Novel virtual machine software protection method based on stack hiding

Abstract

The invention discloses a novel virtual machine software protection method based on stack hiding, and belongs to the field of mobile application reinforcement. The method comprises the steps: analyzing a DEX file into a data structure DeHelper, enabling an instruction mapping module to add an obfuscated byte code instruction to each protected function, randomly inserting a return instruction intothe obfuscated byte code instruction, and counting the frequency of the obfuscated byte codes; enabling the instruction mapping module to perform bit operation or exchange operation on byte codes andoperands in each new byte code mapping instruction to form a new remapping instruction set B; writing an unprotected function set in the data structure DeHelper and an original SO file in the APK1 into a data file S, performing repackaging to generate the APK2 and performing signing; enabling an Android end initialization module to extract DEX and SO files of a protected App from the data file S,and creating an index and a data cache of a key function; enabling an Android end virtual machine to be responsible for executing an unprotected function, and enabling a user-defined virtual machine to execute a protected function. The method has the advantages of universality, portability and safety.

Description

technical field [0001] The invention belongs to the field of mobile application reinforcement, in particular to a novel virtual machine software protection method based on stack hiding. Background technique [0002] With the development of the mobile Internet era, people are increasingly inseparable from smart mobile devices. Whether it is traditional software such as calls, text messages or entertainment, or emerging software such as payment, social networking or work, it plays an increasingly important role in people's lives. At the same time, mobile software contains a large amount of user information and software core business logic, and even private data such as user passwords. Due to the open source nature of the Android platform, if the software is not specially protected, attackers can easily obtain user information and core data. Business logic. [0003] Existing software reinforcement methods are all implemented based on dynamic loading: that is, in the process o...

AI Technical Summary

Problems solved by technology

[0003] Existing software reinforcement methods are all implemented based on dynamic loading: that is, in the process of class loading, the class instructions that need to be protected are encrypted and protected as a whole, but this method has two serious defects: 1) when running the instructions of this class , there will be a plain text instruction sequence in the memory; 2) When executing the instruction, it must be interpreted and executed by the system interpreter

Attackers can easily obtain plaintext instruction sequences from memory or system interpreter entry

Images