WO2023045249A1 - 一种代码混淆的加密方法、装置、设备及可读介质 - Google Patents

一种代码混淆的加密方法、装置、设备及可读介质 Download PDF

Info

Publication number
WO2023045249A1
WO2023045249A1 PCT/CN2022/078323 CN2022078323W WO2023045249A1 WO 2023045249 A1 WO2023045249 A1 WO 2023045249A1 CN 2022078323 W CN2022078323 W CN 2022078323W WO 2023045249 A1 WO2023045249 A1 WO 2023045249A1
Authority
WO
WIPO (PCT)
Prior art keywords
code
program
encrypted
jump instruction
instruction
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/078323
Other languages
English (en)
French (fr)
Inventor
范益
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Suzhou Wave Intelligent Technology Co Ltd
Original Assignee
Suzhou Wave Intelligent Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Suzhou Wave Intelligent Technology Co Ltd filed Critical Suzhou Wave Intelligent Technology Co Ltd
Priority to US18/563,372 priority Critical patent/US12505182B2/en
Publication of WO2023045249A1 publication Critical patent/WO2023045249A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the present application relates to the technical field of computer and communication, and in particular to an encryption method, device, equipment and readable medium for code obfuscation.
  • Code obfuscation also known as flowery instructions, is the act of converting the code of a computer program into a functionally equivalent but difficult to read and understand form. Code obfuscation can be used for the source code of the program, or for the intermediate code compiled by the program, and there is also a method of obfuscating and encrypting the compiled binary file code. Programs that perform code obfuscation are called code obfuscators.
  • code obfuscation tools are often used to protect software products from being decompiled and cracked, and to protect software intellectual property rights, etc., which have attracted more and more attention.
  • code obfuscators with different functions: change the names of various elements in the code, such as variables, functions, and classes, into meaningless names, such as rewriting into single letters, or short meaningless letter combinations, Even rewrite it into a symbol like "_", so that readers can't guess its purpose based on the name; rewrite the logical part of the code and turn it into a functionally equivalent but more difficult to understand form, such as the for loop ( A loop statement in a programming language) into a while loop (another loop statement in a programming language), rewrite the loop as recursion, simplify intermediate variables, etc.; disrupt the format of the code, such as deleting spaces, squeezing multiple lines of code into In one line, or break a line of code into multiple lines, etc.
  • the embodiment of the present application provides an encryption method for code obfuscation, comprising the following steps: obtaining the location information of all function codes in the program to be encrypted; and judging whether there is a jump instruction in the corresponding function codes one by one based on the location information ; When there is a jump instruction in the function code, save the jump instruction and the corresponding address information in the decrypted data body, and replace the jump instruction with a breakpoint instruction; and in response to completing the previous step for all function codes, An encrypted file is generated based on the encrypted program obtained by decrypting the data body and the replacement instruction.
  • the code obfuscation encryption method further includes: obtaining an encrypted program through an encrypted file, and executing the encrypted program; in response to executing a breakpoint instruction, obtaining a corresponding jump instruction based on the decrypted data body; and obtaining the corresponding jump instruction based on the jump instruction Continue with the encryption procedure.
  • continuing to execute the encryption program based on the jump instruction includes: replacing the breakpoint instruction with a corresponding jump instruction and executing the corresponding jump instruction to jump to a corresponding area of the encryption program; and converting the corresponding The jump instruction is replaced by a breakpoint instruction, and the encrypted program continues to execute based on the corresponding area.
  • the encryption method of code confusion also includes: obtaining the file to be encrypted, and verifying the file to be encrypted to determine whether the file header, program header table, and section header table of the file to be encrypted are valid; The file header, program header table and section header table of the file are valid, and the program to be encrypted is obtained based on the file to be encrypted.
  • obtaining the location information of all function codes in the program to be encrypted includes: obtaining a symbol list in the section header table of the program to be encrypted, traversing the symbol list and judging whether the corresponding code is a function based on the symbol type; and When the corresponding code is a function code, record the address information and size information of the function code.
  • judging whether there is a jump instruction in the corresponding function code one by one based on the location information includes: traversing the corresponding function codes one by one based on the location information to judge whether there is a jump instruction; when there is no jump instruction, further Judging whether the function code has completed the traversal; and when the function code has not completed the traversal, continue to judge whether there is a jump instruction in the function code.
  • the encryption method for code obfuscation further includes: when the function code completes traversal, continue to determine whether there is a jump instruction in the next function code.
  • the embodiment of the present application provides an encryption device for code obfuscation, including: a first module, used to obtain the location information of all function codes in the program to be encrypted; a second module, used to judge one by one based on the location information Whether there is a jump instruction in the corresponding function code; the third module is used to store the jump instruction and the corresponding address information in the decrypted data body when there is a jump instruction in the function code, and replace the jump instruction with a break a point instruction; and a fourth module, configured to generate an encrypted file based on the encryption program obtained by decrypting the data body and the replacement instruction in response to completing the step of executing the third module on all function codes.
  • an embodiment of the present application provides a computer device, including a memory and one or more processors, where computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the one or more processors, the One or more processors execute the steps of the encryption method for code obfuscation in any of the foregoing embodiments.
  • the embodiment of the present application provides one or more non-volatile computer-readable storage media storing computer-readable instructions.
  • the computer-readable instructions are executed by one or more processors, one or more A processor executes the steps of the encryption method for code obfuscation in any of the foregoing embodiments.
  • Fig. 1 is a schematic diagram of an embodiment of an encryption method for code obfuscation according to one or more embodiments
  • Fig. 2 is according to one or more embodiments, the operational flowchart of the embodiment of the encryption method of code obfuscation;
  • Fig. 3 is according to one or more embodiments, the operation flowchart of the embodiment of the encryption method of code obfuscation
  • Fig. 4 is a schematic diagram of an embodiment of an encryption device for code obfuscation according to one or more embodiments
  • Figure 5 is a schematic diagram of an embodiment of a computer device according to one or more embodiments.
  • FIG. 6 is a schematic diagram of an embodiment of a non-transitory computer-readable storage medium, according to one or more embodiments.
  • FIG. 1 shows a schematic diagram of an encryption method for code obfuscation provided by an embodiment of the present application.
  • the code obfuscation encryption method of the embodiment of the present application may include the following steps:
  • an encrypted file is generated based on the encrypted program obtained by decrypting the data body and replacing the instruction.
  • the dynamic debugging technology and the code obfuscation technology are combined, and the dynamic encryption and decryption of the code is realized by using the dynamic debugging technology.
  • the original program flow can be disassembled, so that if you want to reverse the program, you must completely track the program execution process, or crack the decryption module code and data body, and perform manual instruction replacement, which can greatly increase the difficulty of reverse engineering and protect the program. It cannot be easily cracked; on the other hand, a program that has been attached with dynamic debugging cannot be attached with a second dynamic debugging tool. From this level, a certain anti-debugging effect is achieved.
  • the embodiment shown in FIG. 1 involves obfuscating the tool body and obfuscating the encrypted decryption module.
  • the obfuscation tool body includes a code obfuscation engine module, which is responsible for reading program files, extracting key information, and obfuscating and encrypting programs.
  • the code obfuscation engine module includes an instruction identification engine and an original decryption engine: the instruction identification engine is responsible for identifying the binary code of the file and converting it into assembly instructions for analysis and processing; the original decryption engine includes a pre-defined and complete decryption process for Dynamic encryption and decryption of obfuscated programs.
  • the part of the decryption module after obfuscation and encryption includes a decryption engine, a decrypted data body and an obfuscated program.
  • step 003 in FIG. 1 specifically includes: in response to the existence of a jump instruction in the function code, saving the jump instruction and corresponding address information into the decrypted data body, and replacing the jump instruction with a breakpoint instruction.
  • FIG. 2 shows an operation flowchart of the encryption method for code obfuscation provided by the embodiment of the present application. As shown in Figure 2, in this embodiment, the operation process includes:
  • Step 101 read the program file to be encrypted.
  • the program file to be encrypted can be specified by the user.
  • Step 102 verifying the file.
  • Verifying the file refers to verifying the program file to be encrypted.
  • Step 102 mainly includes verifying file structure and header structure.
  • the header structure includes file header, program header table and section header table. Among them, the file header and the section header table are the two most used parts. For the section header table, you only need to verify whether it is valid, because some programs specify parameters when compiling, which will eliminate the section header table in the program, making it impossible to know and traverse the functions and their functions in the program through the section header table. The code, therefore, cannot be obfuscated, so strict verification is required.
  • Step 103 traversing functions according to table information.
  • search and retrieve in the section header table information mainly to search and retrieve the symbol table.symtab section in the section header table, so as to obtain A list of file symbols (generally pointing to functions or global variables, etc.).
  • Step 104 judging whether the traversal ends. Step 104 is used to cooperate with step 103 . Judging whether the traversal is complete can be understood as judging whether the traversal of the file symbol list is completed.
  • step 107 is performed; if the traversal is not finished, that is, the traversal of the file symbol list is not completed, then continue the process of traversal confusion, and start to execute step 105.
  • Step 105 traversing function codes. After obtaining the position of the function code in the file in step 103, jump to the corresponding position, use a loop to traverse the code of the function, and the end condition is to traverse to the end of the function, that is, to obtain the address and size information of the function . Step 105 cooperates with the flow of "calling the instruction identification engine to identify instructions" in FIG. 2 . After jumping to the beginning of the function, you need to pass the pointer to the recognition engine, and the recognition engine determines how many bytes of data need to be read, and what kind of instruction it is, because the length of the instruction is not fixed, and there is only one short instruction. Bytes, long ones may contain address operands, etc. When a complete instruction is read and judged, the pointer will move to the beginning of the next instruction. It can be judged whether the recognized instruction is a jump instruction JMP or a CALL instruction, and step 106 or others can be executed according to the judgment result.
  • the recognized instruction is a jump instruction JMP or
  • Step 106 save the command and address in the decrypted data body, and replace the command with INT3.
  • step 106 is executed.
  • Step 106 will save the information of the original instruction, such as address, instruction type, original instruction content, etc., into a data body (ie decrypted data body), and then replace the original instruction with INT3, which is a kind of breakpoint instruction.
  • the breakpoint command will be intercepted by the system during execution, and then the control will be handed over to the dynamic debugging tool.
  • it is the decryption module, which will be decrypted and then executed, and then re-encrypted after execution.
  • Step 107 bind the decrypted data body with the decryption engine.
  • the pre-defined decryption module will be bound to the data body that preserves the complete obfuscation information, that is, the decrypted data body, and then written into a file together with the obfuscated encrypted protected program file. This file is the protected program.
  • the binding of the decrypted data body and the decryption engine is completed. Afterwards, as needed, you can prompt that the obfuscation is successful, and launch the process.
  • the code obfuscation encryption method further includes: obtaining an encrypted program through an encrypted file, and executing the encrypted program; in response to executing a breakpoint instruction, obtaining a corresponding jump instruction based on the decrypted data body; instruction to continue the encryption program.
  • FIG. 3 shows an operation flowchart of an encryption method for code obfuscation provided by an embodiment of the present application. As shown in Figure 3, the running process includes:
  • Step 201 the decryption module is registered and loaded when the program to be encrypted starts.
  • the decryption module will take priority over the startup of the program to be encrypted, complete the environment initialization, set up the dynamic debugging environment, etc., then create a child process and start the program to be encrypted, and the decryption module treats the child process of the encrypted program as a parent process Perform dynamic debugging.
  • Step 202 the encryption program is to be executed normally. Most of the original code of the program to be encrypted has not been changed and can be executed normally.
  • Step 203 execute the INT3 instruction. Because the jump instruction JMP/CALL instruction in the program is replaced, so when the instruction is executed, it will be intercepted by the replaced breakpoint instruction INT3, and then the system will transfer the execution right to the dynamic debugging tool. In this solution is the decryption module of the parent process.
  • Step 204 the decryption module accepts the interception information.
  • the information of the breakpoint instruction will be passed to the module, so the decryption module can obtain the relevant information of the instruction, such as the address.
  • Step 205 search and decrypt the data body according to the information. Then the decryption module will enter the decrypted data body to search based on this information (mainly address offset, etc.), find the original instruction information corresponding to the address, and then replace the INT3 instruction with the original instruction to realize dynamic decryption. After the replacement, use the single-step function to execute the instruction, so that the program to be encrypted is normally executed to the next area, and the control right of the decryption module is maintained.
  • this information mainly address offset, etc.
  • Step 206 replace with INT3 instruction again.
  • the decryption module will replace the original instruction with the INT3 breakpoint instruction again to realize dynamic encryption. Then the decryption module will transfer the control right back to the program to be encrypted, which has been executed to the new area pointed to by the jump instruction JMP/CALL instruction, and the program to be encrypted can execute normally after obtaining the control right until the next INT3 jump The transfer command executes this process again.
  • continuing to execute the encryption program based on the jump instruction includes: replacing the breakpoint instruction with a corresponding jump instruction and executing the corresponding jump instruction to jump to a corresponding area of the encryption program; The corresponding jump instruction is replaced with a breakpoint instruction, and the encryption program is continued to be executed based on the corresponding area.
  • the encryption method of code confusion also includes: obtaining the file to be encrypted, and checking the file to be encrypted to determine whether the file header, program header table and section header table of the file to be encrypted are valid; The file header, program header table and section header table of the file to be encrypted are valid, and the program to be encrypted is obtained based on the file to be encrypted.
  • obtaining the location information of all function codes in the program to be encrypted includes: obtaining the symbol list in the section header table of the program to be encrypted, traversing the symbol list and judging whether the corresponding code is a function based on the symbol type; if If the corresponding code is a function code, the address information and size information of the function code is recorded.
  • obtaining the location information of all function codes in the program to be encrypted includes: obtaining the symbol list in the section header table of the program to be encrypted, traversing the symbol list and judging whether the corresponding code is a function based on the symbol type;
  • record the address information and size information of the function code includes: recording the address information and size information of the function code in response to the corresponding code being a function code.
  • judging whether there is a jump instruction in the corresponding function code one by one based on the location information includes: traversing the corresponding function code one by one based on the location information to judge whether there is a jump instruction; if there is no jump instruction, then Further judge whether the function code has completed the traversal; if the function code has not completed the traversal, continue to judge whether there is a jump instruction in the function code.
  • judging whether there is a jump instruction in the corresponding function code one by one based on the location information includes: traversing the corresponding function code one by one based on the location information to judge whether there is a jump instruction; when there is no jump instruction, It is further judged whether the traversal of the function code is completed; when the traversal of the function code is not completed, continue to judge whether there is a jump instruction in the function code.
  • further judging whether the function code completes the traversal includes: responding to the absence of the jump instruction, further judging whether the function code completes the traversal.
  • the function code has not completed traversal continue to determine whether there is a jump instruction in the function code, including: responding to the incomplete traversal of the function code, continue to determine whether there is a jump instruction in the function code.
  • the method further includes: if the traversal of the function code is completed, continue to judge whether there is a jump instruction in the next function code.
  • the dynamic debugging technology is integrated into the code obfuscation, the original program flow is disassembled through instruction replacement, and the encrypted protected program is allowed to dynamically restore and disassemble the code during operation, which can effectively avoid
  • the cracker saves the complete program code and causes the program to be cracked.
  • the method provided by the embodiment of the present application cannot obtain the original process through general analysis means, and restore and re-obfuscate in real time through dynamic debugging technology during operation. Therefore, it is necessary to completely track each step of the program execution process to find the original process. In this way, the strength of encryption protection is greatly improved, and the cost of cracking is increased, thereby improving the security of the program.
  • the embodiment of the present application provides an encryption device for code obfuscation.
  • Fig. 4 is a schematic diagram of an encryption device for code obfuscation provided by an embodiment of the present application.
  • the encryption device for code obfuscation in the embodiment of the present application includes the following modules: the first module 011 is used to obtain the location information of all function codes in the program to be encrypted; the second module 012 is used to one by one based on the location information Judging whether there is a jump instruction in the corresponding function code; the third module 013 is used to store the jump instruction and the corresponding address information in the decrypted data body when there is a jump instruction in the function code, and replace the jump instruction is a breakpoint instruction; and a fourth module 014, configured to generate an encrypted file based on the encryption program obtained by decrypting the data body and replacing the instruction in response to completing the step of executing the third module on all function codes.
  • an embodiment of the present application provides a computer device.
  • Fig. 5 is a schematic diagram of a computer device provided by an embodiment of the present application.
  • the computer device in this embodiment of the present application includes one or more processors 021 and a memory 022 .
  • the memory 022 stores computer-readable instructions 023.
  • the computer-readable instructions 023 are executed by one or more processors 021, the one or more processors 021 execute the steps of the encryption method for code obfuscation in any of the foregoing embodiments.
  • FIG. 6 shows a schematic diagram of a non-volatile computer-readable storage medium.
  • the non-volatile computer-readable storage medium 031 stores computer program-readable instructions 032, and when the computer-readable instructions 032 are executed by one or more processors, one or more processors can perform any of the aforementioned tasks. Steps of an encryption method for code obfuscation in an embodiment.
  • the steps and system units in the encryption method for code obfuscation can also be realized by using a controller and a computer-readable storage medium for storing computer-readable instructions for enabling the controller to realize the functions of the above steps or units.
  • functions may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Storage media may be any available media that can be accessed by a general purpose or special purpose computer.
  • the computer readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage device, magnetic disk storage device or other magnetic storage device, or may be used to carry or store instructions in Any other medium that can be accessed by a general purpose or special purpose computer or a general purpose or special purpose processor, and the required program code or data structure. Also, any connection is properly termed a computer-readable medium.
  • Disk and disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers . Combinations of the above should also be included within the scope of computer-readable media.
  • the computer-readable storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种代码混淆的加密方法、装置、设备及可读介质。代码混淆的加密方法包括：获取待加密程序中全部函数代码的位置信息；基于位置信息逐个判断对应的函数代码中是否存在跳转指令；在函数代码中存在跳转指令时，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令；以及响应于完成对全部函数代码执行上一步骤，基于解密数据体和替换指令得到的加密程序生成加密文件。

Description

一种代码混淆的加密方法、装置、设备及可读介质
相关申请的交叉引用
本申请要求于2021年9月23日提交中国专利局，申请号为CN202111116879.2，申请名称为“一种代码混淆的加密方法、装置、设备及可读介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机与通信技术领域，尤其涉及一种代码混淆的加密方法、装置、设备及可读介质。
背景技术
随着互联网客户端技术的迅速发展，客户端的各种技术越来越丰富，功能也越来越复杂，但由于客户端代码是运行在用户终端上的，攻击者很容易阅读、分析和破解，给系统带来各种风险。
代码混淆(Obfuscated code)亦称为花指令，是将计算机程序的代码转换成一种功能上等价但是难于阅读和理解的形式的行为。代码混淆可以用于程序源代码，也可以用于程序编译而成的中间代码，也有对编译完成的二进制文件代码进行混淆加密的做法。执行代码混淆的程序被称作代码混淆器。
在市场上，各式各样的代码混淆工具常被用在保护软件产品不被反编译和破解，保护软件知识产权等方面，越来越受到人们的重视。现有存在许多功能各异的代码混淆器：将代码中的各种元素，如变量、函数、类的名字改成无意义的名字，比如改写成单个字母、或是简短的无意义字母组合、甚至改写成“_”这样的符号，使得阅读的人无法根据名字猜测其用途；重写代码中的逻辑部分，将其变成功能上等价，但是更难理解的形式，比如将for循环(编程语言中一种循环语句)改成while循环(编程语言中另一种循环语句)、将循环改写成递归、精简中间变量等；打乱代码的格式，比如删除空格、将多行代码挤到一行中、或者将一行代码断成多行等。
现有的代码混淆方案，可以通过一般的分析手段获得原始流程，从而被破解。
发明内容
在第一方面，本申请实施例提供了一种代码混淆的加密方法，包括以下步骤：获取待加密程序中全部函数代码的位置信息；基于位置信息逐个判断对应的函数代码中是否存在跳转指令；在函数代码中存在跳转指令时，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令；以及响应于完成对全部函数代码执行上一步骤，基于解密数据体和替换指令得到的加密程序生成加密文件。
在一些实施方式中，代码混淆的加密方法还包括：通过加密文件获取加密程序，并执行加密程序；响应于执行断点指令，则基于解密数据体获取对应的跳转指令；以及基于跳转指令继续执行加密程序。
在一些实施方式中，基于跳转指令继续执行加密程序，包括：将断点指令替换为对应的跳转指令并执行对应的跳转指令，以跳转到加密程序的对应区域；以及将对应的跳转指令替换为断点指令，并基于对应区域继续执行加密程序。
在一些实施方式中，代码混淆的加密方法还包括：获取待加密文件，并对待加密文件进行校验以判断待加密文件的文件头、程序头表和节头表是否有效；以及响应于待加密文件的文件头、程序头表和节头表有效，基于待加密文件获取待加密程序。
在一些实施方式中，获取待加密程序中全部函数代码的位置信息，包括：获取待加密程序的节头表中的符号列表，并遍历符号列表并基于符号类型判断对应的代码是否为函数；以及在对应的代码为函数代码时，记录函数代码的地址信息和大小信息。
在一些实施方式中，基于位置信息逐个判断对应的函数代码中是否存在跳转指令包括：基于位置信息逐个遍历对应的函数代码，以判断是否存在跳转指令；在不存在跳转指令时，进一步判断函数代码是否完成遍历；以及在函数代码未完成遍历时，继续判断函数代码中是否存在跳转指令。
在一些实施方式中，代码混淆的加密方法还包括：在函数代码完成遍历时，继续判断下一个函数代码中是否存在跳转指令。
在第二方面，本申请实施例提供了一种代码混淆的加密装置，包括：第一模块，用于获取待加密程序中全部函数代码的位置信息；第二模块，用于基于位置信息逐个判断对应的函数代码中是否存在跳转指令；第三模块，用于在函数代码中存在跳转指令时，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令；以及第四模块，用于响应于完成对全部函数代码执行第三模块的步骤，基于解密数据体和替 换指令得到的加密程序生成加密文件。
在第三方面，本申请实施例提供了一种计算机设备，包括存储器及一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行前述任一实施例中代码混淆的加密方法的步骤。
在第四方面，本申请实施例提供了一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行前述任一实施例中代码混淆的加密方法的步骤。
附图说明
为了更清楚地说明本申请实施例或相关技术方案，下面将对实施例或相关描述中可能涉及的附图作简单地介绍，显而易见地，下面描述中的附图仅仅涉及本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的实施例。
图1为根据一个或多个实施例中，代码混淆的加密方法的实施例的示意图；
图2为根据一个或多个实施例中，代码混淆的加密方法的实施例的运行流程图；
图3为根据一个或多个实施例中，代码混淆的加密方法的实施例的运行流程图；
图4为根据一个或多个实施例中，代码混淆的加密装置的实施例的示意图；
图5为根据一个或多个实施例中，计算机设备的实施例的示意图；
图6为根据一个或多个实施例中，非易失性计算机可读存储介质的实施例的示意图。
具体实施方式
为使本申请的技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本申请实施例进一步详细说明。
需要说明的是，本申请实施例中所有使用“第一”和“第二”的表述均是为了区分两个相同名称非相同的实体或者非相同的参量，可见“第一”“第二”仅为了表述的方便，不应理解为对本申请实施例的限定，后续实施例对此不再一一说明。
在第一方面，本申请实施例提供了一种代码混淆的加密方法。图1示出的是本申请实施例提供的代码混淆的加密方法的示意图。如图1所示，本申请实施例的代码混淆的加密方法可以包括如下步骤：
001、获取待加密程序中全部函数代码的位置信息；
002、基于位置信息逐个判断对应的函数代码中是否存在跳转指令；
003、在函数代码中存在跳转指令时，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令；
004、响应于完成对全部函数代码执行上一步骤，基于解密数据体和替换指令得到的加密程序生成加密文件。
在图1所示的实施例中，将动态调试技术和代码混淆技术相结合，利用动态调试技术实现代码的动态加密和解密。一方面，可以将原本的程序流程拆解，使得想要进行程序逆向就必须完整跟踪程序执行流程，或破解解密模块代码和数据体，进行手动的指令替换，这样可以大幅提高逆向难度，保护程序不被轻易破解；另一方面，已经附加了动态调试的程序是不能被附加第二个动态调试工具的，从这个层面上实现了一定反调试的效果。
图1所示的实施例涉及混淆工具本体和混淆加密后的解密模块部分。其中混淆工具本体包括代码混淆引擎模块，负责读取程序文件、提取关键信息、并对程序进行混淆加密。代码混淆引擎模块包括指令识别引擎和原始解密引擎：指令识别引擎负责对文件二进制代码进行识别，转换成汇编指令以进行分析和处理；原始解密引擎包括预先定义好的、包含完整解密流程，用于动态加密解密被混淆的程序。混淆加密后的解密模块部分包括解密引擎、解密数据体和被混淆的程序。
在一些实施例中，图1中的步骤003，具体包括：响应于函数代码中存在跳转指令，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令。
图2示出的是本申请实施例提供的代码混淆的加密方法的一种运行流程图。如图2所示，在本实施例中，运行流程包括：
步骤101，读取待加密程序文件。待加密程序文件可以由用户指定。
步骤102，校验文件。校验文件指校验待加密程序文件。步骤102主要包括校验文件结构和头结构。头结构包括文件头、程序头表和节头表。其中文件头和节头表是最主要使用的两个部分。对于节头表，仅需校验其是否有效即可，因为部分程序在编译时指定了参数，会消除程序中的节头表，导致无法通过节头表去获知和遍历程序中的函数及其代码，因而是无法进行混淆的，因此需要进行严格的校验。
步骤103，根据表信息遍历函数。在校验并读取节头表信息(也可称为表信息)后，便在节头表信息中进行查找和检索，主要是在节头表中查找和检索符号表.symtab节，从而获取文件符号(一般指向的是函数或全局变量等)列表。然后通过遍历文件符号列 表，并校验符号类型判断是否为函数，如果是函数则获取其地址和大小的信息，这样就获取到了具体的函数的代码在文件中的位置。
步骤104，判断是否遍历结束。步骤104用于和步骤103协作。判断是否遍历结束，可以理解为判断文件符号列表的遍历是否完成。
如果遍历结束，即文件符号列表的遍历完成，则执行步骤107，如遍历未结束，即文件符号列表的遍历未完成，则继续进行遍历混淆的流程，开始执行步骤105。
步骤105，遍历函数代码。在步骤103获取了函数代码在文件中的位置后，便跳转到对应的位置上，使用一个循环遍历该函数的代码，结束条件为遍历到函数结尾，即获取到该函数的地址和大小信息。步骤105与图2中“调用指令识别引擎，识别指令”的流程是相互协作的。在跳转到函数开头后，需要将指针传递给识别引擎，由识别引擎判断决定需要读入几个字节的数据，以及判断这是一个什么指令，因为指令不定长，短的指令只有1个字节，长的则可能包含地址操作数等。当读取并判断出一条完整的指令后，指针将会移动到下一个指令开头的位置。可以判断识别出的指令判断是否为跳转指令JMP或CALL指令，可以根据判断结果执行步骤106或其他。
步骤106，保存指令及地址到解密数据体中，将指令替换为INT3。当识别出的指令为跳转指令JMP或CALL时，执行步骤106。步骤106将会将原指令的信息，如地址、指令类型、原指令内容等保存到一个数据体(即解密数据体)中，然后将原指令替换为INT3，INT3为一种断点指令。断点指令将会在执行时被系统拦截，然后将控制权移交给动态调试工具，在本方案中是解密模块，由解密模块进行解密后再执行，并在执行过后重新加密。
步骤107，将解密数据体与解密引擎绑定。当遍历混淆完成后，便会将预先定义好的解密模块与保存了完整混淆信息的数据体，即解密数据体相绑定，然后与混淆加密保护后的程序文件一同写入到一个文件中，这个文件就是保护后的程序。由此，完成解密数据体与解密引擎绑定。之后，根据需要，可以提示混淆成功，并推出流程。
在本申请的一些实施例中，代码混淆的加密方法还包括：通过加密文件获取加密程序，并执行加密程序；响应于执行断点指令，基于解密数据体获取对应的跳转指令；基于跳转指令继续执行加密程序。
在本实施例中，待加密程序在执行时，会通过动态调试技术进行动态的解密和加密，在程序正常执行的同时保证安全性。图3示出的是本申请实施例提供的一种代码混淆的加密方法的运行流程图。如图3所示，运行流程包括：
步骤201，待加密程序启动解密模块注册加载。在程序启动时，解密模块会优先于待 加密程序启动，完成环境初始化，设置动态调试环境等工作，然后创建一个子进程并启动待加密程序，解密模块以父进程的形式对待加密程序的子进程进行动态调试。
步骤202，待加密程序正常执行。待加密程序大部分的原始代码未做更改，可正常执行。
步骤203，执行INT3指令。因为程序中的跳转指令JMP/CALL指令均被替换，所以在执行到该指令时，会被替换后的断点指令INT3所拦截，然后系统会将执行权转移给动态调试工具，本方案中是父进程的解密模块。
步骤204，解密模块接受拦截信息。在系统将控制权移交给解密模块时，会将断点指令的信息一并传递给模块，因此解密模块可以获得该指令的相关信息，如地址等。
步骤205，根据信息查找解密数据体。随后解密模块将依据此信息(主要是地址偏移等)，进入解密数据体中进行查找，找到该地址所对应的原始指令信息，然后使用原始指令替换该INT3指令，实现动态解密。替换后，使用单步步过的函数执行该指令，使待加密程序正常执行到下一区域，并且保持解密模块的控制权。
步骤206，重新替换为INT3指令。在执行后，解密模块会将原指令再次替换回INT3断点指令，实现动态加密。然后解密模块会将控制权转移回待加密程序，其已经执行到跳转指令JMP/CALL指令所指向的新区域，待加密程序在获取到控制权后可以正常执行，直到下一次遇到INT3跳转指令再次执行本流程。
在本申请的一些实施例中，基于跳转指令继续执行加密程序，包括：将断点指令替换为对应的跳转指令并执行对应的跳转指令，以跳转到加密程序的对应区域；将对应的跳转指令替换为断点指令，并基于对应区域继续执行加密程序。
在本申请的一些实施例中，代码混淆的加密方法还包括：获取待加密文件，并对待加密文件进行校验以判断待加密文件的文件头、程序头表和节头表是否有效；响应于待加密文件的文件头、程序头表和节头表有效，基于待加密文件获取待加密程序。
在一些实施例中，获取待加密程序中全部函数代码的位置信息，包括：获取待加密程序的节头表中的符号列表，并遍历符号列表并基于符号类型判断对应的代码是否为函数；若是对应的代码为函数代码，则记录函数代码的地址信息和大小信息。
在一些实施例中，获取待加密程序中全部函数代码的位置信息，包括：获取待加密程序的节头表中的符号列表，并遍历符号列表并基于符号类型判断对应的代码是否为函数；在对应的代码为函数代码时，记录函数代码的地址信息和大小信息。具体地，在对应的代码为函数代码时，记录函数代码的地址信息和大小信息，包括：响应于对应的代码为函数代码，记录函数代码的地址信息和大小信息。
在一些实施例中，基于位置信息逐个判断对应的函数代码中是否存在跳转指令，包括：基于位置信息逐个遍历对应的函数代码，以判断是否存在跳转指令；若是不存在跳转指令，则进一步判断函数代码是否完成遍历；若是函数代码未完成遍历，则继续判断函数代码中是否存在跳转指令。
在一些实施例中，基于位置信息逐个判断对应的函数代码中是否存在跳转指令，包括：基于位置信息逐个遍历对应的函数代码，以判断是否存在跳转指令；在不存在跳转指令时，进一步判断函数代码是否完成遍历；在函数代码未完成遍历时，继续判断函数代码中是否存在跳转指令。
具体地，在不存在跳转指令时，进一步判断函数代码是否完成遍历，包括：响应于不存在跳转指令，进一步判断函数代码是否完成遍历。在函数代码未完成遍历时，继续判断函数代码中是否存在跳转指令，包括：响应于函数代码未完成遍历，继续判断函数代码中是否存在跳转指令。
在本申请的一些实施例中，方法还包括：若是函数代码完成遍历，则继续判断下一个函数代码中是否存在跳转指令。
代码混淆的加密方法中，将动态调试技术融入到代码混淆中，通过指令替换将原本的程序流程进行拆解，并允许被加密保护的程序在运行中动态地还原和拆解代码，能有效避免出现破解者将完整的程序代码保存下来导致程序被破解的问题。本申请实施例所提供的方法不能通过一般的分析手段获得原始流程，并在运行中通过动态调试技术实时恢复和再混淆，因而必须完整地跟踪每一步程序执行流程才有发现原始流程的可能。这样，大幅提高了加密保护强度，提高了破解成本，从而提高了程序的安全性。
需要特别指出的是，在合理的前提下，上述各个实施例中代码混淆的加密方法的一些步骤可以相互交叉、替换、增加或删减，因此，这些合理的排列组合变换之于代码混淆的加密方法也应当属于本申请的保护范围，并且不应将本申请的保护范围局限在实施例之上。
在第二方面，本申请实施例提供了一种代码混淆的加密装置。图4是本申请实施例提供的一种代码混淆的加密装置的示意图。如图4所示，本申请实施例的代码混淆的加密装置包括如下模块：第一模块011，用于获取待加密程序中全部函数代码的位置信息；第二模块012，用于基于位置信息逐个判断对应的函数代码中是否存在跳转指令；第三模块013，用于在函数代码中存在跳转指令时，将跳转指令和对应地址信息保存到解密数据体中，并将跳转指令替换为断点指令；以及第四模块014，用于响应于完成对全部函数代码执行第三模块的步骤，基于解密数据体和替换指令得到的加密程序生成加密文件。
在第三方面，本申请实施例的提供了一种计算机设备。图5是本申请实施例提供的计算机设备的示意图。如图5所示，本申请实施例的计算机设备包括一个或多个处理器021以及存储器022。存储器022存储有计算机可读指令023，计算机可读指令023被一个或多个处理器021执行时，使得一个或多个处理器021执行前述任一实施例中代码混淆的加密方法的步骤。
在第四方面，本申请实施例提供了一个或多个存储有计算机可读指令的非易失性计算机可读存储介质。图6示出的是非易失性计算机可读存储介质的示意图。如图6所示，非易失性计算机可读存储介质031存储有计算机程可读指令032，计算机可读指令032被一个或多个处理器执行时，使得一个或多个处理器执行前述任一实施例中代码混淆的加密方法的步骤。
最后需要说明的是，本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，可以通过计算机可读指令来指令相关硬件来完成，代码混淆的加密方法的计算机可读指令可存储于一计算机可读存储介质中，计算机可读指令被执行时，可实现前述任一实施例中代码混淆的加密方法的步骤。其中，计算机可读存储介质可为磁碟、光盘、只读存储记忆体(ROM)或随机存储记忆体(RAM)等。上述计算机可读指令的实施例，可以达到与之对应的前述任一代码混淆的加密方法实施例相同或者相类似的效果。
此外，代码混淆的加密方法中的步骤以及系统单元也可以利用控制器以及用于存储使得控制器实现上述步骤或单元功能的计算机可读指令的计算机可读存储介质实现。
本领域技术人员还将明白的是，结合这里的公开所描述的各种示例性逻辑块、模块、电路和算法步骤可以被实现为电子硬件、计算机软件或两者的组合。为了清楚地说明硬件和软件的这种可互换性，已经就各种示意性组件、方块、模块、电路和步骤的功能对其进行了一般性的描述。这种功能是被实现为软件还是被实现为硬件取决于具体应用以及施加给整个系统的设计约束。本领域技术人员可以针对每种具体应用以各种方式来实现的功能，但是这种实现决定不应被解释为导致脱离本申请实施例公开的范围。
在一个或多个示例性设计中，功能可以在硬件、软件、固件或其任意组合中实现。如果在软件中实现，则可以将功能作为一个或多个指令或代码存储在计算机可读介质上或通过计算机可读介质来传送。计算机可读介质包括计算机存储介质和通信介质，该通信介质包括有助于将计算机程序从一个位置传送到另一个位置的任何介质。存储介质可以是能够被通用或专用计算机访问的任何可用介质。作为例子而非限制性的，该计算机可读介质可以包括RAM、ROM、EEPROM、CD-ROM或其它光盘存储设备、磁盘存储 设备或其它磁性存储设备，或者是可以用于携带或存储形式为指令或数据结构的所需程序代码并且能够被通用或专用计算机或者通用或专用处理器访问的任何其它介质。此外，任何连接都可以适当地称为计算机可读介质。例如，如果使用同轴线缆、光纤线缆、双绞线、数字用户线路(DSL)或诸如红外线、无线电和微波的无线技术来从网站、服务器或其它远程源发送软件，则上述同轴线缆、光纤线缆、双绞线、DSL或诸如红外线、无线电和微波的无线技术均包括在介质的定义。如这里所使用的，磁盘和光盘包括压缩盘(CD)、激光盘、光盘、数字多功能盘(DVD)、软盘、蓝光盘，其中磁盘通常磁性地再现数据，而光盘利用激光光学地再现数据。上述内容的组合也应当包括在计算机可读介质的范围内。
以上是本申请公开的示例性实施例，但是应当注意，在不背离权利要求限定的本申请实施例公开的范围的前提下，可以进行多种改变和修改。根据这里描述的公开实施例的方法权利要求的功能、步骤和/或动作不需以任何特定顺序执行。此外，尽管本申请实施例公开的元素可以以个体形式描述或要求，但除非明确限制为单数，也可以理解为多个。
应当理解的是，在本文中使用的，除非上下文清楚地支持例外情况，单数形式“一个”旨在也包括复数形式。还应当理解的是，在本文中使用的“和/或”是指包括一个或者一个以上相关联地列出的项目的任意和所有可能组合。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过计算机可读指令来指令相关的硬件完成，计算机可读指令可以存储于一种计算机可读存储介质中，计算机可读存储介质可以是只读存储器，磁盘或光盘等。
所属领域的普通技术人员应当理解：以上任何实施例的讨论仅为示例性的，并非旨在暗示本申请实施例公开的范围(包括权利要求)被限于这些例子；在本申请实施例的思路下，以上实施例或者不同实施例中的技术特征之间也可以进行组合，并存在如上的本申请实施例的不同方面的许多其它变化，为了简明它们没有在细节中提供。因此，凡在本申请实施例的精神和原则之内，所做的任何省略、修改、等同替换、改进等，均应包含在本申请实施例的保护范围之内。

Claims (10)

  1. 一种代码混淆的加密方法，其特征在于，包括：
    获取待加密程序中全部函数代码的位置信息；
    基于所述位置信息逐个判断对应的所述函数代码中是否存在跳转指令；
    在所述函数代码中存在跳转指令时，将所述跳转指令和对应地址信息保存到解密数据体中，并将所述跳转指令替换为断点指令；以及
    响应于完成对所述全部函数代码执行上一步骤，基于所述解密数据体和替换指令得到的加密程序生成加密文件。
  2. 根据权利要求1所述的代码混淆的加密方法，其特征在于，还包括：
    通过所述加密文件获取所述加密程序，并执行所述加密程序；
    响应于执行断点指令，基于所述解密数据体获取对应的跳转指令；以及
    基于所述跳转指令继续执行所述加密程序。
  3. 根据权利要求2所述的代码混淆的加密方法，其特征在于，所述基于所述跳转指令继续执行所述加密程序，包括：
    将所述断点指令替换为所述对应的跳转指令并执行所述对应的跳转指令，以跳转到所述加密程序的对应区域；以及
    将所述对应的跳转指令替换为所述断点指令，并基于所述对应区域继续执行所述加密程序。
  4. 根据权利要求1至3任一所述的代码混淆的加密方法，其特征在于，还包括：
    获取待加密文件，并对所述待加密文件进行校验以判断所述待加密文件的文件头、程序头表和节头表是否有效；以及
    响应于所述待加密文件的文件头、程序头表和节头表有效，基于所述待加密文件获取待加密程序。
  5. 根据权利要求1至3任一所述的代码混淆的加密方法，其特征在于，所述获取待加密程序中全部函数代码的位置信息，包括：
    获取待加密程序的节头表中的符号列表，并遍历所述符号列表并基于符号类型判断对应的代码是否为函数；以及
    在对应的代码为函数代码时，记录所述函数代码的地址信息和大小信息。
  6. 根据权利要求1至3任一所述的代码混淆的加密方法，其特征在于，所述基于所述位置信息逐个判断对应的所述函数代码中是否存在跳转指令，包括：
    基于所述位置信息逐个遍历对应的所述函数代码，以判断是否存在跳转指令；
    在不存在跳转指令时，进一步判断所述函数代码是否完成遍历；以及
    在所述函数代码未完成遍历时，继续判断所述函数代码中是否存在跳转指令。
  7. 根据权利要求6所述的代码混淆的加密方法，其特征在于，还包括：
    在所述函数代码完成遍历时，继续判断下一个所述函数代码中是否存在跳转指令。
  8. 一种代码混淆的加密装置，其特征在于，包括：
    第一模块，用于获取待加密程序中全部函数代码的位置信息；
    第二模块，用于基于所述位置信息逐个判断对应的所述函数代码中是否存在跳转指令；
    第三模块，用于在所述函数代码中存在跳转指令时，将所述跳转指令和对应地址信息保存到解密数据体中，并将所述跳转指令替换为断点指令；以及
    第四模块，用于响应于完成对所述全部函数代码执行所述第三模块的步骤，基于所述解密数据体和替换指令得到的加密程序生成加密文件。
  9. 一种计算机设备，其特征在于，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行如权利要求1-7任一项所述方法的步骤。
  10. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，其特征在于，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如权利要1-7任一项所述方法的步骤。
PCT/CN2022/078323 2021-09-23 2022-02-28 一种代码混淆的加密方法、装置、设备及可读介质 Ceased WO2023045249A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/563,372 US12505182B2 (en) 2021-09-23 2022-02-28 Obfuscated code encryption method and apparatus, and device and readable storage

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111116879.2 2021-09-23
CN202111116879.2A CN113569269B (zh) 2021-09-23 2021-09-23 一种代码混淆的加密方法、装置、设备及可读介质

Publications (1)

Publication Number Publication Date
WO2023045249A1 true WO2023045249A1 (zh) 2023-03-30

Family

ID=78174113

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/078323 Ceased WO2023045249A1 (zh) 2021-09-23 2022-02-28 一种代码混淆的加密方法、装置、设备及可读介质

Country Status (3)

Country Link
US (1) US12505182B2 (zh)
CN (1) CN113569269B (zh)
WO (1) WO2023045249A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116502192A (zh) * 2023-06-28 2023-07-28 远江盛邦（北京）网络安全科技股份有限公司 数据混淆方法、装置和电子设备
CN118070317A (zh) * 2024-04-19 2024-05-24 国网浙江浙电招标咨询有限公司 基于多因子验证的文件加解密方法、系统和存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113569269B (zh) 2021-09-23 2022-12-27 苏州浪潮智能科技有限公司 一种代码混淆的加密方法、装置、设备及可读介质
CN114662063B (zh) * 2022-04-22 2024-06-25 苏州浪潮智能科技有限公司 一种混淆代码的方法、装置以及介质
CN115203652B (zh) * 2022-09-15 2022-12-13 中电信数智科技有限公司 一种基于源混淆的ios端安全加密控制方法
CN117118615B (zh) * 2023-10-23 2024-02-06 烽台科技（北京）有限公司 基于遗传算法的流量混淆方法、装置和可读存储介质
CN117150563B (zh) * 2023-10-27 2024-02-20 国建大数据科技(辽宁)有限公司 一种软件开发数据加密保护方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110502874A (zh) * 2019-07-19 2019-11-26 西安理工大学 一种基于文件自修改的Android App加固方法
CN112052461A (zh) * 2020-08-05 2020-12-08 北京智游网安科技有限公司 一种基于指令注入的代码处理方法、终端及存储介质
CN112115427A (zh) * 2020-08-14 2020-12-22 咪咕文化科技有限公司 代码混淆方法、装置、电子设备及存储介质
CN113569269A (zh) * 2021-09-23 2021-10-29 苏州浪潮智能科技有限公司 一种代码混淆的加密方法、装置、设备及可读介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090049425A1 (en) * 2007-08-14 2009-02-19 Aladdin Knowledge Systems Ltd. Code Obfuscation By Reference Linking
US8510756B1 (en) * 2007-12-06 2013-08-13 Parallels IP Holdings GmbH Guest operating system code optimization for virtual machine
CN103699820B (zh) * 2013-12-25 2017-02-15 北京深思数盾科技股份有限公司 用于相对跳转指令的混淆方法
JP7131946B2 (ja) * 2017-04-20 2022-09-06 Ｌｉｎｅ株式会社 アプリケーションの保安性を評価する方法およびシステム
CN107292135A (zh) * 2017-06-06 2017-10-24 网易（杭州）网络有限公司 一种程序代码保护方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110502874A (zh) * 2019-07-19 2019-11-26 西安理工大学 一种基于文件自修改的Android App加固方法
CN112052461A (zh) * 2020-08-05 2020-12-08 北京智游网安科技有限公司 一种基于指令注入的代码处理方法、终端及存储介质
CN112115427A (zh) * 2020-08-14 2020-12-22 咪咕文化科技有限公司 代码混淆方法、装置、电子设备及存储介质
CN113569269A (zh) * 2021-09-23 2021-10-29 苏州浪潮智能科技有限公司 一种代码混淆的加密方法、装置、设备及可读介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116502192A (zh) * 2023-06-28 2023-07-28 远江盛邦（北京）网络安全科技股份有限公司 数据混淆方法、装置和电子设备
CN116502192B (zh) * 2023-06-28 2023-08-25 远江盛邦（北京）网络安全科技股份有限公司 数据混淆方法、装置和电子设备
CN118070317A (zh) * 2024-04-19 2024-05-24 国网浙江浙电招标咨询有限公司 基于多因子验证的文件加解密方法、系统和存储介质

Also Published As

Publication number Publication date
US20250245301A1 (en) 2025-07-31
US12505182B2 (en) 2025-12-23
CN113569269B (zh) 2022-12-27
CN113569269A (zh) 2021-10-29

Similar Documents

Publication Publication Date Title
CN113569269B (zh) 一种代码混淆的加密方法、装置、设备及可读介质
JP5562961B2 (ja) マルウェア検知のシステムおよび方法
US9027123B2 (en) Data dependence analyzer, information processor, data dependence analysis method and program
JP5839967B2 (ja) マルウェア解析システム
CN107004088B (zh) 确定装置、确定方法及记录介质
CN106960156B (zh) 基于应用程序的数据加密及访问方法、装置
CN110059455A (zh) 代码加密方法、装置、电子设备和计算机可读存储介质
JP2004511031A (ja) ディジタル・データ保護構成
CN108064382B (zh) 一种基于Ukey的软件解密的方法及终端
Müller et al. Processing dangerous paths
CN111914225A (zh) 一种源代码保护系统及源代码加密方法
CN109740314A (zh) 一种swf混淆加密的方法
CN109753770A (zh) 确定烧录数据的方法及装置、烧录方法及装置、电子设备
CN111475168B (zh) 一种代码编译方法及装置
WO2020177430A1 (zh) 应用加固的方法、装置、计算设备及计算机存储介质
US20180234245A1 (en) Method and system for nfc-based mobile terminal password storage and recovery
JP6256781B2 (ja) システムを保護するためのファイルセキュリティ用の管理装置
CN101131726A (zh) 防止可执行程序的调变的方法和设备
CN109918912B (zh) 一种针对计算机病毒的文件修复方法及相关设备
US20220207166A1 (en) Hidden information-based security system for electronic documents
CN111290747A (zh) 一种创建函数钩子的方法、系统、设备及介质
Ostrovskaya et al. Practical Memory Forensics
CN113076548A (zh) 机器人自动化流程账户信息处理方法及装置
JP2022104887A (ja) 電子文書の経路追跡方法及び追跡システム
JP6752347B1 (ja) 情報処理装置、コンピュータプログラム及び情報処理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22871315

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22871315

Country of ref document: EP

Kind code of ref document: A1

WWP Wipo information: published in national office

Ref document number: 18563372

Country of ref document: US