CN106934260B

CN106934260B - Code protection method, device, server and storage medium

Info

Publication number: CN106934260B
Application number: CN201710150441.3A
Authority: CN
Inventors: 孙吉平; 李伟伟
Original assignee: Beijing Senseshield Technology Co Ltd
Current assignee: Beijing Senseshield Technology Co Ltd
Priority date: 2017-03-14
Filing date: 2017-03-14
Publication date: 2020-03-17
Anticipated expiration: 2037-03-14
Also published as: CN106934260A

Abstract

The embodiment of the invention discloses a code protection method, a device, a server and a storage medium, wherein the method comprises the following steps: analyzing the first file to determine a protection code and a non-protection code; adding a feature calculation code, a feature comparison code and a conditional branch code, and allocating an address space for the protection code, the feature calculation code, the feature comparison code and the conditional branch code; constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code, and calculating and updating feature codes; and generating a second file according to the fixed code block list and the non-protection code. The scheme improves the code protection strength and reduces the risk of code tampering.

Description

Code protection method, device, server and storage medium

Technical Field

The present invention relates to computer technologies, and in particular, to a code protection method, apparatus, server, and storage medium.

Background

A computer program refers to a set of instructions that instruct a computer (or server device) to perform an action or make a decision, and is usually written in a certain programming language, and runs on a certain target architecture.

In order to prevent tampering with the computer program, a method of calculating the feature codes of the application program may be adopted, and when the application program is tampered, the corresponding calculated feature codes are changed, and an exception is thrown to terminate the running of the program.

In the prior art, the mode of preventing the code from being tampered has defects, so that a tampering person can easily crack the code, and the code protection strength is poor.

Disclosure of Invention

The invention provides a code protection method, a code protection device and a storage medium, which improve the code protection strength and reduce the risk of code tampering.

In a first aspect, an embodiment of the present invention provides a code protection method, including:

analyzing the first file to determine a protection code and a non-protection code;

adding a feature calculation code, a feature comparison code and a conditional branch code, and allocating an address space for the protection code, the feature calculation code, the feature comparison code and the conditional branch code;

constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code, and calculating and updating feature codes;

and generating a second file according to the fixed code block list and the non-protection code.

In a second aspect, an embodiment of the present invention further provides a code protection apparatus, including:

the analysis module is used for analyzing the first file and determining a protection code and a non-protection code;

the adding module is used for adding the feature calculation codes, the feature comparison codes and the conditional branch codes;

an address space allocation module, configured to allocate address spaces for the protection code, the feature calculation code, the feature comparison code, and the conditional branch code;

the list construction module is used for constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code;

the characteristic code calculation and updating module is used for calculating and updating the characteristic codes;

and the synthesis module is used for generating a second file.

In a third aspect, an embodiment of the present invention further provides a server, where the server includes: one or more processors; a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the code protection method described above.

In a fourth aspect, an embodiment of the present invention further provides a storage medium containing computer-executable instructions, which when executed by a computer processor, perform a method for code protection, the method comprising:

According to the technical scheme provided by the embodiment of the invention, the protected code and the non-protected code are determined by analyzing the first file; adding a feature calculation code, a feature comparison code and a conditional branch code, and allocating an address space for the protection code, the feature calculation code, the feature comparison code and the conditional branch code; constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code, and calculating and updating feature codes; and generating a second file according to the fixed code block list and the non-protected code, verifying the code loaded into the memory, and protecting the code together with the characteristic comparison code, so that the code protection strength is improved, and the risk of code tampering is reduced.

Drawings

Other features, objects and advantages of the invention will become more apparent upon reading of the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is a flowchart of a code protection method according to an embodiment of the present invention;

FIG. 2 is a flowchart of a code protection method according to a second embodiment of the present invention;

FIG. 3 is a flowchart of a code protection method according to a third embodiment of the present invention;

fig. 4 is a block diagram of a code protection apparatus according to a fifth embodiment of the present invention;

fig. 5 is a schematic structural diagram of a server according to a sixth embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention. It should be further noted that, for the convenience of description, only some of the structures related to the present invention are shown in the drawings, not all of the structures.

Example one

Fig. 1 is a flowchart of a code protection method provided in an embodiment of the present invention, where this embodiment is applicable to a case of protecting a software program, and the method may be executed by a server device including a code protection apparatus, as shown in fig. 1, a specific scheme provided in this embodiment is as follows:

s101, analyzing the first file, and determining a protected code and a non-protected code.

Wherein the first file may be a tamper-resistant file that needs to be protected. The protection code may be a fixed code segment content in the running process, for example, taking a PE file under a windows platform as an example, the parsed file includes a _ add code segment, a _ sub code segment, and a _ wmain code segment, and the _ add code segment, the _ sub code segment, and the _ wmain code segment are determined as the protection code. Wherein the determined protection code comprises: the code, relative virtual address and size of each code segment protecting the code (add code segment, sub code segment and wmain code segment) in the first file are determined.

S102, adding corresponding feature calculation codes, feature comparison codes and conditional branch codes according to the protection codes, and distributing address spaces for the protection codes, the feature calculation codes, the feature comparison codes and the conditional branch codes.

Illustratively, the feature calculation code includes code that calculates the length of the protection code, such as:

for example, the feature calculation method may also be to randomly select some code characters in the protection code for subsequent comparison. The feature comparison code is used for comparing the feature code determined by the feature calculation code, and may be, for example, a feature code determined by comparing the feature calculation code and a pre-stored feature code. The conditional branch code is used for skipping corresponding conditional branches according to the comparison result of the feature comparison code, for example, if the comparison result is always the next code segment, the program continues to run, and if the comparison result is not consistent, the program stops running.

In the code execution process, a corresponding code needs to be found according to the storage address of the code and corresponding operation is performed according to the specific implementation function and instruction of the code. In this step, after the feature calculation code, the feature comparison code, and the conditional branch code are added, address spaces are correspondingly allocated for the feature calculation code, the feature comparison code, and the conditional branch code to store corresponding code contents.

S103, constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code, and calculating and updating the feature code.

The feature calculation code is used for calculating the feature code of the protection code, the feature comparison code is used for comparing the feature code, and the conditional branch code executes corresponding conditions according to the comparison result. The method is characterized in that the method directly modifies the original code segment to enable a tampering person to easily find program segments such as a feature comparison code, a conditional branch code and the like, so that the code segment can be directly shielded, and the feature calculation code, the feature comparison code and the conditional branch code cannot be properly protected.

And S104, generating a second file according to the fixed code block list and the non-protection code.

In this step, the unprotected code and the files of other format types in the first file are integrated with the fixed code block list constructed in S103, and a new second file of the executable file is generated, thereby completing the code protection of the first file. In the process of generating the second file, the method further comprises the steps of calculating the feature code of the protection code by using the feature calculation code, and storing the feature code for comparison of the feature code in the running process of the second file so as to determine whether the second file is tampered.

The embodiment provides a code protection method, which includes extracting a code to be protected after a first file is analyzed, correspondingly adding a feature calculation code, a feature comparison code and a conditional branch code of the segment of protection code, and putting the protection code, the feature calculation code, the feature comparison code and the conditional branch code into a list by constructing a fixed code block list, so that code protection is improved, and the risk of code tampering is reduced.

Example two

Fig. 2 is a flowchart of a code protection method according to a second embodiment of the present invention, where on the basis of the first embodiment, a specific manner for constructing a fixed code block list is provided, and optionally, constructing the fixed code block list according to the protection code, the feature calculation code, the feature comparison code, and the conditional branch code includes: creating a fixed code block list; writing the starting addresses and sizes of the protection code, the feature calculation code, the feature comparison code and the conditional branch code into the fixed code block list; and adding an end mark of the fixed code block list.

Based on the above optimization, as shown in fig. 2, the technical solution provided in this embodiment is specifically as follows:

s201, creating a fixed code block list.

Exemplarily, taking C language as an example, it may be:

s202, writing the starting addresses and the sizes of the protection codes, the feature calculation codes, the feature comparison codes and the conditional branch codes into the fixed code block list.

After the fixed code block list is created, the protection code determined in S101 is divided into individual code segments, and for example, the start address (va) and the size (size) of the protection code, the feature calculation code, the feature comparison code, and the conditional branch code may be sequentially written into the fixed code block list.

And S203, adding an end mark of the fixed code block list.

Illustratively, the block may be va ═ 0 and size ═ 0.

The embodiment provides a code protection method, wherein a fixed code block list is created, the starting addresses and sizes of the protection code, the feature calculation code, the feature comparison code and the conditional branch code are written into the fixed code block list, and an end mark of the fixed code block list is added, so that the code protection strength is improved, and the risk of code tampering is reduced.

EXAMPLE III

Fig. 3 is a flowchart of code protection provided by a third embodiment of the present invention, and on the basis of the foregoing embodiment, optionally, the generating a second file according to the fixed code block list and the non-protected code includes:

writing a jump instruction in the address of the original protection code, and jumping to a corresponding conditional branch code;

calculating the inherent feature codes of the fixed code block list according to the feature calculation codes, and writing the inherent feature codes into the inherent feature code addresses preset by the corresponding conditional branch codes;

creating a section for the list of fixed code blocks;

and synthesizing the executable second file according to the format of the first file.

Based on the above optimization, as shown in fig. 3, the technical solution provided by this embodiment is specifically as follows:

s301, writing a jump instruction in the address of the original protection code, and jumping to the corresponding conditional branch code.

Taking block (va) established in S201 as an example, erasing data of a location where an original function (e.g., _ add) of the protection code is located, and writing jmp va in the location, that is, writing a jump instruction at an address of the original protection code to jump to a corresponding conditional branch code, and correspondingly adding a relocation flag, which may be jmp dword ptr [00414568h ], where 00414568h is an address of a new _ add function.

S302, calculating the inherent feature codes of the fixed code block list according to the feature calculation codes, and writing the inherent feature codes into the inherent feature code addresses preset by the corresponding conditional branch codes.

Illustratively, the value of the intrinsic code featurecomputed by the FEATURE computation code is written into the intrinsic FEATURE code address preset by the corresponding conditional branch code for subsequent comparison.

S303, creating a section for the fixed code block list.

A new section (section) is created for the new (protection code added with feature computation code, feature alignment code and conditional branch code).

S304, synthesizing an executable second file according to the format of the first file.

Illustratively, taking Windows PE as an example, all data is synthesized into a new executable second file according to PE/COFF format (original format of the first file).

The embodiment provides a code protection method, which comprises the steps of writing a jump instruction in an address of an original protection code, and jumping to a corresponding conditional branch code; calculating the inherent feature codes of the fixed code block list according to the feature calculation codes, and writing the inherent feature codes into the inherent feature code addresses preset by the corresponding conditional branch codes; creating a section for the list of fixed code blocks; and synthesizing an executable second file according to the format of the first file, instead of directly performing code protection at the position of the original code, the code protection is performed by adding a fixed code block list, so that the code protection strength is improved, and the risk of code tampering is reduced.

Example four

Fig. 4 is a block diagram of a code protection apparatus according to a fourth embodiment of the present invention, where the apparatus is configured to execute the code protection method according to the fourth embodiment of the present invention, and has corresponding functional modules and beneficial effects of the execution method. As shown in fig. 4, the apparatus includes a parsing module 401, an adding module 402, an address space allocating module 403, a list building module 404, and a synthesizing module 405.

The analysis module 401 is configured to analyze the first file, and determine a protected code and a non-protected code;

an adding module 402, configured to add a feature calculation code, a feature comparison code, and a conditional branch code;

an address space allocation module 403, configured to allocate address spaces for the protection code, the feature calculation code, the feature comparison code, and the conditional branch code;

a list construction module 404, configured to construct a fixed code block list according to the protection code, the feature calculation code, the feature comparison code, and the conditional branch code;

a feature code calculation and update module 405, configured to calculate and update a feature code;

and a composition module 406 for generating a second file.

The code protection device provided by the embodiment analyzes the first file, and determines a protection code and a non-protection code; adding a feature calculation code, a feature comparison code and a conditional branch code, and allocating an address space for the protection code, the feature calculation code, the feature comparison code and the conditional branch code; constructing a fixed code block list according to the protection code, the feature calculation code, the feature comparison code and the conditional branch code, and calculating and updating feature codes; and generating a second file according to the fixed code block list and the non-protected code, verifying the code loaded into the memory, and protecting the code together with the characteristic comparison code, so that the code protection strength is improved, and the risk of code tampering is reduced.

On the basis of the above technical solution, the list building module 404 is specifically configured to: creating a fixed code block list; writing the starting addresses and sizes of the protection code, the feature calculation code, the feature comparison code and the conditional branch code into the fixed code block list; and adding an end mark of the fixed code block list.

On the basis of the above technical solution, the synthesis module 405 is specifically configured to: writing a jump instruction in the address of the original protection code, and jumping to a corresponding conditional branch code; calculating the inherent feature codes of the fixed code block list according to the feature calculation codes, and writing the inherent feature codes into the inherent feature code addresses preset by the corresponding conditional branch codes; creating a section for the list of fixed code blocks; and synthesizing the executable second file according to the format of the first file.

Fig. 5 is a schematic structural diagram of a server according to a fifth embodiment of the present invention. FIG. 5 illustrates a block diagram of an exemplary server 12 suitable for use in implementing embodiments of the present invention. The server 12 shown in fig. 5 is only an example, and should not bring any limitation to the function and the scope of use of the embodiment of the present invention.

As shown in FIG. 5, the server 12 is in the form of a general purpose computing device. The components of the server 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including the system memory 28 and the processing unit 16.

Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, such architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, micro-channel architecture (MAC) bus, enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

The server 12 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

The system memory 28 may include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM)30 and/or cache memory 32. The server 12 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 34 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 5, and commonly referred to as a "hard drive"). Although not shown in FIG. 5, a magnetic disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 by one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.

A program/utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination thereof may comprise an implementation of a network environment. Program modules 42 generally carry out the functions and/or methodologies of the described embodiments of the invention.

The server 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), with one or more devices that enable a user to interact with the server 12, and/or with any devices (e.g., network card, modem, etc.) that enable the server 12 to communicate with one or more other computing devices. Such communication may be through an input/output (I/O) interface 22. Also, the server 12 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the Internet) via the network adapter 20. As shown, the network adapter 20 communicates with the other modules of the server 12 via the bus 18. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the server 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

The processing unit 16 executes various functional applications and data processing, such as implementing a code protection method provided by an embodiment of the present invention, by executing programs stored in the system memory 28.

EXAMPLE six

An embodiment of the present invention further provides a storage medium containing computer-executable instructions, which when executed by a computer processor, perform a code protection method, where the method includes:

Computer storage media for embodiments of the invention may employ any combination of one or more computer-readable media. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

It is to be noted that the foregoing is only illustrative of the preferred embodiments of the present invention and the technical principles employed. It will be understood by those skilled in the art that the present invention is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the invention. Therefore, although the present invention has been described in greater detail by the above embodiments, the present invention is not limited to the above embodiments, and may include other equivalent embodiments without departing from the spirit of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method of code protection, comprising:

creating a fixed code block list;

writing the starting addresses and sizes of the protection code, the feature calculation code, the feature comparison code and the conditional branch code into the fixed code block list, and adding an end mark of the fixed code block list;

calculating and updating feature codes, wherein the feature calculation codes are used for calculating feature codes of the protection codes, the feature comparison codes are used for comparing the feature codes, and the conditional branch codes execute corresponding conditions according to comparison results;

2. The method of claim 1, wherein parsing the first file and determining the protection code comprises:

determining a code with unchanged content in the running process loaded into a memory as a protection code; the code, relative virtual address and size of code segments of the protection code are determined.

3. The method of claim 2, wherein the conditional branch code is configured to: and if the result feature code obtained by the calculation of the feature calculation code is consistent with the pre-stored feature code, skipping to a correct execution path.

4. The method of claim 1, wherein the generating a second file from the list of fixed code blocks and the non-protected code comprises:

creating a section for the list of fixed code blocks;

5. A code protection device, comprising:

the list building module is used for creating a fixed code block list; writing the starting addresses and sizes of the protection code, the feature calculation code, the feature comparison code and the conditional branch code into the fixed code block list, and adding an end mark of the fixed code block list;

the feature code calculation and update module is used for calculating and updating feature codes, the feature calculation codes calculate the feature codes of the protection codes, the feature comparison codes are used for comparing the feature codes, and the conditional branch codes execute corresponding conditions according to comparison results;

and the synthesis module is used for generating a second file.

6. The apparatus of claim 5, wherein the synthesis module is specifically configured to:

creating a section for the list of fixed code blocks;

7. A server, characterized in that the server comprises: one or more processors; storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement a code protection method as claimed in any one of claims 1-4.

8. A storage medium containing computer-executable instructions which, when executed by a computer processor, perform a method of code protection, the method comprising:

creating a fixed code block list;

and calculating and updating feature codes, wherein the feature calculation codes are used for calculating feature codes of the protection codes, the feature comparison codes are used for comparing the feature codes, and the conditional branch codes execute corresponding conditions according to comparison results.