button, a volume button, and so on.
  • the button 194 may be a mechanical button. It can also be a touch button.
  • the mobile terminal 100 may receive key input, and generate key signal input related to user settings and function control of the mobile terminal 100.
  • the motor 193 can generate vibration prompts, such as vibration prompts for incoming calls, alarms, receiving messages, etc., and can also be used for touch vibration feedback, such as touch operations for different applications (such as photography, games, audio playback, etc.), or for display Touch operations in different areas of the screen 190 can correspond to different vibration feedback effects.
  • the touch vibration feedback effect can support customization.
  • the indicator 192 may be an indicator light, which may be used to indicate the charging status, power change, or to indicate messages, missed calls, notifications, and so on.
  • the SIM card interface 195 is used to connect to the SIM card.
  • the SIM card can be inserted into the SIM card interface 195 or pulled out from the SIM card interface 195 to achieve contact and separation with the mobile terminal 100.
  • the mobile terminal 100 may support 1 or N SIM card interfaces, and N is a positive integer greater than 1.
  • the SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc.
  • the same SIM card interface 195 can insert multiple cards at the same time. The types of multiple cards can be the same or different.
  • the SIM card interface 195 can also be compatible with different types of SIM cards.
  • the SIM card interface 195 may also be compatible with external memory cards.
  • the mobile terminal 100 interacts with the network through the SIM card to implement functions such as call and data communication.
  • the mobile terminal 100 adopts an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the mobile terminal 100 and cannot be separated from the mobile terminal 100.
  • the file can be packed by the UPX (the Ultimate Packer for eXecutables, advanced executable program file compressor) compression shell principle, with ELF (Executable and Linkable Format, executable and The linkable format) file is taken as an example for description.
  • the ELF file 210 to be packed may include an ELF header, and multiple section areas such as section area 1, section area 2, ..., section area n.
  • the specific packing steps may include: parsing the ELF file to be packed to obtain the information of each section area in the ELF file; traversing the ELF section area and compressing the content in the section area; The compressed data is reassembled into an ELF file, and the decompression code is inserted therein to generate a new ELF file 220.
  • the shell features are obvious, and after decompression, the content of the ELF file is continuous in the memory and is easy to be restored to the original ELF file. Therefore, this method is difficult to ensure the security of the file.
  • the present disclosure first proposes a file processing method, which can be applied to processing related business files to pack them, thereby improving the security of the business files.
  • Fig. 3 shows the flow of a file processing method in this exemplary embodiment, including the following steps S310 to S340:
  • Step S310 Obtain the file to be processed and the packed file corresponding to the file to be processed.
  • the file to be processed refers to a source business file that needs to be packed, and it can be a file in multiple formats, such as an ELF file, or a BIN (Binary, binary) file.
  • a packed file refers to a shell file used to pack a file to be processed, which is the same type of file as the file to be processed, and contains the core unpacking logic.
  • the packed file may be obtained from the packed system, for example, when a specific packed system or tool is used for file processing, the corresponding packed file is obtained from the packed system or tool.
  • the present exemplary embodiment can perform a file processing process particularly for ELF files.
  • the above-mentioned file to be processed and the packed file are both ELF files.
  • the ELF file is a format file used for binary files, executable files, object codes, shared libraries, and core dumps. It can consist of 4 parts, namely the ELF header and the Program header table. header table), section (Section) or segment (segments), and section header table (Section header table).
  • the ELF header is used to describe the organization of the entire ELF file
  • the program header table is used to describe various segments in the ELF file, so that the system can create a process image.
  • the section describes the ELF file from the perspective of operation
  • the section describes the ELF file from the perspective of linking.
  • the relationship between the section and the section is inclusive, and a section can contain several sections.
  • the section header table is used to describe the information of the file section area, such as size, offset and other information.
  • the ELF file format can provide two views, such as the link view 400 shown in FIG. 4 and the execution view 500 shown in FIG. 5.
  • the link view 400 uses the section as the unit, and the execution view 500 uses the segment as the unit.
  • the link view refers to the view used during linking, and the execution view is the view used during execution.
  • the file processing method may further include the following steps:
  • the file to be processed and the packed file need to be initialized, and the file to be processed and the packed file are linked to view through the packing tool or system.
  • the data structure is loaded into the memory to determine the section information of the file to be processed and the section information of the packed file.
  • the section information may include the name, type, memory size, and specific content contained in the section, such as data codes or character strings.
  • step S320 the packed file is modified according to the section information of the file to be processed and the section information of the packed file to obtain a first intermediate file.
  • this exemplary embodiment may modify the structure of the packed file to deform it.
  • the first intermediate file is the file after the packed file is modified, and the framework of the new file used for file fusion can be determined according to the first intermediate file.
  • Modifying the packed file can include calculating the memory size of the file to be processed and the multiple sections contained in the packed file, adjusting the size of the section contained in the packed file according to the calculated memory size, or moving The section header of a specific section in the packed file.
  • the section information of each section in the packed file may be copied to the corresponding section of the first intermediate file.
  • other security processing may be performed on the packed file, for example, native method obfuscation protection is performed on the source code of the packed file.
  • step S320 may include the following steps:
  • Step S610 Compare the section capacity in the file to be processed with the section capacity in the packed file, and determine the largest section capacity as the standard capacity
  • Step S620 adjust the section area of the packed file according to the standard capacity
  • Step S630 Erase at least one section in the packed file to obtain the first intermediate file.
  • the section capacity is the section size.
  • the section with the largest capacity is determined as the standard capacity, and then the section of the packed file is adjusted according to the standard capacity.
  • the capacity of a certain section in the file to be processed which is greater than the capacity of the corresponding section in the packed file
  • the capacity of the packed file is expanded to the standard capacity, so that the capacity of the section area of the packed file is increased after the transformation, so as to realize the expansion of the packed file.
  • the section information of the packed file can also be erased.
  • the erasing of at least one section in the packed file can be to hide the section or
  • the section area may be deleted, and corresponding processing methods may be adopted according to different application scenarios, which is not specifically limited in the present disclosure. Specifically, it can be implemented by erasing at least one section in the packed file.
  • at least one section area may be any section area or a specific section area, which is not specifically limited in the present disclosure.
  • erasing at least one section in the packed file may include the following steps:
  • erasing the preset types of sections in the packed file may include erasing specific types of data in the section header, such as ".interp”, “.hash”, “.rel.dyn", and ".rel.
  • step S330 the file to be processed is encrypted to obtain a second intermediate file.
  • the second intermediate file refers to a file obtained after encrypting the file to be processed.
  • symmetric encryption technology is often used to encrypt files, and the key is hard-coded in the program code.
  • This encryption method when the program is attacked by a black box, will threaten the operating environment of the encrypted device, including memory information, disk read and write permissions, etc., and the keys running in the memory will no longer be safe. Therefore, in this exemplary embodiment, white-box encryption may be used, or the key may be white-boxed to ensure the security of the key.
  • encrypting the file to be processed in step S330 may include the following steps:
  • the file to be processed is compressed, and white box encryption technology is used to encrypt the file to be processed.
  • the entire file to be processed may be encrypted using white box encryption technology.
  • the white box encryption technology can hide the encryption key in a series of data tables. During the encryption execution, the value of the key will not appear in the memory, so that it can perform encryption calculations in an insecure environment.
  • a static white box or a dynamic white box may be used, which is not specifically limited in the present disclosure.
  • this exemplary embodiment may also perform compression processing on the file to be processed, so as to save memory space and accelerate network transmission.
  • step S340 the first intermediate file and the second intermediate file are merged to generate an executable file corresponding to the file to be processed.
  • the executable file corresponding to the file to be processed is the file after the file to be processed is packed, and its type is the same as the type of the file to be processed and the packed file, for example, when the file to be processed and the packed file are ELF files,
  • the generated executable file is also an ELF file.
  • the two can be merged to generate an executable file corresponding to the file to be processed.
  • the process of merging can be regarded as a process of packing the file to be processed.
  • the first intermediate file may be executed first, so that information such as the entry address of the second intermediate file is protected.
  • the program of the first intermediate file ends the second intermediate file starts to execute.
  • the executable file corresponding to the generated file to be processed has a larger volume than the file to be processed that has not undergone fusion processing
  • the executable file may increase by 40KB-80KB compared to the original file to be processed.
  • larger executable files may affect the user experience for applications that are more sensitive to volume.
  • this exemplary embodiment may also perform compression processing on the file to be processed after it is generated, so as to improve the utilization of the memory space.
  • step S340 may include the following steps:
  • Step S710 copy the first intermediate file starting from the preset first address, and determine the second address where the last character of the copied first intermediate file is located;
  • Step S720 copy the second intermediate file to a third address located after the second address
  • Step S730 Combine the copied first intermediate file and the second intermediate file to generate an executable file.
  • the first intermediate file is the file after the packed file is modified
  • the second intermediate file is the file after the file to be processed is encrypted
  • the first intermediate file and the second intermediate file are merged
  • the process is essentially a process of generating a new file (the executable file corresponding to the file to be processed) based on these two files.
  • the specific fusion process may include determining the location of the first intermediate file in the executable file to be generated, that is, the first address, and copying all the contents of the first intermediate file to the first address.
  • the first address may refer to the start address of the executable file.
  • the end address of the first intermediate file in the executable file that is, the second address
  • the entire content of the second intermediate file is copied to a position after the second address, that is, the third address, so as to realize the fusion of the first intermediate file and the second intermediate file to generate the final executable file.
  • the file to be processed and the packed file corresponding to the file to be processed are obtained; the packed file is modified according to the section information of the file to be processed and the section information of the packed file to obtain the first An intermediate file; the file to be processed is encrypted to obtain a second intermediate file; the first intermediate file and the second intermediate file are merged to generate an executable file corresponding to the file to be processed.
  • this exemplary embodiment proposes a new file processing method to modify the packed file, and merge the modified packed file with the file to be processed to generate the file to be processed
  • the corresponding executable file can effectively prevent the static decompilation of the file to be processed; on the other hand, the generated executable file, whether in the file form or in the memory, the packed file and the file to be processed are in a highly integrated state. It is difficult to restore it to the original and complete file to be processed, which ensures the security of the file to be processed; on the other hand, before file fusion is performed in this exemplary embodiment, the file to be processed is also encrypted, which further improves the generated executable file. The safety and reliability.
  • the file processing device 800 may include: a file acquisition module 810, configured to acquire a file to be processed and a packed file corresponding to the file to be processed; With the section information of the packed file, the packed file is modified to obtain the first intermediate file; the file encryption module 830 is used to encrypt the file to be processed to obtain the second intermediate file; the file fusion module 840 is used to convert the first intermediate file An intermediate file is merged with the second intermediate file to generate an executable file corresponding to the file to be processed.
  • the file modification module includes: a capacity comparison unit, configured to compare the section capacity in the file to be processed with the section capacity in the packed file, and determine the largest section capacity as the standard capacity;
  • the section area adjustment unit is used to adjust the section area of the packed file according to the standard capacity;
  • the section area erasing unit is used to erase at least one section area in the packed file to obtain the first intermediate file.
  • the file fusion module includes: a first copying unit for copying the first intermediate file starting from a preset first address, and determining the last character of the first intermediate file to be copied The second address where the location is located; the second copy unit is used to copy the second intermediate file to the third address located after the second address; the file merging unit is used to merge the copied first intermediate file and the second intermediate file, Generate executable files.
  • the section erasing unit is used to erase a preset type of section in the packed file.
  • the file encryption module is used to compress the file to be processed, and uses white box encryption technology to encrypt the file to be processed.
  • the files to be processed and the packed files are both executable and linkable format files.
  • the file processing apparatus further includes: a loading module for loading the file to be processed and the packed file in the data structure of the link view after obtaining the file to be processed and the packed file corresponding to the file to be processed, To get the section information of the file to be processed and the section information of the packed file.
  • Exemplary embodiments of the present disclosure also provide a computer-readable storage medium on which is stored a program product capable of implementing the above-mentioned method of this specification.
  • various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code.
  • the program product runs on a terminal device, the program code is used to make the terminal device execute the above-mentioned instructions in this specification.
  • the steps described in the "Exemplary Methods" section according to various exemplary embodiments of the present disclosure for example, any one or more of the steps in FIG. 3, FIG. 6 or FIG. 7 may be performed.
  • the exemplary embodiments of the present disclosure also provide a program product for implementing the above method, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed on a terminal device, such as a personal computer. run.
  • a program product of the present disclosure is not limited thereto.
  • the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device.
  • the program product can adopt any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code for performing the operations of the present disclosure can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming. Language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on.
  • the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers for example, using Internet service providers

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

一种文件处理方法、文件处理装置、计算机可读存储介质与电子设备，涉及计算机技术领域。该文件处理方法包括：获取待处理文件和所述待处理文件对应的加壳文件（S310）；根据所述待处理文件的节区信息与所述加壳文件的节区信息，对所述加壳文件进行改造，得到第一中间文件（S320）；对所述待处理文件进行加密，得到第二中间文件（S330）；将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件（S340）。该方法可以对文件进行有效处理，提高文件安全性。

Description

文件处理方法、文件处理装置、存储介质与电子设备 技术领域
本公开涉及计算机技术领域，尤其涉及一种文件处理方法、文件处理装置、计算机可读存储介质与电子设备。
背景技术
随着计算机技术的迅速发展，各种应用程序或软件为人们带来便利的同时，也存在许多安全方面的问题，例如某些应用程序所涉及的编程语言容易被反编译，进而可能导致被加入恶意代码，影响应用程序的正常运行逻辑。因此，对文件进行保护，提高文件的安全性迫在眉睫。
现有技术中，通常会采用软件加壳技术，对文件注入一段二进制代码，以实现对文件加壳，从而保护文件安全。然而，采用上述方式对文件加壳后，往往其壳特征比较明显，且由于脱壳工具十分繁多，加壳后的文件仍然比较容易被恢复，难以对文件的安全性进行有效保障。因此，如何对文件进行有效处理，以提高其安全性，是现有技术亟待解决的问题。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
本公开提供了一种文件处理方法、文件处理装置、计算机可读存储介质与电子设备，进而至少在一定程度上提高文件安全性。
本公开的其他特性和优点将通过下面的详细描述变得显然，或部分地通过本公开的实践而习得。
根据本公开的第一方面，提供一种文件处理方法，包括：获取待处理文件和所述待处理文件对应的加壳文件；根据所述待处理文件的节区信息与所述加壳文件的节区信息，对所述加壳文件进行改造，得到第一中间文件；对所述待处理文件进行加密，得到第二中间文件；将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件。
根据本公开的第二方面，提供一种文件处理装置，包括：文件获取模块，用于获取待处理文件和所述待处理文件对应的加壳文件；文件改造模块，用于根据所述待处理文件的节区信息与所述加壳文件的节区信息，对所述加壳文件进行改造，得到第一中间文件；文件加密模块，用于对所述待处理文件进行加密，得到第二中间文件；文件融合模块，用于将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件。
根据本公开的第三方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现上述文件处理方法。
根据本公开的第四方面，提供一种电子设备，包括：处理器；以及存储器，用于存储所述处理器的可执行指令；其中，所述处理器配置为经由执行所述可执行指令来执行上述文件处理方法。
本公开的技术方案具有以下有益效果：
根据上述文件处理方法、文件处理装置、计算机可读存储介质与电子设备，获取待处理文件和待处理文件对应的加壳文件；根据待处理文件的节区信息与加壳文件的节区信息，对加壳文件进行改造，得到第一中间文件；对待处理文件进行加密，得到第二中间文件；将第一中间文件与第二中间文件进行融合，生成待处理文件对应的可执行文件。一方面，相比于现有技术，本示例性实施例提出一种新的文件处理方法，对加壳文件进行改造，并将改造后的加壳文件与待处理文件进行融合，生成待处理文件对应的可执行文件，可以有效防止待处理文件的静态反编译；另一方面，生成的可执行文件，不论是文件形态还是在内存中，加壳文件与待处理文件都处于高度融合的状态，难以将其还原为原始完整的待处理文件，保障了待处理文件的安全；再一方面，本示例性实施例在进行文件融合之前，还对待处理文件进行加密，进一步提高了生成的可执行文件的安全可靠性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出本示例性实施方式的一种系统架构的示意图；
图2示出相关技术中一种文件处理方法的示意图；
图3示出本示例性实施方式的一种文件处理方法的流程图；
图4示出本示例性实施方式的一种链式视图示意图；
图5示出本示例性实施方式的一种执行视图示意图；
图6示出本示例性实施方式的一种文件处理方法的子流程图；
图7示出本示例性实施方式的另一种文件处理方法的子流程图；
图8示出本示例性实施方式的一种文件处理装置的结构框图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。
此外，附图仅为本公开的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
本公开的示例性实施方式提供一种用于实现文件处理方法的电子设备。该电子设备至少包括处理器和存储器，存储器用于存储处理器的可执行指令，处理器配置为经由执行可执行指令来执行文件处理方法。
电子设备可以以各种形式来实施，例如可以包括手机、平板电脑、笔记本电脑、个人数字助理(Personal Digital Assistant，PDA)、导航装置、可穿戴设备、无人机等移动设备，以及台式电脑、智能电视等固定设备。下面以图1中的移动终端100为例，对电子设备的构造进行示例性说明。本领域技术人员应当理解，除了特别用于移动目的的部件之外，图1中的构造也能够应用于固定类型的设备。在另一些实施方式中，移动终端100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件、软件或软件和硬件的组合实现。各部件间的接口连接关系只是示意性示出，并不构成对移动终端100的结构限定。在另一些实施方式中，移动终端100也可以采用与图1不同的接口连接方式，或多种接口连接方式的组合。
如图1所示，移动终端100具体可以包括：处理器110、内部存储器121、外部存储器接口122、通用串行总线(Universal Serial Bus，USB)接口130、充电管理模块140、电源管理模块141、电池142、天线1、天线2、移动通信模块150、无线通信模块160、音频模块170、扬声器171、受话器172、麦克风173、耳机接口174、传感器模块180、显示屏190、摄像模组191、指示器192、马达193、按键194以及用户标识模块(Subscriber Identification Module，SIM)卡接口195等。其中传感器模块180可以包括深度传感器1801、压力传感器1802、陀螺仪传感器1803、气压传感器1804等。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(Application Processor，AP)、调制解调处理器、图形处理器(Graphics Processing Unit，GPU)、图像信号处理器(Image Signal Processor，ISP)、控制器、视频编解码器、数字信号处理器(Digital Signal Processor，DSP)、基带处理器和/或神经网络处理器(Neural-Network Processing Unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
控制器可以根据指令操作码和时序信号，产生操作控制信号，完成读取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。存储器可以存储用于实现六个模块化功能的指令：检测指令、连接指令、信息管理指令、分析指令、数据传输指令和通知指令，并由处理器110来控制执行。在一些实施方式中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施方式中，处理器110可以包括一个或多个接口。接口可以包括集成电路(Inter-Integrated Circuit，I2C)接口、集成电路内置音频(Inter-Integrated Circuit Sound，I2S)接口、脉冲编码调制(Pulse Code Modulation，PCM)接口、通用异步收发传输器(Universal Asynchronous Receiver/Transmitter，UART)接口、移动产业处理器接口(Mobile Industry Processor Interface，MIPI)、通用输入输出(General-Purpose Input/Output，GPIO)接口、用户标识模块(Subscriber Identity Module，SIM)接口和/或通用串行总线(Universal Serial Bus，USB)接口等。通过不同的接口和移动终端100的其他部件形成连接。
USB接口130是符合USB标准规范的接口，具体可以是MiniUSB接口，MicroUSB接口，USBTypeC接口等。USB接口130可以用于连接充电器为移动终端100充电，也可以连接耳机，通过耳机播放音频，还可以用于移动终端100连接其他电子设备，例如连接电脑、外围设备等。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。在一些有线充电的实施方式中，充电管理模块140可以通过USB接口130接收有线充电器的充电输入。在一些无线充电的实施方式中，充电管理模块140可以通过移动终端100的无线充电线圈接收无线充电输入。充电管理模块140为电池142充电的同时，还可以通过电源管理模块141为电子设备供电。
电源管理模块141用于连接电池142、充电管理模块140与处理器110。电源管理模块141接收电池142和/或充电管理模块140的输入，为处理器110、内部存储器121、显示屏190、摄像模组191和无线通信模块160等供电。电源管理模块141还可以用于监测电池容量，电池循环次数，电池健康状态(漏电，阻抗)等参数。在其他一些实施方式中，电源管理模块141也可以设置于处理器110中。在另一些实施方式中，电源管理模块141和充电管理模块140也可以设置于同一个器件中。
移动终端100的无线通信功能可以通过天线1、天线2、移动通信模块150、无线通信模块160、调制解调处理器以及基带处理器等实现。
天线1和天线2用于发射和接收电磁波信号。移动终端100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可 以将天线1复用为无线局域网的分集天线。在另外一些实施方式中，天线可以和调谐开关结合使用。
移动通信模块150可以提供应用在移动终端100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(Low Noise Amplifier，LNA)等。移动通信模块150可以由天线1接收电磁波，并对接收的电磁波进行滤波、放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施方式中，移动通信模块150的至少部分功能模块可以被设置于处理器110中。在一些实施方式中，移动通信模块150的至少部分功能模块可以与处理器110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器171，受话器172等)输出声音信号，或通过显示屏190显示图像或视频。在一些实施方式中，调制解调处理器可以是独立的器件。在另一些实施方式中，调制解调处理器可以独立于处理器110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块160可以提供应用在移动终端100上的包括无线局域网(Wireless Local Area Networks，WLAN)(如无线保真(Wireless Fidelity，Wi-Fi)网络)、蓝牙(Bluetooth，BT)、全球导航卫星系统(Global Navigation Satellite System，GNSS)、调频(Frequency Modulation，FM)、近距离无线通信技术(Near Field Communication，NFC)、红外技术(Infrared，IR)等无线通信的解决方案。无线通信模块160可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块160经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器110。无线通信模块160还可以从处理器110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
在一些实施方式中，移动终端100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得移动终端100可以通过无线通信技术与网络以及其他设备通信。无线通信技术可以包括全球移动通讯系统(Global System for Mobile communications，GSM)，通用分组无线服务(General Packet Radio Service，GPRS)，码分多址接入(Code Division Multiple Access，CDMA)，宽带码分多址(Wideband Code Division Multiple Access，WCDMA)，时分码分多址(Time Division-Synchronous Code Division Multiple Access，TD-SCDMA)，长期演进(Long Term Evolution，LTE)，新空口(New Radio，NR)，BT，GNSS，WLAN，NFC，FM，和/或IR技术等。GNSS可以包括全球卫星定位系统(Global Positioning System，GPS)，全球导航卫星系统(Global  Navigation Satellite System，GLONASS)，北斗卫星导航系统(Beidou Navigation Satellite System，BDS)，准天顶卫星系统(Quasi-Zenith Satellite System，QZSS)和/或星基增强系统(Satellite Based Augmentation Systems，SBAS)。
移动终端100通过GPU、显示屏190及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏190和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏190用于显示图像，视频等。显示屏190包括显示面板。显示面板可以采用液晶显示屏(Liquid Crystal Display，LCD)，有机发光二极管(Organic Light-Emitting Diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(Active-Matrix Organic Light Emitting Diode，AMOLED)，柔性发光二极管(Flexlight-Emitting Diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(Quantum dot Light Emitting Diodes，QLED)等。在一些实施方式中，移动终端100可以包括1个或N个显示屏190，N为大于1的正整数。
移动终端100可以通过ISP、摄像模组191、视频编解码器、GPU、显示屏190及应用处理器等实现拍摄功能。
ISP用于处理摄像模组191反馈的数据。例如，拍照时，打开快门，光线通过镜头被传递到摄像头感光元件上，光信号转换为电信号，摄像头感光元件将电信号传递给ISP处理，转化为肉眼可见的图像。ISP还可以对图像的噪点，亮度，肤色进行算法优化。ISP还可以对拍摄场景的曝光，色温等参数优化。在一些实施方式中，ISP可以设置在摄像模组191中。
摄像模组191用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(Charge Coupled Device，CCD)或互补金属氧化物半导体(Complementary Metal-Oxide-Semiconductor，CMOS)光电晶体管。感光元件把光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施方式中，移动终端100可以包括1个或N个摄像模组191，N为大于1的正整数，若移动终端100包括N个摄像头，N个摄像头中有一个是主摄像头。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当移动终端100在频点选择时，数字信号处理器用于对频点能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。移动终端100可以支持一种或多种视频编解码器。这样，移动终端100可以播放或录制多种编码格式的视频，例如：动态图像专家组(Moving Picture Experts Group，MPEG)1，MPEG2，MPEG3，MPEG4 等。
外部存储器接口122可以用于连接外部存储卡，例如Micro SD卡，实现扩展移动终端100的存储能力。外部存储卡通过外部存储器接口122与处理器110通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器121可以用于存储计算机可执行程序代码，可执行程序代码包括指令。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储移动终端100使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(Universal Flash Storage，UFS)等。处理器110通过运行存储在内部存储器121的指令和/或存储在设置于处理器中的存储器的指令，执行移动终端100的各种功能应用以及数据处理。
移动终端100可以通过音频模块170、扬声器171、受话器172、麦克风173、耳机接口174及应用处理器等实现音频功能。例如音乐播放、录音等。
音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块170还可以用于对音频信号编码和解码。在一些实施方式中，音频模块170可以设置于处理器110中，或将音频模块170的部分功能模块设置于处理器110中。
扬声器171，也称“喇叭”，用于将音频电信号转换为声音信号。移动终端100可以通过扬声器171收听音乐，或收听免提通话。
受话器172，也称“听筒”，用于将音频电信号转换成声音信号。当移动终端100接听电话或语音信息时，可以通过将受话器172靠近人耳接听语音。
麦克风173，也称“话筒”，“传声器”，用于将声音信号转换为电信号。当拨打电话或发送语音信息时，用户可以通过人嘴靠近麦克风173发声，将声音信号输入到麦克风173。移动终端100可以设置至少一个麦克风173。在另一些实施方式中，移动终端100可以设置两个麦克风173，除了采集声音信号，还可以实现降噪功能。在另一些实施方式中，移动终端100还可以设置三个，四个或更多麦克风173，实现采集声音信号，降噪，还可以识别声音来源，实现定向录音功能等。
耳机接口174用于连接有线耳机。耳机接口174可以是USB接口130，也可以是3.5mm的开放移动电子设备平台(Open Mobile Terminal Platform，OMTP)标准接口，美国蜂窝电信工业协会(Cellular Telecommunications Industry Association of the USA，CTIA)标准接口。
深度传感器1801用于获取景物的深度信息。在一些实施方式中，深度传感器可以设置于摄像模组191。
压力传感器1802用于感受压力信号，可以将压力信号转换成电信号。在一些实施 方式中，压力传感器1802可以设置于显示屏190。压力传感器1802的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。
陀螺仪传感器1803可以用于确定移动终端100的运动姿态。在一些实施方式中，可以通过陀螺仪传感器1803确定移动终端100围绕三个轴(即，x，y和z轴)的角速度。陀螺仪传感器1803可以用于拍摄防抖。示例性的，当按下快门，陀螺仪传感器1803检测移动终端100抖动的角度，根据角度计算出镜头模组需要补偿的距离，让镜头通过反向运动抵消移动终端100的抖动，实现防抖。陀螺仪传感器1803还可以用于导航，体感游戏场景。
气压传感器1804用于测量气压。在一些实施方式中，移动终端100通过气压传感器1804测得的气压值计算海拔高度，辅助定位和导航。
此外，根据实际需要，还可以在传感器模块180中设置其他功能的传感器，例如磁传感器、加速度传感器、距离传感器、接近光传感器、指纹传感器、温度传感器、触摸传感器、环境光传感器、骨传导传感器等等。
按键194包括开机键，音量键等。按键194可以是机械按键。也可以是触摸式按键。移动终端100可以接收按键输入，产生与移动终端100的用户设置以及功能控制有关的键信号输入。
马达193可以产生振动提示，例如来电、闹钟、接收信息等的振动提示，也可以用于触摸振动反馈，例如作用于不同应用(如拍照、游戏、音频播放等)的触摸操作，或者作用于显示屏190不同区域的触摸操作，可以对应不同的振动反馈效果。触摸振动反馈效果可以支持自定义。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和移动终端100的接触和分离。移动终端100可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口195可以支持Nano SIM卡，Micro SIM卡，SIM卡等。同一个SIM卡接口195可以同时插入多张卡。多张卡的类型可以相同，也可以不同。SIM卡接口195也可以兼容不同类型的SIM卡。SIM卡接口195也可以兼容外部存储卡。移动终端100通过SIM卡和网络交互，实现通话以及数据通信等功能。在一些实施方式中，移动终端100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在移动终端100中，不能和移动终端100分离。
在一种文件处理方法的相关技术中，可以通过UPX(the Ultimate Packer for eXecutables，先进的可执行程序文件压缩器)压缩壳原理对文件进行加壳，以ELF(Executable and Linkable Format，可执行与可链接格式)文件为例进行说明。如图2所示，待加壳的ELF文件210可以包括ELF头，以及节区1、节区2、…、节区n等多个节区。其具体的加壳步骤可以包括，解析待加壳的ELF文件，获取ELF文件中各 节区的信息；遍历ELF节区，并对节区中的内容进行压缩；将压缩好的各个节区的压缩数据重新组装为ELF文件，并在其中插入解压缩代码，生成新的ELF文件220。但是，由于UPX压缩壳使用较为广泛，壳特征明显，且解压缩后，ELF文件内容在内存中是连续的，容易被恢复成原始ELF文件，因此，这种方式难以保障文件的安全性。
基于此，本公开首先提出了一种文件处理方法，可以应用于对相关业务文件进行处理，以对其进行加壳处理，从而提高业务文件的安全性的场景中。
图3示出了本示例性实施方式中一种文件处理方法的流程，包括以下步骤S310～S340：
步骤S310，获取待处理文件和待处理文件对应的加壳文件。
其中，待处理文件是指需要进行加壳处理的源业务文件，其可以是多种格式的文件，例如ELF文件，或者BIN(Binary，二进制)文件等。加壳文件是指用于对待处理文件加壳的壳文件，与待处理文件为相同类型的文件，其中包含了核心的解壳逻辑。在本示例性实施例中，加壳文件可以从加壳系统中获取，例如采用特定的加壳系统或工具进行文件处理时，从加壳系统或工具中获取相应的加壳文件。
在本示例性实施例中，考虑到基于虚拟机的编程语言JAVA更容易被人反编译，越来越多的应用程序将核心代码以C/C++实现，并且以ELF文件的形式供上层JAVA代码调用，以保证安全性。因此，本示例性实施例特别可以针对于ELF文件，进行文件处理过程。
在一示例性实施例中，上述待处理文件以及加壳文件均为ELF文件。
其中，ELF文件是一种用于二进制文件、可执行文件、目标代码、共享库和核心转储格式文件，其可以由4部分组成，分别是ELF头部(ELF header)、程序头表(Program header table)、节(Section)或者段(segments)以及节头表(Section header table)。其中，ELF头部用于描述整个ELF文件的组织，程序头表用于描述ELF文件中的各种段，以使系统创造进程映像。其中，段是从运行的角度来描述ELF文件，而节是从链接的角度来描述ELF文件，段与节是包含的关系，一个段可以包含若干个节。节头表用于描述文件节区的信息，比如大小、偏移等信息。
通常，ELF文件格式可以提供两种视图，例如图4所示的链接视图400，以及如图5所示的执行视图500。链接视图400以节区为单位，执行视图500是以段为单位。链接视图是指在链接时所用到的视图，而执行视图则是在执行时所用到的视图。
在一示例性实施例中，在上述步骤S310后，文件处理方法还可以包括以下步骤：
以链接视图的数据结构加载待处理文件和加壳文件，以得到待处理文件的节区信息和加壳文件的节区信息。
在本示例性实施例中，在获取了待处理文件以及加壳文件后，需要对待处理文件和加壳文件进行初始化操作，通过加壳工具或系统将待处理文件与加壳文件以链接视图的数据结构加载到内存中，确定待处理文件的节区信息，以及加壳文件的节区信息。 其中，节区信息可以包括节区的名称、类型、内存大小以及所包含的具体内容如数据代码或字符串等。
步骤S320，根据待处理文件的节区信息与加壳文件的节区信息，对加壳文件进行改造，得到第一中间文件。
为了提高文件的安全性，本示例性实施例可以对加壳文件的结构进行改造，以对其进行畸形化处理。其中，第一中间文件即为对加壳文件进行改造后的文件，可以根据第一中间文件确定用于进行文件融合的新文件的框架。对加壳文件进行改造可以包括，计算待处理文件与加壳文件中所包含的多个节区的内存大小，根据计算出的内存大小调整加壳文件中所包含的节区的大小，或者移动加壳文件中特定节区的节区头等。在本示例性实施例中，可以将加壳文件中各节区的节区信息复制到第一中间文件的相应节区中。此外，为了提高加壳文件的安全强度，还可以对加壳文件进行其他安全处理，例如对加壳文件的源代码进行native(原生)方法混淆保护等。
在一示例性实施例中，如图6所示，上述步骤S320可以包括以下步骤：
步骤S610，对比待处理文件中的节区容量与加壳文件中的节区容量，将其中最大的节区容量确定为标准容量；
步骤S620，按照标准容量对加壳文件的节区进行调整；
步骤S630，擦除加壳文件中的至少一个节区，得到第一中间文件。
具体在进行加壳文件的改造时，可以先对待处理文件和加壳文件进行检索，计算待处理文件中的节区容量和加壳文件中的节区容量，并记录其各自的节区信息，其中，节区容量即为节区大小。将其中节区容量最大的确定为标准容量，然后根据标准容量对加壳文件的节区进行调整。例如计算待处理文件中某一节区的容量，大于加壳文件中对应节区的容量时，可以选择将待处理文件的该区节的容量作为标准容量，并将第一中间文件相应节区的容量扩增为标准容量，使得加壳文件在改造后节区容量增大，以实现对加壳文件的扩增。
另外，为了进一步保护加壳文件的安全性，还可以对加壳文件的节区信息进行擦除处理，其中，擦除加壳文件中的至少一个节区，可以是对节区进行隐藏，也可以是对节区进行删除，根据不同的应用场景可以采取相应的处理方式，本公开对此不做具体限定。具体的，可以通过擦除加壳文件中的至少一个节区的方式实现。其中，至少一个节区可以是任意节区，也可以是特定节区，本公开对此不做具体限定。
在一示例性实施例中，上述擦除加壳文件中的至少一个节区，可以包括以下步骤：
擦除加壳文件中预设类型的节区。
通常，对文件进行解析时，往往需要某些节区的节区信息。而本示例性实施例通过擦除加壳文件中预设类型的节区，防止文件被解析的同时，保证程序的正常运行，从而实现对加壳文件的保护。其中，擦除加壳文件中预设类型的节区，可以包括擦除节区头中特定类型的数据，例如“.interp”、“.hash”、“.rel.dyn”、“.rel.plt”、“.plt”、“.text”、 “.code”、“.ARM.extab”、“.ARM.exidx”、“.rodata”、“.init_array”、“.fini_array”、“.got”、“.got.plt”、“.eh_frame”、“.eh_frame_hdr”、“.data”、“.bss”等。
步骤S330，对待处理文件进行加密，得到第二中间文件。
其中，第二中间文件是指对待处理文件进行加密后得到的文件。在实际应用中，往往采用对称加密技术对文件进行加密，将密钥硬编码在程序代码中。而这种加密方式，当程序受到黑盒攻击时，则会使加密设备的运行环境，包括内存信息、磁盘的读写权限等受到威胁，运行在内存中的密钥也不再安全。因此，本示例性实施例可以采用白盒加密，或对密钥进行白盒化处理，以保障密钥安全。
具体的，在一示例性实施例中，上述步骤S330中对待处理文件进行加密，可以包括以下步骤：
对待处理文件进行压缩，并采用白盒加密技术对待处理文件进行加密。
本示例性实施例可以对待处理文件整体采用白盒加密技术进行加密。其中，白盒加密技术可以将加密密钥隐藏在一系列的数据表中，加密执行过程中，内存中不会出现密钥的值，使其能够在不安全的环境下进行加密计算。具体的，在对待处理文件进行加密时，可以采用静态白盒，也可以采用动态白盒，本公开对此不做具体限定。此外，在加密之前，本示例性实施例还可以对待处理文件进行压缩处理，以节省内存空间，加速网络传输。
步骤S340，将第一中间文件与第二中间文件进行融合，生成待处理文件对应的可执行文件。
其中，待处理文件对应的可执行文件即为对待处理文件进行加壳处理后的文件，其类型与待处理文件与加壳文件的类型相同，例如待处理文件与加壳文件为ELF文件时，生成的可执行文件则也为ELF文件。当确定第一中间文件与第二中间文件后，可以将二者进行融合，生成待处理文件对应的可执行文件，其融合的过程可以视为对待处理文件进行加壳的过程。运行生成的待处理文件对应的可执行文件时，可以先执行第一中间文件，以使第二中间文件的入口地址等信息被保护。当第一中间文件的程序结束后，第二中间文件开始执行。
此外，考虑到生成的待处理文件对应的可执行文件，其体积相比于未经过融合处理的待处理文件的体积较大，例如可执行文件可能会比原待处理文件增加40KB-80KB。在实际应用时，针对对体积比较敏感的应用程序，较大的可执行文件可能会对使用体验造成影响。基于此，本示例性实施例还可以在生成待处理文件后，对其进行压缩处理，以提高内存空间的利用率。
具体的，在进行第一中间文件与第二中间文件的融合时，如图7所示，上述步骤S340可以包括以下步骤：
步骤S710，以预设的第一地址为起始，复制第一中间文件，并确定被复制的第一中间文件的最后一个字符所在的第二地址；
步骤S720，将第二中间文件复制到位于第二地址之后的第三地址；
步骤S730，合并被复制的第一中间文件和第二中间文件，生成可执行文件。
在本示例性实施例中，第一中间文件是对加壳文件进行改造后的文件，第二中间文件是对待处理文件进行加密后的文件，而对第一中间文件与第二中间文件进行融合的过程，实质上是根据这两个文件生成一个新的文件(待处理文件对应的可执行文件)的过程。具体的融合过程可以包括，在需要生成的可执行文件中确定第一中间文件的位置，即第一地址，将第一中间文件的全部内容复制至第一地址。其中，第一地址可以是指可执行文件的起始地址。然后，根据第一中间文件的最后一个字符所在的位置，可以确定第一中间文件在可执行文件中的结束地址，即第二地址。进一步的，将第二中间文件的全部内容复制至第二地址之后的位置，即第三地址，以实现第一中间文件与第二中间文件的融合，生成最终的可执行文件。
综上，本示例性实施方式中，获取待处理文件和待处理文件对应的加壳文件；根据待处理文件的节区信息与加壳文件的节区信息，对加壳文件进行改造，得到第一中间文件；对待处理文件进行加密，得到第二中间文件；将第一中间文件与第二中间文件进行融合，生成待处理文件对应的可执行文件。一方面，相比于现有技术，本示例性实施例提出一种新的文件处理方法，对加壳文件进行改造，并将改造后的加壳文件与待处理文件进行融合，生成待处理文件对应的可执行文件，可以有效防止待处理文件的静态反编译；另一方面，生成的可执行文件，不论是文件形态还是在内存中，加壳文件与待处理文件都处于高度融合的状态，难以将其还原为原始完整的待处理文件，保障了待处理文件的安全；再一方面，本示例性实施例在进行文件融合之前，还对待处理文件进行加密，进一步提高了生成的可执行文件的安全可靠性。
本公开的示例性实施方式还提供一种文件处理装置。如图8所示，该文件处理装置800可以包括：文件获取模块810，用于获取待处理文件和待处理文件对应的加壳文件；文件改造模块820，用于根据待处理文件的节区信息与加壳文件的节区信息，对加壳文件进行改造，得到第一中间文件；文件加密模块830，用于对待处理文件进行加密，得到第二中间文件；文件融合模块840，用于将第一中间文件与第二中间文件进行融合，生成待处理文件对应的可执行文件。
在一示例性实施例中，文件改造模块包括：容量对比单元，用于对比待处理文件中的节区容量与加壳文件中的节区容量，将其中最大的节区容量确定为标准容量；节区调整单元，用于按照标准容量对加壳文件的节区进行调整；节区擦除单元，用于擦除加壳文件中的至少一个节区，得到第一中间文件。
在一示例性实施例中，文件融合模块包括：第一复制单元，用于以预设的第一地址为起始，复制第一中间文件，并确定被复制的第一中间文件的最后一个字符所在的第二地址；第二复制单元，用于将第二中间文件复制到位于第二地址之后的第三地址；文件合并单元，用于合并被复制的第一中间文件和第二中间文件，生成可执行文件。
在一示例性实施例中，节区擦除单元用于擦除加壳文件中预设类型的节区。
在一示例性实施例中，文件加密模块用于对待处理文件进行压缩，并采用白盒加密技术对待处理文件进行加密。
在一示例性实施例中，待处理文件以及加壳文件均为可执行和可链接格式文件。
在一示例性实施例中，文件处理装置还包括：加载模块，用于在获取待处理文件和待处理文件对应的加壳文件之后，以链接视图的数据结构加载待处理文件和加壳文件，以得到待处理文件的节区信息和加壳文件的节区信息。
上述装置中各模块的具体细节在方法部分实施方式中已经详细说明，未披露的细节内容可以参见方法部分的实施方式内容，因而不再赘述。
所属技术领域的技术人员能够理解，本公开的各个方面可以实现为系统、方法或程序产品。因此，本公开的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式(包括固件、微代码等)，或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“系统”。
本公开的示例性实施方式还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本公开的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当程序产品在终端设备上运行时，程序代码用于使终端设备执行本说明书上述“示例性方法”部分中描述的根据本公开各种示例性实施方式的步骤，例如可以执行图3、图6或图7中任意一个或多个步骤。
本公开的示例性实施方式还提供了一种用于实现上述方法的程序产品，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本公开的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本公开操作的程序代码，程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其他实施方式。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施方式仅被视为示例性的，本公开的真正范围和精神由权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限。

Claims (10)

  1. 一种文件处理方法，其特征在于，包括：
    获取待处理文件和所述待处理文件对应的加壳文件；
    根据所述待处理文件的节区信息与所述加壳文件的节区信息，对所述加壳文件进行改造，得到第一中间文件；
    对所述待处理文件进行加密，得到第二中间文件；
    将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述待处理文件的节区信息与所述加壳文件的节区信息，对所述加壳文件进行改造，得到第一中间文件，包括：
    对比所述待处理文件中的节区容量与所述加壳文件中的节区容量，将其中最大的节区容量确定为标准容量；
    按照所述标准容量对所述加壳文件的节区进行调整；
    擦除所述加壳文件中的至少一个节区，得到所述第一中间文件。
  3. 根据权利要求2所述的方法，其特征在于，所述将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件，包括：
    以预设的第一地址为起始，复制所述第一中间文件，并确定被复制的所述第一中间文件的最后一个字符所在的第二地址；
    将所述第二中间文件复制到位于所述第二地址之后的第三地址；
    合并被复制的所述第一中间文件和所述第二中间文件，生成所述可执行文件。
  4. 根据权利要求2所述的方法，其特征在于，所述擦除所述加壳文件中的至少一个节区，包括：
    擦除所述加壳文件中预设类型的节区。
  5. 根据权利要求1所述的方法，其特征在于，所述对所述待处理文件进行加密，包括：
    对所述待处理文件进行压缩，并采用白盒加密技术对所述待处理文件进行加密。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述待处理文件以及所述加壳文件均为可执行和可链接格式文件。
  7. 根据权利要求6所述的方法，其特征在于，在获取待处理文件和所述待处理文件对应的加壳文件之后，所述方法还包括：
    以链接视图的数据结构加载所述待处理文件和所述加壳文件，以得到所述待处理文件的节区信息和所述加壳文件的节区信息。
  8. 一种文件处理装置，其特征在于，包括：
    文件获取模块，用于获取待处理文件和所述待处理文件对应的加壳文件；
    文件改造模块，用于根据所述待处理文件的节区信息与所述加壳文件的节区信息， 对所述加壳文件进行改造，得到第一中间文件；
    文件加密模块，用于对所述待处理文件进行加密，得到第二中间文件；
    文件融合模块，用于将所述第一中间文件与所述第二中间文件进行融合，生成所述待处理文件对应的可执行文件。
  9. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求1至7任一项所述的方法。
  10. 一种电子设备，其特征在于，包括：
    处理器；以及
    存储器，用于存储所述处理器的可执行指令；
    其中，所述处理器配置为经由执行所述可执行指令来执行权利要求1至7任一项所述的方法。
PCT/CN2020/091375 2020-05-20 2020-05-20 文件处理方法、文件处理装置、存储介质与电子设备 WO2021232311A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/091375 WO2021232311A1 (zh) 2020-05-20 2020-05-20 文件处理方法、文件处理装置、存储介质与电子设备
CN202080095222.XA CN115039096A (zh) 2020-05-20 2020-05-20 文件处理方法、文件处理装置、存储介质与电子设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/091375 WO2021232311A1 (zh) 2020-05-20 2020-05-20 文件处理方法、文件处理装置、存储介质与电子设备

Publications (1)

Publication Number Publication Date
WO2021232311A1 true WO2021232311A1 (zh) 2021-11-25

Family

ID=78709045

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/091375 WO2021232311A1 (zh) 2020-05-20 2020-05-20 文件处理方法、文件处理装置、存储介质与电子设备

Country Status (2)

Country Link
CN (1) CN115039096A (zh)
WO (1) WO2021232311A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116720212B (zh) * 2023-08-10 2023-11-17 上海观安信息技术股份有限公司 文件保护方法及装置、计算机设备和计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020112158A1 (en) * 2001-02-14 2002-08-15 Golchikov Andrey Vladimirovich Executable file protection
CN107273723A (zh) * 2017-07-07 2017-10-20 广东工业大学 一种基于so文件加壳的Android平台应用软件保护方法
CN107480476A (zh) * 2017-06-15 2017-12-15 西北大学 一种基于ELF感染的Android本地层指令编译虚拟化加壳方法
CN107577715A (zh) * 2017-08-08 2018-01-12 海信集团有限公司 So文件的保护方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020112158A1 (en) * 2001-02-14 2002-08-15 Golchikov Andrey Vladimirovich Executable file protection
CN107480476A (zh) * 2017-06-15 2017-12-15 西北大学 一种基于ELF感染的Android本地层指令编译虚拟化加壳方法
CN107273723A (zh) * 2017-07-07 2017-10-20 广东工业大学 一种基于so文件加壳的Android平台应用软件保护方法
CN107577715A (zh) * 2017-08-08 2018-01-12 海信集团有限公司 So文件的保护方法及装置

Also Published As

Publication number Publication date
CN115039096A (zh) 2022-09-09

Similar Documents

Publication Publication Date Title
WO2021213120A1 (zh) 投屏方法、装置和电子设备
WO2021052178A1 (zh) 一种Wi-Fi连接方法及设备
US11683850B2 (en) Bluetooth reconnection method and related apparatus
WO2020244623A1 (zh) 一种空鼠模式实现方法及相关设备
WO2020093988A1 (zh) 一种图像处理方法及电子设备
WO2021104114A1 (zh) 一种提供无线保真WiFi网络接入服务的方法及电子设备
CN114489533A (zh) 投屏方法、装置、电子设备及计算机可读存储介质
CN113408016B (zh) 保存密文的方法和装置
WO2023011376A1 (zh) 一种北斗通信系统中密钥更新方法、系统及相关装置
CN111382418B (zh) 应用程序权限管理方法、装置、存储介质与电子设备
CN115696237A (zh) 一种北斗通信系统中加密方法、系统及相关装置
EP4283931A1 (en) Nfc method and system, and electronic device
WO2022062809A1 (zh) 投屏控制方法和装置
CN114205336A (zh) 跨设备音频播放方法、移动终端、电子设备及存储介质
WO2021232311A1 (zh) 文件处理方法、文件处理装置、存储介质与电子设备
KR20150116220A (ko) 미디어 스트리밍 방법 및 그 전자 장치
US20230335081A1 (en) Display Synchronization Method, Electronic Device, and Readable Storage Medium
CN112437341B (zh) 一种视频流处理方法及电子设备
CN116382810A (zh) Meta模式的启动方法、电子设备及存储介质
WO2022174718A1 (zh) 一种数据备份方法和电子设备
CN117440194A (zh) 一种投屏画面的处理方法及相关装置
CN116939559A (zh) 蓝牙音频编码数据分发方法、电子设备及存储介质
CN113901485A (zh) 应用程序加载方法、电子设备及存储介质
CN115485685A (zh) 应用程序安全检测方法、装置、存储介质及电子设备
CN115086888A (zh) 消息通知方法与装置、电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20936919

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 18/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20936919

Country of ref document: EP

Kind code of ref document: A1