WO2013170724A1 - Method for protecting java application programs in android system - Google Patents

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to the field of computer security, and more particularly to a method for protecting a JAVA application in an Android system. By encrypting and transforming several method instruction codes of the JAVA class object to be protected, the encrypted method code is decrypted in real time according to the calling requirement during the running of the program, which makes the application difficult to decompile and static analysis, and realizes JAVA. Effective protection of the program. BACKGROUND OF THE INVENTION Android (Android) is a Linux-based open source operating system mainly used in portable devices. Android is one of the mainstream operating systems used in mobile devices such as mobile phones and tablets. The application in Android system is usually written in JAVA language, compiled and generated JAVA program files are installed and run. Because JAVA belongs to the intermediate language, its compiled executable file contains a lot of source code structure and design information, and the Android system is a Linux-based operating system. Its openness and rich variety of program analysis tools make the JAVA program very It is easy to be decompiled and statically analyzed, so the copyright protection of the application in Android is very weak. The application's installation files are easy to copy and distribute, and pirates can easily get it on the network and install it on other unauthorized devices. Even if the developer implements some software protection in the application, such as verification and functional binding of the hardware device or user identity, the pirate can easily analyze the running logic of the application, bypass or remove the corresponding in the program. Protection function, generate a cracked version that can be used freely. One of the common protection methods at present is to use the "packing," method, that is, all or part of the instructions of the application are encrypted or otherwise transformed, and the runtime is reversed by a shelling program. After the transformation, it is loaded into memory and executed. Add some control protection measures to the shelling program, such as authentication of the user's identity, application integrity check, etc. Although this method can prevent direct decompilation of the application, its "hulling operation" is a one-time operation. After the "hulling", all the instruction codes of the program are in the memory, and the cracker can be conveniently placed in the program. After the shell is loaded, the memory data is saved and the original program is restored. In addition, the function logic of the shelling program is fixed, and it is easy for the decrypter to analyze and crack, so the method of packing is not strong enough for the application software. Due to the above reasons, the software piracy phenomenon of the Android system is very serious, and the rights of the paid software cannot be guaranteed. As a result, many successful softwares in the iOS system give up the Android system or release the software in the form of free advertising in the Android system. It can be seen that the lack of protection mechanism of JAVA program seriously restricts the development of the software market in Android system.

SUMMARY OF THE INVENTION In order to overcome the shortcomings of the JAVA application lacking a security protection mechanism in the prior art, the present invention provides a method for protecting a JAVA application in an Android system by using a plurality of method instruction codes of a JAVA class object to be protected. Transform storage, real-time decryption operation of the encrypted method code according to the calling requirement when the program runs, making the application difficult to be decompiled and statically analyzed, and effectively protecting the JAVA application. In the JAVA language, there are two types of method functions for class objects: normal methods and native methods. The normal method is compiled into JAVA instruction code by JAVA language. The runtime is executed by JAVA Virtual Machine (JVM). Another type of native method is Native Method. It is called by JANI Native Interface (JAVA Native Interface). The interface accesses the external library running on the local operating system. JNI implements mutual calls between JAVA programs and external libraries, and is usually used to provide JAVA programs with non-JAVA language implementations. The invention encrypts the method data content of a class object implemented by the JAVA language and changes it to a specific The JNI protection function interface calls the decryption to restore the original instruction code in the JNI protection function interface, and then calls the restored original instruction code. The steps to protect a JAVA application are:

1. Locate the functional unit to be protected in the JAVA program file (for example, a common method of the class object to be protected, to implement a specific function), and change it to a local method;

2. Create a new normal method (that is, a copy unit corresponding to the functional unit) for the object. The new normal method is the copy method of the above-mentioned protected normal method, so that the instruction code space of the new normal method is The instruction code space of the protected common method is equal, and the instruction code space of the new normal method is completely filled with the null instruction;

3. Generate a JNI library (JAVA local call library) that exports the interface to the protected normal method. The original instruction code of the protected normal method is encrypted and stored in the resources of the JNI library.

 4. Erase the original instruction code of the protected normal method. For other methods that require protection, perform the same steps as above. Execute a protected JAVA application. When the protected normal method is called, since the protected normal method has been changed to the local method, the JVM will call the interface of the protected normal method in the JNI library. Perform the following steps in the JNI library:

1. Find the encrypted data of the protected common method from the resources of the JNI library, decrypt the data, and fill it back into the instruction code space of the copy method;

 2. Call and execute the copy method;

 3. Erase the instruction code in the instruction code space of the copy method, that is, erase the entire copy method;

4. Return the call to the protected normal method. The key used in the above encryption process can be protected by the protected JAVA application. Generated such that the keys used by each JAVA application are different; for example, the information includes but is not limited to software basic information, APPID, version number, and the like. It is also possible to combine the information of the protected JAVA application with the information of the user authorized to use the JAVA application to generate a key, so that the installation procedure of each user is different, and the unauthorized copying of the installer is prevented. For example, user information includes, but is not limited to, user ID, APPID, version number, UID. For the above encryption method, various symmetric or asymmetric algorithms may be used. For example, symmetric algorithms include but are not limited to AES, DES, TDES, etc.; asymmetric algorithms include but are not limited to: RSA, ECC). It can be a public or private encryption algorithm, or other data transformation and inverse transformation methods. For example, a specific transformation of code data bytes can be converted into other bytecodes or encrypted data, and the inverse transformation uses the same rules to obtain the original. data. In the above encryption and decryption execution process, some methods may be further adopted to increase the difficulty of decompilation and static analysis, or dynamic debugging, and the methods include:

1. Use a custom non-standard JAVA program file format. For example, you can define a file format, such as . sense or other format, store the content in the file, and then use the loader you created to load the file in this format. The file storage can be loaded in an encrypted or defined format. Because of this file format, the average person does not know the file format and does not know how to load it, thus increasing the difficulty of decompilation.

 2. Remove some information (such as variable names) that does not affect the source of the program. For example, remove the relevant internal variable name, or some internal logic code (such as switch) to confuse or remove. When decompiled, the interruption to this logical part will not proceed, increasing complexity.

3. Use the anti-debugging technology when running the JAVA application. When the JAVA application detects that the debugger is debugging the program, stop the decryption and load the running process. The anti-debugging technique is to add the relevant code to monitor whether there is debugger debugging in the JAVA application code. When running the JAVA application, the anti-debugging code in the code will monitor whether there is debugger debugging. If there is, stop the decryption and load the running process. Reverse debugging can be done in any process. When it is detected that the debugger is debugging the program, it will stop the decryption and load the running process. After the stop, it can't be debugged, which increases the difficulty of debugging, and of course increases the difficulty of decompilation. The invention can encrypt and protect multiple methods of any class object, and is dynamically decrypted and loaded and executed only when the protected ordinary method is called, and the copy method is erased immediately after the call is completed. The instruction code in the instruction code space (erasing the contents of the entire copy method, that is, the instruction code for erasing the copy method), there is always no complete program code in the memory, so it is difficult for the cracker to recover the program file for decompilation and static Analysis prevents the piracy of JAVA applications. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart of a method for encrypting protection in the present invention. 2 is a flow chart of a method of performing a call protection in the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, specific embodiments of the present invention will be described by way of examples. For example, to protect the generic method M of class Class A (i.e., a functional unit that implements a particular function), in accordance with an embodiment of the present invention, the following steps are performed:

1. Locate ClassA.M in the JAVA program file (source file). In a specific embodiment of the present invention, positioning is to first find the ClassA class, and then find the M method in ClassA. Positioned by code is ClassA test=new ClassA(); test.M method can be obtained. Change the method ClassA.M (the normal method M of the class ClassA to be protected) to the local method. Change the normal method to a local method with the keyword native. The local method is changed after the change.

Create a new normal method for class ClassA M1 (M1 corresponds to the copy unit of function unit M above). In one embodiment of the present invention, it is created within the class code of class ClassA, and a common method M1 is generated by the code. Let the new normal method Ml's instruction code space be equal to the ClassA.M instruction code space. According to an embodiment of the present invention, according to the code content of the M method, how much space the method occupies is calculated, and the specific size of the code space of the M method is calculated, and when a new common method M1 is generated, the size of the M1 is set. The size of the above M. Then fill all the instruction space of Ml as a null instruction. According to an embodiment of the present invention, the M1 is an empty method, and only the declaration of the method is included, the method does not contain code, and the code space of the method body is consistent with the size of the M instruction code space.

Generate a JNI library and export the ClassA.M interface. Specifically, in accordance with an embodiment of the present invention, the steps of generating JNI include: (1) writing JAVA code, indicating the local dynamic link library and local interface method to be accessed; (2) compiling with the javac command. Java class, use (javah -jni java class name) to generate a header file with the extension h; (3) use C / C + + to implement the functions declared in the .h file generated in (2); (4) compile C / C++ implementation code generates dynamic link library (dll/so file); (5) generates jar package for calling; defines interface and so on are included in the above steps. According to a specific embodiment of the present invention, the exported ClassA.M interface is the function declared in the .h file generated in the C/C++ implementation step 2 in the above-mentioned JNI generation step, and the interface name format of the ClassA.M is JAVA. - Plus the package path of the java program plus the function name. The original instruction code in ClassA.M is encrypted and stored in the resources of the JNI library. The encryption method may be a symmetric or asymmetric encryption algorithm, and may be a public or private encryption algorithm, or other data transformation and inverse transformation methods. In addition, the original of ClassA.M The instruction code is encrypted and stored in the JNI library by the above encryption method, for example, encrypting the code byte and storing the encrypted character string in the resource. When decryption is performed, the encrypted content of the resource is decrypted according to the same rule.

 5. Erase the instruction code of ClassA.M, ie delete the instruction code of the ClassA.M method. For other methods that require protection, perform the same steps as above. Execute the protected JAVA application. When calling the normal method ClassA.M, because the ClassA.M and the local method are modified, the JVM will call the ClassA.M interface in the JNI library, and perform the following steps in the JNI library. :

1. Find the encrypted data of ClassA.M from the resources of the JNI library (when encrypting, the stored resource location becomes a known location, and the encrypted data can be found according to this location), and the encrypted data is decrypted. Then fill in the decrypted data. Specifically, the way to fill in the data is: find the location of the method of ClassA.Ml, and then write the decrypted data into the instruction code space of ClassA.Ml;

2. The JAVA application calls ClassA.Ml;

3. Erase the ClassA.Ml instruction code;

4. Return to the ClassA.M call.

Claims

claims 1. A method of protecting JAVA applications in Android systems, characterized by locating the functional unit to be protected in the JAVA application source file and changing the functional unit to a local method; Create a copy unit of the functional unit such that the instruction code space of the copy unit is equal to the instruction code space of the functional unit; Fill the instruction code space of the copy unit entirely with empty instructions; Generate a JAVA local call library and export the interface of the functional unit; Encrypt the original instruction code of the functional unit and store it in the resource of the JNI library; Erase the original instruction code in the functional unit. 2. The method of protecting JAVA applications in the Android system according to claim 1, characterized by: When the functional unit is called, the interface of the functional unit in the JAVA local call library is called through the Java virtual machine, and the following steps are performed in the JAVA local call library: Find the encrypted data of the functional unit from the resources of the JAVA local call library, and decrypt the data; Fill the decrypted data back into the instruction code space of the copy unit; Call and execute the copy unit; Erase the instruction code in the instruction code space of the replica unit; Returns the call to the functional unit. 3. The method of protecting a JAVA application in an Android system according to claims 1 and 2, characterized in that the key used in the encryption process is generated from the information of the JAVA application. 4. The method of protecting a JAVA application in an Android system according to claims 1 and 2, characterized in that the key used in the encryption process is composed of the information of the JAVA application and the person authorized to use it. The JAVA application's user information is combined to generate a key. 5. The method of protecting JAVA applications in the Android system according to claims 1-4, characterized in that the encryption method is a symmetric or asymmetric algorithm, or a public or private encryption algorithm, or other data transformation with the inverse transformation method. 6. The method of protecting JAVA applications in the Android system according to claims 1-5, characterized in that, in the above-mentioned encryption or decryption process, a customized non-standard JAVA program file format is used. 7. The method of protecting JAVA applications in the Android system according to claims 1-5, characterized in that, during the above-mentioned encryption or decryption process, source program information that does not affect the operation of the JAVA application is removed. 8. The method of protecting a JAVA application in an Android system according to claims 1-5, characterized in that, during the above-mentioned decryption process, when running the JAVA application, when it is detected that the JAVA application is being processed When debugging, stop the decryption and loading running process.