Program control flow deep confusion method based on labels

Abstract

The invention belongs to the technical field of computer software safety and intellectual property protection, in particular to a program control flow deep confusion method based on labels. The method comprises the following steps of: secretly generating labeled data, and spreading labels along with the execution of a program. In the execution process of the program, the labels can also be dynamically deleted and increased. Since the labels are hidden in the execution process of the program, the actual execution process of the program is changed. A confusing device can also be automatically inserted with some new indicators to change and spread the labels so that the execution flows of the labels are very difficult to analyze. In the invention, paths which can not be truly executed can also be inserted with codes resulting in the change of control flows. The invention realizes program control flow deep confusion with low performance overhead and greatly improves the safety and the secrecy of the program.

Description

technical field [0001] The invention belongs to the technical field of computer software security and intellectual property protection, and in particular relates to a method for deep obfuscation of program control flow. Background technique [0002] With the birth of software, the reverse engineering of software was also born. Here, reverse engineering is relative to the normal program development process. The normal program development process refers to the process of converting the high-level expression form (source code) of the program to the low-level expression form (executable file), which is the process of program compilation that we often refer to. figure 1 The left half lists the specific steps of this conversion: first, the program is converted from the form of source code to the form of abstract syntax tree by the precompiler, and then the compiler converts the abstract syntax tree into the program control flow graph, The control flow graph can reflect the speci...

AI Technical Summary

Problems solved by technology

Here we take the program control flow obfuscation technology based on the horizontal expansion of control flow with the best performance as an example. If 80% of the control flow of the program is obfuscated, it will bring more than 5 times the performance overhead, that is, the obfuscated program Only 1 / 5 of the performance of the original program

In addition to the problem that the performance of the obfuscated program is much worse than the original program, the above technologies cannot achieve deep program obfuscation, because they are all "control flow insensitive". The control flow insensitivity mentioned here is mainly It means that these technologies do not need to rely on their own program control flow when obfuscating the control flow of the program. A specific manifestation is that these technologies can independently confuse any function in the program without confusing other functions.

This obfuscation technique that is not sensitive to control flow has a significant problem, because in reverse engineering, it is generally only necessary to find the most useful algorithm in the original program or just find one of the loopholes to attack, and this control flow is not sensitive The confusion makes it possible to analyze its core algorithm during reverse engineering, thus greatly reducing the cost of reverse engineering. Therefore, this paper believes that these technologies cannot really achieve in-depth program control flow analysis.

Images