CN108932407A - A kind of program safety guard method and device - Google Patents

Abstract

The invention discloses a kind of program safety guard methods and device, this method to include：M called function is obtained from the source files of program that user edits；The look-up table of functions comprising M called function is established, M is the integer greater than 1；The function call instruction of called function each in M called function is replaced with into table lookup operation instruction, so as to obtain new program file, the table lookup operation instruction from look-up table of functions for obtaining current called function；Generate executable program file corresponding with new program file.

Description

A program security protection method and device

technical field

The invention relates to the technical field of software development, in particular to a program security protection method and device.

Background technique

A source program file written in a high-level language is compiled into an executable program file for machine execution, and decompilation is the reverse process. The executable program file can be decompiled to obtain a readable source program file. Computer software reverse engineering (Reverse engineering), also known as computer software restoration engineering, refers to the work of "reverse analysis and research" on the executable program files of other people's software to deduce the ideas and principles used by other people's software products. , structure, algorithm, processing process, operation method and other design elements, so as to be used as a reference when developing software by yourself, or directly used in your own software products.

Therefore, software products independently developed by users can easily be reverse-engineered and decompiled by competitors through computer software to know the ideas, principles, structures, algorithms, processing procedures, and operating methods used by the software products, resulting in software products being imitated. , or even steal. Therefore, the security of the current software products is not high.

Contents of the invention

Embodiments of the present invention provide a program security protection method and device, which solve the technical problem of low security of software products.

In a first aspect, an embodiment of the present invention provides a program security protection method, including:

Obtain M called functions from the source program file edited by the user;

Establish a function lookup table containing the M called functions, where M is an integer greater than 1;

The function call instruction of each called function in the M called functions is replaced by a table lookup operation instruction so as to obtain a new program file, and the table lookup operation instruction is used to obtain from the function lookup table the current called function;

An executable program file corresponding to the new program file is generated.

Optionally, the establishment of a function lookup table containing the M called functions includes:

Corresponding to a column of the function lookup table with a single described called function, set up a function lookup table comprising M columns*N rows, where N is an integer greater than 1;

In each column of the function lookup table, an index of the called function where the column is located is established.

Optionally, the acquisition of M called functions from the source program file edited by the user includes:

By scanning the source program file, each called function existing in the source program file, or a called function meeting a preset condition is obtained.

Optionally, in each column of the function lookup table, an index of the called function where the column is located is established, including:

assigning a column index to each called function, and the column index is used to determine the column where the called function is located in the function lookup table;

Under each column index of the called function, a row index is established for the called function of the current column in the function lookup table, and the row index is used to obtain the called function in the current column of the function lookup table function.

Optionally, the assigning a column index to each called function includes:

randomly assigning an integer value as a column index to each of said called functions;

Encrypting the column index of each called function to obtain the encrypted column index of each called function;

A first decryption function for each encrypted column index is constructed, and the first decrypted function is used to decrypt each encrypted column index to obtain a column index corresponding to the encrypted column index.

Optionally, establishing a row index for the called function in the current column in the function lookup table includes:

An N-level row index is established for the called function of the current column, wherein the row index of the current row is the table lookup result of the previous row, and the table lookup result corresponding to the row index of the last level is the called function of the current column.

Optionally, the establishment of an N-level row index for the called function of the current column includes:

Encrypting one or more row indexes in the N-level row indexes to obtain corresponding encrypted row indexes;

A second decryption function for each encrypted row index is constructed, and the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

Optionally, after the function call instruction of each of the M called functions is replaced with a table lookup operation instruction, it also includes:

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or

The table lookup operation instruction corresponding to the middle row of the function lookup table is processed as mutual recursive calls of the table lookup function in the multiple table lookup operation instructions.

In a second aspect, an embodiment of the present invention provides a program security protection device, including:

A function acquisition unit, configured to acquire M called functions from the source program file edited by the user;

A lookup table establishment unit, configured to establish a function lookup table containing the M called functions, where M is an integer greater than 1;

An instruction replacement unit, configured to replace the function call instruction of each of the M called functions with a table lookup operation instruction, so as to obtain a new program file, and the table lookup operation instruction is used to obtain a new program file from the Obtain the current called function from the above function lookup table;

A file generating unit, configured to generate an executable program file corresponding to the new program file.

Optionally, the look-up table establishment unit includes:

The table building subunit is used to correspond to a column of the function lookup table with a single described function to be adjusted, and establish a function lookup table including M columns*N rows, where N is an integer greater than 1;

The index building subunit is used to create an index of the called function in each column of the function lookup table.

Optionally, the function acquisition unit includes:

By scanning the source program file, each called function existing in the source program file, or a called function meeting a preset condition is acquired.

Optionally, the index building subunit is specifically used for:

assigning a column index to each called function, and the column index is used to determine the column where the called function is located in the function lookup table;

Under each column index of the called function, a row index is established for the called function of the current column in the function lookup table, and the row index is used to obtain the called function in the current column of the function lookup table function.

Optionally, the index building subunit is specifically used for:

randomly assigning an integer value as a column index to each of said called functions;

Encrypting the column index of each called function to obtain the encrypted column index of each called function;

A first decryption function for each encrypted column index is constructed, and the first decrypted function is used to decrypt each encrypted column index to obtain a column index corresponding to the encrypted column index.

Optionally, the index building subunit is specifically used for:

An N-level row index is established for the called function of the current column, wherein the row index of the current row is the table lookup result of the previous row, and the table lookup result corresponding to the row index of the last level is the called function of the current column.

Optionally, the index building subunit is specifically used for:

Encrypting one or more row indexes in the N-level row indexes to obtain corresponding encrypted row indexes;

A second decryption function for each encrypted row index is constructed, and the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

Optionally, a table lookup instruction processing unit is also included for:

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or

The table lookup operation instruction corresponding to the middle row of the function lookup table is processed as mutual recursive calls of the table lookup function in the multiple table lookup operation instructions.

In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps described in any possible implementation manner in the first aspect are implemented.

In a fourth aspect, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, any aspect of the first aspect is implemented. Steps described in a possible implementation manner.

One or more technical solutions provided in the embodiments of the present invention have at least the following technical effects or advantages:

By obtaining M called functions from the source program file edited by the user; establishing a function lookup table containing M called functions, and replacing the function call instructions of each called function in the M called functions with look-up The table operation instruction is used to obtain a new program file, and the table lookup operation instruction is used to obtain the current called function from the function lookup table; generate an executable program file corresponding to the new program file. Turn the direct function call instruction into a table lookup operation instruction for the called function in the function lookup table, which can completely hide the function call in the program in the table, so that the final executable program file is no longer directly The function call, but needs to look up the table to get the called function, so as to realize the table lookup call function. And this way of looking up the table to call the function makes it difficult for the reverse engineer to see the real calling function from the program obtained by decompiling the executable program file, thereby increasing the difficulty of reverse engineering and thus improving the security of the software product.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a flowchart of a program security protection method provided by an embodiment of the present invention;

FIG. 2 is a program module diagram of a program protection device provided by an embodiment of the present invention;

Fig. 3 is a structural block diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

The embodiment of the present invention solves the technical problem of low security of software products by providing a program security protection method and device. The general idea is as follows:

Obtain M called functions from the source program file edited by the user; establish a function lookup table containing M called functions, and replace the function call instruction of each called function in the M called functions with a table lookup operation instruction In order to obtain a new program file, the table lookup operation instruction is used to obtain the current called function from the function lookup table; generate an executable program file corresponding to the new program file.

Through the above technical solution, the direct function call instruction is changed into a table lookup operation instruction for the called function in the function lookup table, and the function call in the program can be completely hidden in the table, so that the final generated executable program file It is no longer a direct function call, but needs to look up the table to get the called function, so as to realize the table lookup call function. And this way of looking up the table to call the function makes it difficult for the reverse engineer to see the real calling function from the program obtained by decompiling the executable program file, thereby increasing the difficulty of reverse engineering and thus improving the security of the software product.

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art. It should be noted that, on the premise of no conflict, various embodiments provided in the embodiments of the present invention may be combined with each other.

The source program file edited by the user is compiled and linked to generate an executable program file. It should be noted that the steps S101-S104 provided by the embodiment of the present invention are just applied to the compiling step of the source program file, therefore, in the compiling step of the source program file, in addition to the The steps and other processing details that need to be performed can refer to the prior art, and for the sake of brevity of the description, details are not described herein.

Referring to Figure 1, the program security protection method provided by the embodiment of the present invention includes the following steps:

Step S101: Obtain M called functions from the source program file edited by the user.

Specifically, M called functions in the source program file are obtained by scanning the source program file. Obtaining the M called functions in the source program file may be: acquiring each called function existing in the source program file or a called function satisfying a preset condition.

As far as the called function meeting the preset condition is concerned, it can be to obtain the user-defined called function in the source program file, or to get the called function belonging to the library function in the source program file, or to get the called function belonging to the preset list function.

Step S102, establishing a function lookup table including the M called functions, where M is an integer greater than 1.

In the specific implementation process, the source program edited by the user may be imported into the program hardening tool, and the function lookup table is established by the program hardening tool.

The function lookup table is specifically a function lookup table with M columns*N rows, where N is an integer greater than 1.

It should be noted that the number of columns in the function lookup table is determined according to the number of called functions obtained from the source program file, and the number of rows in the function lookup table is at least two, because the height of the number of rows in the function lookup table exceeds 1 When , it is more difficult to analyze the target function of each real call.

In the specific implementation process, the implementation process of step S102 is: a column of the function look-up table corresponding to a single described function to be called, and a function look-up table including M columns*N rows is established, where N is an integer greater than 1; For each column of the above-mentioned function lookup table, an index of the called function where the column is located is established.

Specifically, each called function is correspondingly stored in a column of the function lookup table, so that each column of the function lookup table is correspondingly used for: a called function lookup in which a calling function calls a called function. For example, if two called functions are obtained from the source program file, the function lookup table to be established has two columns. For example, the main() function calls the for() function and the bar() function in turn, and the function lookup table has two columns. Columns, one for the call to the for() function and the other for the call to the bar() function.

In the specific implementation process, there are many ways to establish the index of the called function where the column is located:

It may be: directly randomly assigning an index value to each called function, forming a one-to-one direct index relationship between the called function and the index value, and directly finding the called function based on the index value. The index value can be an int value, for example, the index value is a random number 1, which corresponds to the called function A; the index value is a random number 2, which corresponds to the called function B. However, this method is less difficult to be reversed. In order to increase the difficulty of reverse, it can be realized based on the following process:

Step 1: Assign a column index to each called function, and the column index is used to determine the column of the called function in the function lookup table.

Specifically, in step 1, each called function is randomly assigned an integer value int as a column index. Encrypt the column index of each called function to obtain the encrypted column index of each called function; construct a first decryption function for each encrypted column index, and the first decryption function is used to decrypt each The encrypted column index obtains an integer value corresponding to the encrypted column index as a column index.

Specifically, the column index may be encrypted based on any hash encryption algorithm, and the first decryption function is implemented based on the corresponding hash decryption algorithm.

After step 1, then perform step 2: under each column index of the called function, set up a row index for the called function of the current column in the function lookup table, and the row index is used for the function in the function The called function is obtained by looking up the current column in the table.

In step 2, a row index is established for the called function of the current column in the function lookup table, which may be specifically: an N-level row index is established for the called function of the current column, wherein the row index of the current row is the row index of the previous row The table lookup result, the table lookup result corresponding to the last row index is the called function of the current column. The number of levels of the row index is the same as the number of rows of the function lookup table.

It should be noted that the table lookup result corresponding to the column index is the first-level row index, and the table lookup result based on the first-level row index is the second-level index, and the next row is obtained by searching based on the second-level row index row index, and proceed in turn until the table lookup result of the last row is obtained, that is, the called function hidden in the last row is obtained.

In the specific implementation process, in order to improve the reverse difficulty, one or more row indexes in the N-level row indexes are encrypted to obtain the corresponding encrypted row indexes; the second decryption for each of the encrypted row indexes is constructed function, the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

Through the above steps 1 to 2, every time the table lookup operation of the table lookup function table() can find the corresponding column of the function lookup table and the row index of the next row of the called function, until the current column of the function lookup table is found The last line, and the real called function is hidden in the last line of the function lookup table.

Specifically, the row index may be encrypted based on any hash encryption algorithm, and the second decryption function is implemented based on the corresponding hash decryption algorithm.

Through the encryption and decryption of the row index, the row index of the next row cannot be directly obtained based on the column index, but the row index of the next row can be obtained based on the corresponding hash decryption algorithm, and then the row index of the last row can be obtained, and then the row index of the last row can be obtained. The called function implements the lookup table calling function.

After step S102, step S103 is then performed: the function call instruction of each called function in the M called functions is replaced with a table lookup operation instruction to obtain a new program file, and the table lookup operation instruction is used for The current called function is obtained from the function lookup table.

It should be noted that the table lookup operation instruction is an instruction using the table lookup function table( ). Specifically, the table lookup function table() used in the table lookup operation instruction, because the index encryption/decryption process has been performed at least once in step S102, the table lookup function table() used in the table lookup operation instruction does not directly correspond to the index value Each function call increases the reverse difficulty of the table lookup function itself.

In order to further increase the difficulty of reverse engineering, except for the first row and the last row of the function lookup table, the table lookup operation instructions in the middle row are processed as recursive calls of the table lookup function itself, or mutual recursive calls between multiple table lookup functions. The implementation process is specifically: processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or processing the table lookup operation instruction corresponding to the middle row of the function lookup table It is the mutual recursive calling of the table lookup function in multiple table lookup operation instructions.

Next, take the following function call included in the source program file as an example: main(){foo(); bar();}, to illustrate the implementation process of steps S101-S103, the established function lookup table includes two columns, one column is the index to the foo() function, and the other column is the index to the bar() function.

Assign a random int value to the foo() function and encrypt the random int value to obtain the encrypted column index as encode_rand_1, assign a random int value to the foo() function and encrypt the random int value, and obtain the encrypted column index as encode_rand_2. When the foo() function needs to be called, the column index encode_rand_1 can index to the column where the foo() function is located as the first column of the function lookup table. When the bar() function needs to be called, the column index encode_rand_2 can index to bar() The column where the function is located is the second column of the function lookup table. And establish the row index of foo() function and bar() function.

Replace the original function call instruction {foo(); bar();} with the table lookup operation instruction for searching in the function lookup table, specifically: {table(encode_rand_1);table(encode_rand_2);}

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or processing the table lookup operation instruction corresponding to the middle row of the function lookup table as multiple lookup tables Mutual recursive calls of lookup table functions in operation instructions.

Based on the above implementation process, the new program is finally obtained as follows:

The established function lookup table is as follows:

index_1_1—>encoded_index_2_1 index_1_2—>encoded_index_2_2 index_2_1—>foo() index_2_2—>bar()

After step S103, step S104 is executed to generate an executable program file corresponding to the new program file.

Specifically, an executable program file corresponding to the new program is generated through the linking step.

It should be noted that the technical solution provided by the embodiment of the present invention can be applied to the scenario where the white box hardening tool is used to harden the program. The white box hardening tool is a kind of program testing, The hardening tool, the white box hardening tool is specifically performed in the process of processing the source program edited by the user into an executable program file, where the executable program file is a binary file (Binary). The black box is a process of program testing and reinforcement performed during the process of processing the formed executable program files into executable program files.

It should also be noted that the above technical solutions provided by the embodiments of the present invention can be applied to the generation of software products (executable program files) under various platforms: ELF files based on the Android operating system, application programs based on the Apple mobile phone operating system , the application program of the Apple computer operating system, the software based on the Linux system and the loaded library file, the executable program and the DLL (Dynamic Link Library, dynamic link library) file of the Windows operating system. It should be noted that the above technical solutions provided by the embodiments of the present invention may be based on the following execution set types: X86, X86_64, ARM, ARM64.

Furthermore, in order to further increase the reverse difficulty and thereby increase the security of the program, the embodiment of the present invention includes the following steps before obtaining the new program on the premise of the aforementioned implementation process:

First, perform step A1: determine N target functions from the source program file edited by the user, the source program file is composed of at least N functions, and N is an integer greater than 1.

It should be noted that the source program file edited by the user specifically refers to the uncompiled code of the most original program written by the user according to a certain programming language specification, and the source program file is a readable text file. It is usually written in a high-level language, such as: C language, C++ language, Java language, etc. The source program file can appear in the form of a book or tape or other carriers, but the most commonly used format is a text file. Moreover, the function in the source program file is a self-contained series of instructions to complete certain related functions.

Specifically, the source program file edited by the user is composed of multiple functions, which may include functions in the function library, and may also include user-defined functions. The source program file includes a main function and various sub-functions, no matter the main function or the sub-functions, each function has its own function name.

Specifically, step A1 is as follows: scan the source program file edited by the user to obtain all the functions existing in the source program, and determine all functions in the source program file as target functions by scanning all the functions in the source program file.

Step A1 specifically includes: determining all the functions in the source program file, screening out one or more functions from all the functions in the source program file, and determining it as the target function. In the specific implementation process, there can be a variety of screening rules, for example:

Screening rule 1: establish a function list in advance, and the function name that can be determined as the target function is written in the function list. Step A1 is specifically: scan the source program file to obtain the function names of all functions existing in the source program, and determine whether the function name of each function existing in the source program is in the function list, and if it exists in the function list, then Determined to be the objective function, otherwise it is not the objective function.

Specifically, the function list is the function name of some functions that complete specific functions, so that function call confusion can be performed more specifically.

Screening rule 2: multiple functions are randomly selected from all functions in the source program file, and each is determined as the target function.

Screening rule three: determine all the functions in the source program file, filter out the functions with function calls from all the functions in the source program file, and determine them as target functions.

After step A1, step A2 is then performed: creating an unreachable branch within each of the N objective functions.

It should be noted that an unreachable branch is a path that cannot be executed through input, therefore, the unreachable program will not be executed during execution. Relative to the unreachable branch is the reachable branch, which is a path that can be executed under a certain input. Therefore, the program in the reachable branch will be executed under a certain input during actual execution.

Specifically, an unreachable branch is created in each of the N objective functions, and the implementation manner is as follows:

Create a conditional call statement in each of the target functions, wherein the conditional call statement in each of the target functions includes a reachable branch and the unreachable branch; In the reach branch, write the real function call of the target function.

In a specific implementation process, there may be one or more real function calls in each target function. It should be noted that the real function call of the target function refers to the function call of the target function that existed before the source program file was hardened, that is, which function or functions are called by the target function. Specifically, if there is a real function call in the target function, create a conditional call statement at the function call instruction of the target function, and move the function call instruction for realizing the real function call of the target function to the conditional call In the reachable branch of the statement.

In the specific implementation process, creating a conditional call statement in each target function may be: transforming a function call instruction for realizing the real function call of the target function to obtain a conditional call statement for the target function.

Therefore, if there are multiple consecutive real function calls in the target function, a conditional call statement can be created in the target function, and the multiple continuous real function calls can be written in the reachable branch of a conditional call statement in the target function. function call. It is also possible to create multiple conditional call statements, and in each conditional call statement, a real function call is written one-to-one.

Specifically, the conditional call statement in each target function can be: based on the setting of a mathematical expression with a unique result, when the unique result of the mathematical expression is obtained, execute the instruction in the reachable branch of the conditional call statement, that is Execution: the function call instruction used to implement the real function call of the target function, and the instructions in the unreachable branch of the conditional call statement will not be executed during actual execution. Thus, a conditional call statement with reachable and unreachable branches is formed.

Specifically, among the different objective functions of the N objective functions, the mathematical expression with the unique result used may be the same, or there may be multiple mathematical expressions, and a mathematical expression is randomly determined for the current objective function Mode.

In the specific implementation process, the mathematical expression used is specifically a relatively complex mathematical expression, which increases the difficulty of reverse engineering.

In a specific implementation manner, the conditional call statement may be an if statement, specifically: if (a mathematical expression with a unique result) {block A} else{block B}. Specifically, the mathematical expression is a Boolean variable with a unique result, the reachable branch of the if statement is to execute program block A, the unreachable branch is to execute program block B, and program block A is the real function used for the target function Called function call instruction. When the only result is obtained, the instructions in the reachable branch of the conditional call statement are executed. Program block B is the added call of the target function to other functions, which is a function call relationship that does not exist in the target function in the source program file, and is used to confuse the real function call relationship of the target function.

In the specific implementation process, a conditional call statement may be created for each real function call of the target function, or a conditional call statement may be created for multiple continuous real function calls of the target function.

Taking the real function call relationship of function A in the source program file as follows: function A → call function B1, call function B2, for example:

Can be as follows:

int A()

{if(mathematical expression with unique result){call to function B1}else{call to other function};

if (mathematical expression with unique result) {call to function B2} else{call to other function};

It can also be as follows: int A() {if (mathematical expression with unique result) {call to function B1, call to function B2}else{call to other functions};

Of course, in the specific implementation process, the conditional call statement can also be in other forms, and the programming language of the source program file is different, so the conditional call statement used can also be different.

After step A2, step A3 is then performed: adding calls of the target function to other functions in each unreachable branch of the target function to obtain a new program, and the other functions belong to the source program file.

It should be noted that the other functions are for the target function, specifically the functions that are different from the functions called in the reachable branch of the conditional call statement of the target function, and the other functions for the target function may include the The objective function is to call the objective function itself.

For example, the source program file includes function A, function A calls function B and function C, function B calls function D, function D calls function E, there is a real function call in the reachable branch of the conditional call statement of target function A as : call function B and function C, and move the calls to function B and C to the reachable branch of the conditional call statement of the target function A. In the unreachable branch of the conditional call statement of the target function A, calls to one or more of function D and function E may be added.

Specifically, in step A3, adding calls from the target function to other functions in each unreachable branch of the target function can have multiple implementations, which are described separately below:

Implementation mode one:

For each of the target functions, the following steps are respectively performed: in the unreachable branch of the conditional call statement of the target function, adding random calls of other functions by the target function.

Specifically, in the reachable branch of the conditional call statement of the target function, random calls of functions different from the functions called in the reachable branch by the target function are added.

For example, the source program file includes function 1, function 1 calls functions 2, 3, and 4, function 3 calls functions 2, 5, and function 4 calls functions 6, 7.

Create a conditional call statement 1 in the target function 1 (that is, in function 1). In the reachable branch of the conditional call statement 1, function 1 calls functions 2, 3, and 4. In the unreachable branch of the conditional call statement 1 Add random calls of function 1 to functions 1, 5, 6, and 7 in function 1, create conditional call statement 2 in target function 3 (that is, in function 3), and write a function in the reachable branch of conditional call statement 2 3 calls functions 2 and 5, and adds function 3 random calls to functions 1, 3, 4, 6, and 7 in the unreachable branch of the conditional call statement 2. Create a conditional call statement 3 in the target function 4 (that is, in function 1), in the reachable branch of the conditional call statement 3, function 4 calls functions 6 and 7, and in the unreachable branch of the conditional call statement 3 Write function 4 with random calls to functions 1, 2, 3, 4, 5.

More specifically, the random call is to randomly select one or more functions that are different from the functions called in the reachable branch of the conditional call statement of the target function, and then write the random call in the unreachable branch The call of one or more selected functions.

Through the first embodiment, an unexecutable function call relationship that confuses the real function call logic in the target function can be written in each target function.

Since the source program file edited by the user may contain many functions, in this case, the first embodiment will greatly increase the amount of code to generate the executable program file and increase the size of the software product. For this, the following is given The second implementation mode is as follows:

Perform the following steps for each of the target functions: scan the source program file to determine the number of functions in the source program file; judge whether the number of functions in the source program file is greater than a preset value; In the unreachable branch of the conditional call statement of the target function, add the random call of the target function to other functions; otherwise, in the unreachable branch of the conditional call statement of the target function, add the random call of the target function to other functions A one-to-one call.

Through the second embodiment, it is possible to balance the code size and reverse difficulty of the final generated executable program file.

In the first and second embodiments above, the random call of the objective function to other functions can be implemented as follows:

Determine one or more candidate called functions from all the functions in the source program file; in the unreachable branch of the conditional call statement of the target function, add a pair of the target function to the one or more candidate called functions one call.

Further, the candidate called function is different from the function called in the reachable branch of the conditional call statement of the target function.

It should be noted that, as long as the candidate called function for the target function is different from the function called in the reachable branch of the conditional call statement of the target function, it can be different from other functions (including other target functions in the N target functions) ) in the same function called.

There are many ways to determine more than one candidate called function from all the functions in the source program file, which will be explained separately below:

Method 1: Randomly select a function different from the function called in the reachable branch of the conditional call statement of the target function from all the functions in the source program file, and determine it as the candidate called function.

Method 2: From all the functions in the source program file, select a function that satisfies a preset function condition, and determine it as the candidate called function. For example, user-defined functions may be selected from all functions of the source program file as candidate called functions, so that the candidate called functions will not be library functions, thereby increasing the difficulty of being interpreted by reverse engineers.

In the specific implementation process, in order to add a one-to-one call of the target function to the one or more candidate called functions in the unreachable branch of the conditional call statement of the target function.

Adding the call of the target function to the candidate called function, the specific implementation is as follows:

First, by scanning the source program file edited by the user, the function names of all functions in the source program file are obtained, and the function names of all functions in the source program file are recorded; Adding a function call instruction in the source program file; obtaining the function name of the candidate called function from the function names of all functions in the source program file; writing the function name of the candidate called function in the function call instruction.

Further, the candidate called function may be a parameterized function or a parameterless function, if the candidate called function is a parameterized function, write the name of the candidate called function in the function call instruction After the function name, the following steps are further included: generating a random transfer parameter for the candidate called function; writing the random transfer parameter into the function calling instruction.

For example, writing the random transfer parameter after the function call instruction may be expressed as follows:

int_stdcall function (random pass parameter x, random pass parameter y).

Because the instructions in the unreachable branch will not be executed, the transfer parameters for the candidate called function written in the unreachable branch can be randomly generated without affecting the function of the program itself.

Based on the same inventive concept, an embodiment of the present invention provides a program security protection device, as shown in FIG. 2 , including:

A function acquisition unit 201, configured to acquire M called functions from the source program file edited by the user;

A lookup table establishment unit 202, configured to establish a function lookup table comprising the M called functions, where M is an integer greater than 1;

The instruction replacement unit 203 is used to replace the function call instruction of each called function in the M called functions with a table lookup operation instruction so as to obtain a new program file, and the table lookup operation instruction is used to obtain a new program file from Obtain the current called function in the function lookup table;

The file generation unit 204 is configured to generate an executable program file corresponding to the new program file.

In a specific implementation manner, the lookup table establishment unit 202 includes:

The table building subunit is used to correspond to a column of the function lookup table with a single described function to be adjusted, and establish a function lookup table including M columns*N rows, where N is an integer greater than 1;

The index building subunit is used to create an index of the called function in each column of the function lookup table.

In a specific implementation manner, the function acquiring unit 201 includes:

By scanning the source program file, each called function existing in the source program file, or a called function meeting a preset condition is acquired.

In a specific implementation manner, the indexing subunit is specifically used for:

assigning a column index to each called function, and the column index is used to determine the column where the called function is located in the function lookup table;

Under each column index of the called function, a row index is established for the called function of the current column in the function lookup table, and the row index is used to obtain the called function in the current column of the function lookup table function.

In a specific implementation manner, the indexing subunit is specifically used for:

randomly assigning an integer value as a column index to each of said called functions;

Encrypting the column index of each called function to obtain the encrypted column index of each called function;

A first decryption function for each encrypted column index is constructed, and the first decrypted function is used to decrypt each encrypted column index to obtain a column index corresponding to the encrypted column index.

In a specific implementation manner, the indexing subunit is specifically used for:

An N-level row index is established for the called function of the current column, wherein the row index of the current row is the table lookup result of the previous row, and the table lookup result corresponding to the row index of the last level is the called function of the current column.

In a specific implementation manner, the indexing subunit is specifically used for:

Encrypting one or more row indexes in the N-level row indexes to obtain corresponding encrypted row indexes;

A second decryption function for each encrypted row index is constructed, and the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

In a specific embodiment, it also includes a table look-up instruction processing unit for:

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or

The table lookup operation instruction corresponding to the middle row of the function lookup table is processed as mutual recursive calls of the table lookup function in the multiple table lookup operation instructions.

Based on the same inventive concept, as an implementation of the above method, the embodiment of the present invention provides a computer device 30. FIG. 3 is a schematic structural diagram of the computer device 30 in the embodiment of the present invention. Referring to FIG. A memory 301, a processor 302, and a computer program 303 stored in the memory 301 and operable on the processor 302. When the processor executes the program 303, the steps described in any one of the foregoing program protection method embodiments are implemented.

Based on the same inventive concept, an embodiment of the present invention provides a computer storage medium on which a computer program is stored, and the above instructions can be executed by the processor 302 of the computer device 30 shown in FIG. 3 to complete the above method. The computer storage medium is specifically a non-transitory computer-readable storage medium, specifically ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

The above-mentioned technical solutions in the embodiments of the present invention have at least the following technical effects or advantages:

By obtaining M called functions from the source program file edited by the user; establishing a function lookup table containing M called functions, and replacing the function call instructions of each called function in the M called functions with look-up The table operation instruction is used to obtain a new program file, and the table lookup operation instruction is used to obtain the current called function from the function lookup table; generate an executable program file corresponding to the new program file. Turn the direct function call instruction into a table lookup operation instruction for the called function, which can completely hide the function call relationship in the program in the table. It is difficult for reverse engineers to see the real function call from the decompiled program. Therefore, the difficulty of reversing each real calling function is increased, thereby improving the security of the software product.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

The invention discloses A1, a program security protection method, including:

Obtain M called functions from the source program file edited by the user;

Establish a function lookup table containing the M called functions, where M is an integer greater than 1;

The function call instruction of each called function in the M called functions is replaced by a table lookup operation instruction so as to obtain a new program file, and the table lookup operation instruction is used to obtain from the function lookup table the current called function;

An executable program file corresponding to the new program file is generated.

A2, the method for program security protection as described in A1, the establishment of a function lookup table comprising the M called functions includes:

Corresponding to a column of the function lookup table with a single described called function, set up a function lookup table comprising M columns*N rows, where N is an integer greater than 1;

In each column of the function lookup table, an index of the called function where the column is located is established.

A3, the method for program security protection as described in A2, described to obtain M called functions from the source program file edited by the user, including:

By scanning the source program file, each called function existing in the source program file, or a called function meeting a preset condition is obtained.

A4, the method for program security protection as described in A2 or A3, described in each column of the function lookup table, establishes the index of the called function where the column is located, including:

assigning a column index to each called function, and the column index is used to determine the column where the called function is located in the function lookup table;

Under each column index of the called function, a row index is established for the called function of the current column in the function lookup table, and the row index is used to obtain the called function in the current column of the function lookup table function.

A5, the method for program security protection as described in A4, said assigning a column index to each said called function, comprising:

randomly assigning an integer value as a column index to each of said called functions;

Encrypting the column index of each called function to obtain the encrypted column index of each called function;

A first decryption function for each encrypted column index is constructed, and the first decrypted function is used to decrypt each encrypted column index to obtain a column index corresponding to the encrypted column index.

A6, the method for program security protection as described in A4, said setting up a row index to the called function of the current column in the function lookup table, comprising:

An N-level row index is established for the called function of the current column, wherein the row index of the current row is the table lookup result of the previous row, and the table lookup result corresponding to the row index of the last level is the called function of the current column.

A7, the method for program security protection as described in A6, said setting up an N-level row index to the called function of the current column, including:

Encrypting one or more row indexes in the N-level row indexes to obtain corresponding encrypted row indexes;

A second decryption function for each encrypted row index is constructed, and the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

A8. The program security protection method as described in A2 or A3, after the function call instruction of each called function in the M called functions is replaced with a table lookup operation instruction, it also includes:

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or

The table lookup operation instruction corresponding to the middle row of the function lookup table is processed as mutual recursive calls of the table lookup function in the multiple table lookup operation instructions.

The present invention also discloses a B9, a program security protection device, including:

A function acquisition unit, configured to acquire M called functions from the source program file edited by the user;

A lookup table establishment unit, configured to establish a function lookup table containing the M called functions, where M is an integer greater than 1;

An instruction replacement unit, configured to replace the function call instruction of each of the M called functions with a table lookup operation instruction, so as to obtain a new program file, and the table lookup operation instruction is used to obtain a new program file from the Obtain the current called function from the above function lookup table;

A file generating unit, configured to generate an executable program file corresponding to the new program file.

B10. The program security protection device as described in B9, the look-up table establishment unit includes:

The table building subunit is used to correspond to a column of the function lookup table with a single described function to be adjusted, and establish a function lookup table including M columns*N rows, where N is an integer greater than 1;

The index building subunit is used to create an index of the called function in each column of the function lookup table.

B11. The program security protection device as described in A10, the function acquisition unit includes:

By scanning the source program file, each called function existing in the source program file, or a called function meeting a preset condition is obtained.

B12. The program security protection device as described in B10 or B11, the indexing subunit is specifically used for:

assigning a column index to each called function, and the column index is used to determine the column where the called function is located in the function lookup table;

Under each column index of the called function, a row index is established for the called function of the current column in the function lookup table, and the row index is used to obtain the called function in the current column of the function lookup table function.

B13. The program security protection device as described in B12, the index building subunit is specifically used for:

randomly assigning an integer value as a column index to each of said called functions;

Encrypting the column index of each called function to obtain the encrypted column index of each called function;

A first decryption function for each encrypted column index is constructed, and the first decrypted function is used to decrypt each encrypted column index to obtain a column index corresponding to the encrypted column index.

B14. The program security protection device as described in B12, the index building subunit is specifically used for:

An N-level row index is established for the called function of the current column, wherein the row index of the current row is the table lookup result of the previous row, and the table lookup result corresponding to the row index of the last level is the called function of the current column.

B15. The program security protection device as described in B14, the index building subunit is specifically used for:

Encrypting one or more row indexes in the N-level row indexes to obtain corresponding encrypted row indexes;

A second decryption function for each encrypted row index is constructed, and the second decryption function is used to decrypt each encrypted row index to obtain a corresponding row index.

B16. The program security protection device as described in B10 or B11, further comprising a table lookup instruction processing unit, for:

Processing the table lookup operation instruction corresponding to the middle row of the function lookup table as a recursive call of the table lookup function in the table lookup operation instruction; or

The table lookup operation instruction corresponding to the middle row of the function lookup table is processed as mutual recursive calls of the table lookup function in the multiple table lookup operation instructions.

The present invention also discloses C17, a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps described in any one of A1-A8 are realized.

The present invention also discloses D18, a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, any one of A1-A8 is realized. described steps.

Claims (10)

1. a kind of program safety guard method, which is characterized in that including：

M called function is obtained from the source files of program that user edits；

The look-up table of functions comprising the M called function is established, M is the integer greater than 1；

The function call instruction of each called function in the M called function is replaced with into table lookup operation instruction, so as to obtain Program file newly is obtained, the table lookup operation instruction from the look-up table of functions for obtaining current called function；

Generate executable program file corresponding with the new program file.

2. program safety guard method as described in claim 1, which is characterized in that described to establish comprising the M by letter of transfer Several look-up table of functions, including：

The column that the look-up table of functions is corresponded to the single called function, establish the look-up table of functions comprising M column * N row, N For the integer greater than 1；

In each column of the look-up table of functions, the index to the called function where the column is established.

3. program safety guard method as claimed in claim 2, which is characterized in that the source files of program edited from user Middle M called function of acquisition, including：

By scanning the source files of program, each called function present in the source files of program is obtained, or meet pre- If the called function of condition.

4. program safety guard method as claimed in claim 2 or claim 3, which is characterized in that described in the look-up table of functions Each column establishes the index to the called function where the column, including：

Column index is distributed to each called function, the column index is for determining the called function in the function lookup The column of table；

Under the column index of each called function, in the look-up table of functions when the called function in forefront establishes row rope Draw, the line index is used in the look-up table of functions obtain the called function when forefront.

5. program safety guard method as claimed in claim 4, which is characterized in that described to distribute each called function Column index, including：

The integer value as column index is distributed for each called function at random；

The column index of each called function is encrypted, the encryption column index of each called function is obtained；

For the first decryption function of each encryption column index, first decryption function is used to decrypt each described for building Column index is encrypted, column index corresponding with encryption column index is obtained.

6. program safety guard method as claimed in claim 4, which is characterized in that described to current in the look-up table of functions The called function of column establishes line index, including：

N grades of line index are established to the called function when forefront, wherein the line index of current line is the checking result of lastrow, most The corresponding checking result of rear stage line index is the called function when forefront.

7. program safety guard method as claimed in claim 6, which is characterized in that described pair is established when the called function in forefront N grades of line index, including：

One or more line index in the N grades of line index is encrypted, corresponding encryption line index is obtained；

For the second decryption function of each encryption line index, second decryption function is used to decrypt each described for building Line index is encrypted, corresponding line index is obtained.

8. a kind of program safety protective device, which is characterized in that including：

Function acquiring unit, for obtaining M called function from the source files of program that user edits；

Look-up table establishes unit, and for establishing the look-up table of functions comprising the M called function, M is the integer greater than 1；

Replacement unit is instructed, is looked into for replacing with the function call instruction of each called function in the M called function Table handling instruction, so as to obtain new program file, the table lookup operation instruction from the look-up table of functions for being worked as Preceding called function；

File generating unit, for generating executable program file corresponding with the new program file.

9. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the program is held by processor Step of any of claims 1-7 is realized when row.

10. a kind of computer equipment including memory, processor and stores the meter that can be run on a memory and on a processor Calculation machine program, which is characterized in that the processor realizes step of any of claims 1-7 when executing described program Suddenly.