Python script protection tool, method, storage medium and program product

Abstract

The present invention provides a Python script protection tool, method, storage medium and program product, and relates to the field of Python script protection. The Python script protection tool includes a protector and a Python extension package, wherein the Python extension package includes multiple versions of Python interpreter cores and has the ability to generate multiple versions of code objects; the protector includes a script protection module and a local program protection module, wherein the script protection module is used to protect the script, and the multiple versions of code objects generated by calling the Python interpreter core are carried in the protected script, and the local program protection module is used to generate a runtime library package corresponding to the protected script, and introduce a first file in the runtime library package to search for code objects with matching versions when running the protected script. The protection tool of the present invention not only ensures that the protected script has high security, but also enables the protected script to support cross-version operation.

Description

Technical Field

[0001] The present invention relates to the technical field of Python script protection, and in particular to a Python script protection tool, method, storage medium and program product. Background Art

[0002] Python is an object-oriented interpreted computer programming language. Programs written in Python do not need to be compiled into binary code and can be run directly from the source code. In order to protect their own intellectual property rights, Python script developers can use protection tools to protect Python scripts.

[0003] Most Python script protection solutions on the market are source code level solutions. During the execution of the protected Python script, the compiled .pyc file can be easily decompiled back to Python code by the decompilation tool, which is almost the same as the source code. In comparison, the bytecode level solution can protect the bytecode file and prevent it from being directly decompiled, which is more secure. However, the specific implementation process of the existing bytecode level protector is not public. In addition, the Python interpreter version required for the execution of the protected Python script must be consistent with the Python interpreter version used during protection, otherwise the protected Python script cannot be executed normally or the execution result will be biased, which has limitations. Summary of the invention

[0004] 1. Technical issues to be solved

[0005] In view of the deficiencies of the prior art, an embodiment of the present invention provides a bytecode-level protection solution, including a Python script protection tool, method, storage medium, and program product. The solution not only ensures that the protected Python script has high security, but also solves the aforementioned limitations.

[0006] (II) Technical solution

[0007] To achieve the above objectives, the embodiments of the present invention are implemented through the following technical solutions:

[0008] In a first aspect, a Python script protection tool is provided, including:

[0009] A Python extension package, wherein the underlying protector in the Python extension package includes multiple versions of Python interpreter cores, and the multiple versions of Python interpreter cores are used to generate corresponding multiple versions of code objects;

[0010] A protector, the protector comprising a script protection module and a local program protection module, wherein:

[0011] The script protection module is used to call the underlying protector to generate multiple versions of code objects corresponding to the source code of the Python script to be protected, and generate a protected script, wherein the protected script includes the encrypted multiple versions of the code objects;

[0012] The local program protection module is used to generate a runtime library package corresponding to the protected script, and the runtime library package is used to support the running of the protected script. The runtime library package includes a first file, and the first file is used to search for a code object that matches the version of the Python interpreter that runs the protected script from the multiple versions of code objects.

[0013] In a second aspect, a Python script protection method is provided, including:

[0014] The protector receives the Python script to be protected;

[0015] The script protection module of the protector calls the underlying protector in the Python extension package, so that the underlying protector uses the multiple versions of Python interpreter cores included to generate multiple versions of code objects corresponding to the source code of the Python script respectively;

[0016] The script protection module of the protector generates a post-protection script, wherein the post-protection script includes the encrypted code objects of the multiple versions;

[0017] The local program protection module of the protector generates a runtime library package corresponding to the protected script, and the runtime library package is used to support the running of the protected script; the runtime library package also includes a first file, and the first file is used to search for a code object that matches the version of the Python interpreter that runs the protected script from the multiple versions of code objects.

[0018] In a third aspect, a method for running a protected Python script is provided, wherein the protected Python script includes a protected script and a runtime library package corresponding to the protected script; wherein the protected script includes multiple versions of encrypted code objects, and the runtime library package is used to support the running of the protected script;

[0019] The method is executed by a Python interpreter, and includes: loading the runtime library package; calling the first file in the runtime library package to search for a code object that matches the version of the Python interpreter from multiple versions of code objects in the protected script; and decrypting and executing the found code object based on the runtime library package.

[0020] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and when a processor executes the computer-executable instructions, the above-mentioned protection method or operation method is implemented.

[0021] In a fifth aspect, a computer program product is provided, comprising computer instructions, which implement the above-mentioned protection method or operation method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is an exemplary upstream and downstream flow diagram for protecting Python scripts using an existing protector;

[0023] Figure 2 A protection tool and its upstream and downstream flow diagram provided in an embodiment of the present invention;

[0024] Figure 3 Another protection tool provided by an embodiment of the present invention and a schematic diagram of its upstream and downstream flows;

[0025] Figure 4 A schematic diagram of another protection tool provided by an embodiment of the present invention when used for Python script protection;

[0026] Figure 5 A flowchart of a Python script protection method provided by an embodiment of the present invention;

[0027] Figure 6 It is a schematic diagram of a part of the process of the Python script running method of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the accompanying drawings of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] For ease of understanding, some terms involved in this application are briefly explained below.

[0030] Programs written in Python are usually called Python scripts, Python programs, Python projects, Python projects, etc., and are collectively referred to as Python scripts in this application.

[0031] Source code is a human-readable text file written by programmers. It is written by tools such as text editors or integrated development environments (IDEs) and is the original form of the program. The source code of Python scripts often has a .py extension, so it is sometimes referred to as a .py file.

[0032] Code object, the Python interpreter usually abstracts an executable scope (such as a module or function) into a code object, whose main function is to execute code. Code objects are usually stored in memory. When the Python interpreter loads the source code of a python script, it compiles the source code into a code object and stores it in memory for execution.

[0033] A code object can be understood as a data container that contains a bytecode object and metadata information related to execution, such as file name, line number, constants, variables, etc. Bytecode objects are generally data structures that represent bytecodes in Python, which can be stored persistently, usually in bytecode files. Bytecode files often have a .pyc extension, so they are sometimes referred to as .pyc files.

[0034] The Python interpreter generally includes a compiler and a virtual machine (Virtual Machine). When a Python script is executed for the first time, the compiler generally compiles the source code in the Python script first. The main result of the compilation is to generate code objects (including bytecode objects), and then the compiled results are handed over to the virtual machine, which executes them in sequence to complete the execution of the Python program. In some cases, such as when the bytecode cache is enabled, the bytecode object can be persistently stored in a .pyc file. When the Python script needs to be executed again later, the Python interpreter can check whether there is a corresponding .pyc file. If it exists, the bytecode object in the .pyc file is loaded, converted into the corresponding code object, and then executed without recompiling, thereby speeding up the execution.

[0035] A runtime library generally refers to a pre-written code library that is specifically loaded and used when the program is running. These libraries provide the necessary support and resources for the running of the script, allowing the script to execute normally at runtime.

[0036] See also Figure 1 , Figure 1 This is an exemplary upstream and downstream flow diagram for protecting Python scripts using existing protectors.

[0037] The protector developer uses his own device (referred to as device 1) to develop a protector that can be used to protect Python scripts.

[0038] The Python interpreter version X is installed on the device of the Python script developer (referred to as device 2). The Python script developer developed a Python script on device 2 that can be used to implement certain specific functions. In order to protect the Python script so that the important source code or code logic is not exposed or tampered with, the Python script developer can use a protector on device 2 for protection. The source code file of the Python script (for the sake of distinction and description, this article will refer to it as script A) is used as the input of the protector, and the output is the protected Python script (for the sake of distinction and description, this article will refer to it as script B) and the corresponding runtime library package. Script B and the corresponding runtime library package are delivered together to downstream script users.

[0039] It is understandable that, in this example, the Python script developer and the protector user are the same entity; in other cases, the Python script developer and the protector user may be different entities, for example, the Python script developer is a R&D staff in the enterprise, and the protector user is a product delivery staff.

[0040] If the script user needs to run the protected Python script, he needs to install the Python interpreter of version X on the device (device 3) he uses, and then he can run the script smoothly, including calling the corresponding runtime library package to achieve specific functions. If the Python interpreter version installed on device 3 is not version X, the script is likely to fail to run or run correctly to achieve specific functions.

[0041] The specific implementation process of the existing protector is not public. After analysis, the inventor believes that one of the possible reasons for the occurrence of this problem is that different versions of Python interpreters may make some changes to the bytecode format or interpretation logic, resulting in different bytecode objects generated by the same source code on different versions of interpreters, resulting in one version of Python interpreter being unable to execute the code object generated by another version of Python interpreter. Therefore, an embodiment of the present invention proposes a protection tool that can be used to protect Python scripts. While achieving bytecode-level protection and having high security, it can also make the protected Python script (hereinafter referred to as the protected script) compatible with the operation of multiple versions of Python interpreters, that is, the protected script supports cross-version operation.

[0042] The following will further explain the composition of the protection tool, the method of using the protection tool to protect the Python script, and the method of running the protected script in conjunction with the accompanying drawings.

[0043] See also Figure 2 The protection tool of the embodiment of the present application includes: a Python extension package and a protector, wherein the protector includes a script protection module and a local program protection module.

[0044] The Python extension package includes a low-level protector, which includes multiple versions of the Python interpreter core.

[0045] The Python interpreter core is the core part of the Python language, generally including grammatical semantic analysis, interpreter, built-in functions, etc. The Python interpreter core can illustratively exist in the form of a dynamic link library. The Python interpreter core in the embodiment of the present application can at least be used to compile the source code and generate a code object.

[0046] The multiple versions of Python interpreter core include two or more versions, which can be any one or more of Python 3.6-3.11, or other achievable versions. The bottom layer protector includes multiple versions of Python interpreter core, and has the ability to compile a source code separately and generate corresponding multiple versions of code objects.

[0047] The script protection module is used to protect Python scripts and generate protected scripts. In some implementations, the script protection module can be used to call the underlying protector to generate multiple versions of code objects corresponding to the source code of the Python script to be protected and generate protected scripts.

[0048] It should be understood that for a Python script to be protected, in addition to one or more source code files, it may also include some other files, such as instruction documents, configuration files, test files, etc. In addition, a Python script used to implement certain specific functions may be part of a larger project, which may include multiple Python scripts. For users using the protector in the embodiment of the present application, they can input the folder of the Python script or the folder of the entire project into the protector, and the script protection module can parse the source code files therein by itself, without the need for users to manually search for imports, and without the need for users to protect them one by one in multiple times. Of course, in some implementations, the source code files parsed by the script protection module can be displayed to the user by the protector, allowing the user to confirm or modify them, such as removing some source code files that do not need to be protected. See. Figure 4The aforementioned parsing steps can be implemented illustratively by a parsing module in the script protection module.

[0049] The source code of the Python script to be protected in the embodiment of the present application may be at least part of the source code file of the Python script, for example, as mentioned above, it is a source code file that has been parsed by the protector itself or modified by the protector user, and the present application does not limit this. The script protection module can be used to call the underlying protector, allowing the underlying protector to use its multiple Python interpreter cores to generate corresponding multiple versions of code objects respectively. These multiple versions of code objects can be encrypted by the script protection module or the underlying protector and used to generate the protected script.

[0050] It should be understood that the protected script no longer contains the aforementioned source code, and the code objects it contains are also encrypted, which can effectively prevent the leakage of important source code or decompilation and modification through code objects, increasing the difficulty of reverse analysis of script logic, so that the protected Python script is still safe and reliable after being deployed on the script user's device.

[0051] It should be noted that, since the embodiments of the present application involve multiple encryption processes, for the sake of distinction, the encryption of the code object is referred to as the first encryption. The first encryption in the embodiments of the present application can be understood as encryption in a broad sense, and can adopt encryption methods in the prior art or other possible implementation methods, which are not limited in the present application.

[0052] In some implementations, the first encrypted versions of the code objects are encrypted using at least one of the following methods:

[0053] (a) Encrypt the strings in the source code;

[0054] (b) Encrypting class attribute names in source code;

[0055] (c) Confusing local variables of functions in source code;

[0056] (d) Dynamically encrypting the bytecode in the code object;

[0057] (e) Name obfuscation of code objects.

[0058] For (a), it mainly refers to encrypting some important plaintext strings in the source code, which can increase the difficulty of reverse analysis.

[0059] For (b), it mainly refers to encrypting part or all of the class attribute names in the source code.

[0060] For (c), it mainly refers to renaming the names of local variables of functions in the source code into meaningless strings, thereby achieving obfuscation and preventing the logic of the source code from being inferred.

[0061] For (d), it mainly refers to encrypting the bytecode in the code object, and then decrypting it in real time only when the code object needs to be executed, and then re-encrypting it after execution, so as to prevent the protected script from being transferred out of the code object from the memory at one time.

[0062] For (e), it mainly refers to renaming the name of the code object to achieve obfuscation and prevent the inference of the meaning of the code object and the logic of the source code.

[0063] Optionally, when at least one of (a), (b) and (c) is adopted, the protector is used to modify the source code according to the encryption method, and to add stub marks corresponding to the encryption method before and after the modified source code statements.

[0064] It should be noted that the present embodiment does not limit the order of the steps of modifying the source code and adding the stub flag. Adding the corresponding stub flag can facilitate the Python underlying protector to identify and process it, and can also serve as an identifier for subsequent decryption. For example, see Figure 4 The aforementioned encryption and pile mark adding steps can be implemented by the processing module in the protector.

[0065] It should also be noted that for some encryption methods, such as item (c), only the name of the local variable is renamed, and the code logic is not changed. The obfuscated code does not need to be deobfuscated when it is executed, so the step of adding the corresponding stub flag can be omitted.

[0066] Optionally, when at least one of (d) and (e) is adopted, the multiple versions of the code objects generated by the underlying protector can be encrypted respectively according to the encryption method. The encryption process can be implemented by the underlying protector or by the protector. For example, see Figure 4 , the aforementioned encryption process can be implemented by the generation module in the protector.

[0067] Optionally, when (d) is adopted, the encrypted code object also includes a pile flag corresponding to the encryption method of (d).

[0068] It should be understood that after the encryption is performed using the aforementioned first encryption method, decryption needs to be performed accordingly when the protected script is subsequently run. The corresponding decryption function can be implemented by the runtime library in the runtime library package, such as Figure 4 As shown, it can also be implemented by an independent decryption module, such as Figure 3As shown, this application is not limited to this.

[0069] The local program protection module is used to generate a runtime library package corresponding to the protected script, and the runtime library package is used to support the operation of the protected script, including decrypting the encrypted code object, such as Figure 2 The virbox_pyruntime package in the example. It is understandable that the runtime library package includes one or more runtime libraries for supporting the execution of the post-protection script. Exemplarily, when the Python interpreter adopts Cpython, the runtime library in the runtime library package can be a Python C extension runtime library.

[0070] In some implementations, the runtime library may include a decryption function corresponding to the encryption method used by the first encryption, such as a decryption function for implementing string decryption, a decryption function for implementing class attribute name decryption, a decryption function for implementing bytecode decryption, an encryption function for implementing bytecode encryption, etc. Optionally, the decryption function may also include a corresponding function for deobfuscation. It is understandable that for some obfuscation methods (such as an obfuscation method that only renames the name), the readability of the code is worse, but the code logic is not changed. The obfuscated code does not need to be deobfuscated when it is executed, so the runtime library may not need to include a corresponding function for deobfuscation.

[0071] The runtime library package also includes a first file, which is used to find a code object that matches the version of the Python interpreter that runs the protected script from the aforementioned multiple versions of code objects. The first file can be in the form of a function, such as Figure 2 The Virbox function in the example may also be implemented in other possible forms, which are not limited in the present application. It should be understood that the first file may also have other possible functions, such as being used to execute a post-protection script.

[0072] In this way, no matter which version of Python interpreter is installed on the device 3 of the script user, as long as it is within the range of the multiple versions described by the aforementioned multiple versions of the Python interpreter core, cross-version operation can be achieved, which is more convenient for script developers and script users, reducing the limitations of use. For script developers, it is not necessary to protect Python scripts multiple times because of the different interpreter versions on the devices of the script users. For script users, it is not required to install a specific version of Python interpreter on the devices they use, and even if they subsequently change devices and replace different versions of Python interpreters, it does not affect their normal use of the protected script.

[0073] See also Figure 3 and Figure 4In some possible implementations, the protection tool also includes runtime libraries corresponding to multiple system architectures. These runtime libraries can be carried in the protector or packaged into files independent of the protector, which is not limited in this application.

[0074] The system architecture includes an operating system and a hardware architecture. The operating system may exemplarily include Windows, Linux, macOS, Darwin, etc., and the hardware architecture may exemplarily include x86, x64, arm32, arm64, etc. The aforementioned multiple system architectures may exemplarily include one or more of the following: windows-x64, windows-x86, linux-x64, linux-x86, linux-arm, linux-aarch64, Darwin-x64, macOS-X64, macOS-arm64.

[0075] The runtime library is closely related to the system architecture. Different system architectures require corresponding runtime libraries to correctly interpret and execute Python scripts. In this solution, the runtime libraries corresponding to multiple system architectures are carried in the protection tool so that when the protector is used to protect Python scripts, they can be used by the local program protection module to generate runtime library packages.

[0076] It is understandable that the runtime library contained in the runtime library package may be part or all of the runtime library carried in the protector, or it may be a file after some processing of the runtime library carried in the protector. This may be different due to the specific Python script to be protected, the specific protection requirements and the processing steps, etc., but it does not affect the realization of cross-version, cross-platform and other effects in the embodiments of the present application. Exemplarily, the protector carries the most complete runtime library corresponding to each system architecture, including runtime library a for implementing string / class attribute name decryption, runtime library b for implementing bytecode encryption / decryption, etc. For a certain Python script, the encryption method selected by the user during protection includes dynamic encryption of bytecode, but does not include encryption of string and class attribute names. Then the runtime library package corresponding to the protected Python script may not contain runtime library a corresponding to each system architecture.

[0077] The runtime library package also includes a second file, which is used to search the runtime library package for a runtime library that is compatible with the system architecture of the device running the protected script. The second file can be in any possible implementation form, such as Figure 3 The "__init__.py" file in the example is not limited in this application.

[0078] Exemplarily, the structure of the generated virbox_pyruntime package may be presented as the following structure.

[0079]

[0080] like Figure 1 The existing protector shown in the figure only contains the runtime library that can be run by the current system architecture (that is, the system architecture of the device 2 of the protector user), which limits the use of the script user. However, by adopting the scheme in the embodiment of the present application, the device 3 of the script user can realize cross-platform operation regardless of the system architecture, as long as it is within the system architecture range corresponding to the runtime library provided by the aforementioned protection tool, which is more convenient for script developers and script users. In other words, by adopting such an implementation method, the protected script is not only compatible with multiple versions of Python interpreters, but also supports cross-platform operation, which further improves the convenience for script developers and script users and reduces the limitations of use.

[0081] Optionally, in some implementations, the runtime libraries corresponding to the multiple system architectures in the protector are encrypted. For the sake of distinction, the encryption of these runtime libraries is referred to as the second encryption. When the protector is used to protect a Python script, the runtime libraries can be decrypted in a second manner corresponding to the second encryption, such as Figure 4 As shown in the example, in this way, the local program protection module can generate a runtime library package corresponding to the Python script based on the runtime libraries corresponding to the decrypted multiple system architectures. After the runtime library package is generated, the decrypted runtime libraries can be re-encrypted for the second time.

[0082] The runtime library in the existing protector has no self-protection, and it is easy to analyze some of the encryption algorithms and write decompiled scripts, or analyze its principles and logic through dynamic and static analysis tools such as IDA and x64dbg. In this way, relying on the script content after protection and repairing the code object, a pyc file that can be independently executed without relying on the runtime library of the protector can be generated, and finally the script before protection can be decompiled. The aforementioned implementation method of the embodiment of the present application can effectively self-protect the runtime library provided by the protector, thereby further improving the security of the script after protection.

[0083] See also Figure 3In some possible implementations, the Python extension package may further include an operating environment file, wherein the operating environment file includes an environment required to run the script protection module. When the script protection module is implemented using the Python language, the operating environment file may use any possible version of the Python environment, such as the Python 3.8 environment.

[0084] By carrying the operating environment file in the Python extension package, the protector does not need to rely on the Python environment in the device 2 of the protector user when running, and the protector user does not need to download and deploy a specific Python environment on his own device. For example, for a Python script developer, if he uses Python 3.11 for development, the Python 3.11 environment is deployed on his device, which is inconsistent with the Python 3.8 environment required for the protector to run; for another example, for a Python script delivery person, since he may not have or need professional knowledge related to the development and deployment environment, the Python environment may not be deployed on his device. However, by adopting the method of the embodiment of the present application, even if the Python environment such as the Python interpreter is not deployed in the device 2, or the deployed Python environment is inconsistent with the environment required for the operation of the protector itself, the protector can still run normally to protect the Python script, which further improves the convenience of the protector user and reduces the limitations of the use of the protector.

[0085] Optionally, the operating environment file may not be a complete Python environment, but may only include the dependency libraries necessary for running the protector. Generally speaking, a complete Python environment includes relatively bloated dependency libraries, including standard libraries and / or third-party libraries, and some may also include development tools, virtual environments, and some possible other tools and resources. However, after the modification of the environment operating file, the dependency libraries necessary for running the protector are smaller than those of the complete Python environment.

[0086] Optionally, the operating environment file can be a compiled and compressed file. Exemplarily, when Python 3.8 is used as the operating environment of the protector, Python 3.8 can be used to compile the standard library into a pyc module and packaged into a compressed package, such as a zip compressed package. Python supports loading pyc modules from compressed packages such as zip, so this method can reduce the size of the Python extension package as much as possible without affecting the normal loading of the environment operating file in the extension package by the protector.

[0087] It should be noted that when the protector developer delivers the Python extension package and the protector to the protector user, the developer may deliver only the protector, and the protector user may obtain the Python extension package through the Internet or other means when the protector user needs to use the protector. This application does not limit this.

[0088] Optionally, an operation control may be provided on the user interface of the protector. When the protector receives a preset operation of the operation control by the protector user, the Python extension package can be obtained and installed. Exemplarily, the protector is also used to: search for the corresponding Python extension package, and display operation instruction information when the Python extension package cannot be found; in response to the preset operation performed by the user on the operation control based on the operation instruction information, the Python extension package is obtained from a preset address and installed. By operating the operation control on the user interface of the protector, the Python extension package can be obtained and installed with one click, making the operation of protecting the script more convenient and friendly.

[0089] In some implementations, the protector in the embodiments of the present application may be protected by another protection tool, such as a shell tool Virbox Protector, etc., so as to improve the security of the protection tool itself, which is also one of the guarantees for improving the security of the protected Python script.

[0090] In other implementations, since the purpose of the protection tool is to protect programs developed in Python, when Python is used to develop a script protection module, a protector can be used for self-protection, thereby improving the security of the protection tool itself.

[0091] For ease of explanation, the source code form of the script protection module developed by the protector developer can be called the original protection module. The original protection module is implemented in Python language. The protector developer can copy a copy of the protector in source code form, which also has the function of protecting Python scripts. By using the copy to protect the original protection module in the protector, the protected data, that is, the script protection module, can be obtained. The script protection module is used to replace the original protection module in the source code form in the original protector, thereby obtaining a self-protected protector. In this way, the protector delivered by the protector developer to the protector user does not contain the source code of the script protection module.

[0092] It should be noted that when using a protector for self-protection, the process can be similar to the process of using a protector to protect other Python scripts, or it can be slightly different. For example, when the process is similar, the self-protection process also includes the steps of generating multiple versions of code objects corresponding to the original protection module and generating a script protection module. For another example, when the process is different, since the version in the operating environment file can be determined, it can be set that only the code object of the version consistent with the version in the operating environment file is generated during the self-protection process, and the protected data is generated according to the code object of this version.

[0093] It should also be noted that, when the aforementioned self-protection scheme is adopted, a runtime library module may be built into the protector. The role of the runtime library module is similar to the role of the runtime library package on the post-protection script, and is mainly used to support the operation of the script protection module obtained after self-protection. The runtime library module may include a third file, and the third file is mainly used to execute the script protection module obtained after self-protection. The runtime library contained in the runtime library module may be the same as the runtime library used to generate the runtime library package, or a part of it. In other words, the runtime library provided by the protection tool, such as a runtime library that can run under multiple system architectures, can be used to support the operation of the self-protection protector, and can also be used to support the generation of a runtime library package corresponding to the post-protection script.

[0094] In some implementations, the protector can be jointly developed in two languages: the script protection module / the original protection module can be implemented in Python, and the other parts can be implemented in the second language.

[0095] The second language can be illustratively C language, JAVA and other possible languages. Compared with other languages, the protector developed in C language can be directly executed on the device of the protector user without downloading the interpreter corresponding to the second language (for example, if JAVA is used, the JAVA interpreter needs to be downloaded). Exemplarily, when the second language is C language, the protected data can be written into a C language header file, and the protector provides C API and built-in runtime library modules through the Python interpreter to execute the script protection module obtained through self-protection.

[0096] Exemplarily, the local program protection module can be implemented in C language, which can be recognized and loaded by the operating system for execution, and the program instruction set can also be directly recognized and executed by the CPU. The local program protection module can include a native program protection function encapsulated in C language, so that Python code (such as a script protection module implemented in Python language or a module in the script protection module) can directly call the function to protect the runtime library package, or protect the runtime library contained therein.

[0097] Optionally, the part of the protector implemented in Python language can adopt any of the aforementioned forms of self-protection, and in order to further improve the overall security of the protector, for the sensitive functions in this part implemented in the second language, other encryption tools, such as Virbox Protector, etc., can also be used for self-protection. Exemplarily, sensitive functions can be functions involving encryption or decryption, such as functions related to the second decryption, etc. Sensitive functions can also be functions involving license verification, such as protector developers can issue a license to protector users to control the time or number of times the protector user uses the protector, etc. When the protector user needs to perform a license verification before using it, the function used to implement the license verification can also be protected by an encryption tool as a sensitive function. Sensitive functions can also be some local codes of the protector developer's device. It can be understood that sensitive functions can also be codes that meet one or more of the aforementioned conditions at the same time.

[0098] See also Figure 4 In some implementations, the script protection module may include a parsing module for parsing the source code of the Python script to be protected.

[0099] The Python script to be protected may need to import a function module customized by the script developer (referred to as a custom module), and may also include a function that calls the custom module.

[0100] Optionally, the protector may also provide one or more functions of module inspection and function inspection.

[0101] When the protector user selects module inspection, the generated runtime library package may include a corresponding runtime library or inspection module for module inspection. Optionally, the parsing module may also be used to analyze whether the imported custom module is included. When the custom module is analyzed, the processing module is also used to add corresponding stub marks for module inspection before and after the module import statement. In this way, the generated post-protection script will call the corresponding runtime library or inspection module to check whether the imported custom module has been protected by the protector according to the corresponding stub mark during runtime. Only the protected one will be allowed to be imported, and the unprotected one will be prohibited from being imported to prevent it from being replaced.

[0102] When the user of the protector selects function inspection, the generated runtime library package can include the corresponding runtime library or inspection module for function inspection. Optionally, the parsing module can also be used to analyze whether to include the function of calling the user-defined module. When the function of calling the user-defined module is analyzed, the processing module is also used to add the corresponding pile mark for function inspection before and after the function call statement. In this way, the generated post-protection script can call the corresponding runtime library or inspection module to check whether the function has been protected by the protector according to the corresponding pile mark during runtime. Only the protected ones are allowed to execute the call to prevent these functions from being dynamically replaced in the memory.

[0103] It should be noted that the aforementioned pile flags used for subsequent decryption can be called decryption piles; different from the decryption piles, the pile flags added here for function verification and module verification can be called verification piles.

[0104] Optionally, when the underlying protector is implemented in a second language, the script protection module may further include an underlying protector interaction module, which is implemented in Python and is used to implement cross-language calls to the underlying protector, so that the underlying protector generates different versions of code objects based on the code processed by the processing module, and processes the code objects using, for example, the aforementioned (d), (e) or other possible encryption or processing methods, and the processed code objects are then returned to the generation module in the protector for generating a post-protection script.

[0105] Optionally, the generation module is further used to generate a protected script according to a preset template and various versions of code objects or processed code objects. For example, the preset template can be a py script statement, and the encrypted code object is embedded into the preset template to obtain a protected script C, which can have the same extension as the script A before protection, both of which are .py. Figure 4 shown.

[0106] Optionally, the generating module is further configured to call the local program protection module to generate the runtime library package.

[0107] Optionally, the script protection module can also be used to protect the protected script from tampering. Exemplarily, a signature value or hash value can be calculated for the protected script and carried in the protected script or runtime library package. When the protected script is run, the protected script can be verified based on the signature value or hash value. If the protected script has been changed, it cannot pass the verification. In this way, it is possible to prevent other codes from being added to the protected script, thereby damaging the original code logic.

[0108] The embodiment of the present application also provides a method for protecting a Python script, and the execution subject of the method can be any of the possible protectors described above or the electronic device where the protector is located. The following takes the process of a protector located in the device 2 of the protector user protecting a Python script as an example to further illustrate the protection method.

[0109] See also Figure 5 , the method may include:

[0110] S110, the protector receives the Python script to be protected;

[0111] S120, the script protection module of the protector calls the underlying protector in the Python extension package, so that the underlying protector uses the multiple versions of Python interpreter cores included to generate multiple versions of code objects corresponding to the source code of the Python script respectively;

[0112] S130, the script protection module of the protector generates a protected script, wherein the protected script includes the encrypted code objects of the multiple versions;

[0113] S140: The local program protection module of the protector generates a runtime library package corresponding to the protected script, where the runtime library package is used to support the running of the protected script.

[0114] The runtime library package also includes a first file, which is used to search for a code object that matches the version of the Python interpreter that runs the protected script from the multiple versions of code objects.

[0115] For the implementation methods of the script protection module, Python extension package, underlying protector, Python interpreter core, code object, local program protection module, runtime library package, first file, etc., which have been previously introduced in the protection tool embodiments, please refer to the aforementioned relevant description paragraphs and will not be repeated here.

[0116] Optionally, before step S110, the following may be included: modifying the Python interpreter loading path to the Python extension package, so that the protector depends on the runtime environment file in the extension package, rather than the Python environment deployed on the device 2; registering a protector, registering the protector to the Python execution environment, and adding a local program protection module to the protector; registering the built-in runtime library module, so that the self-protected script protection module can be executed. When two languages ​​are used for joint development, these steps can be implemented by a second language, such as C language.

[0117] Optionally, after step S110, the following steps may also be included:

[0118] S150: The protector obtains at least one processing method specified by the user, which may exemplarily include one or more of the aforementioned first encryption methods, and may also include one or more of module verification and function verification.

[0119] S160, the script protection module parses the source code of the Python script and processes the source code according to a processing method specified by the user.

[0120] Exemplarily, step S160 includes: S161, when the user selects module inspection and function inspection, analyzing whether the source code includes an imported custom module and whether it includes a function that calls a custom module; if included, adding corresponding inspection stubs before and after the module import statement and function call statement of the source code.

[0121] Also illustratively, step S160 includes: S162, when the user chooses to perform at least one first encryption process on the source code, respectively add corresponding decryption stubs before and after the statements to be processed, and modify the statements to be processed.

[0122] Optionally, step S140 includes:

[0123] S141, the local program protection module imports the runtime library obtained after the second decryption, and the runtime library may exemplarily include runtime libraries corresponding to multiple system architectures;

[0124] S142, generating a runtime library package corresponding to the post-protection script; the runtime library may exemplarily include runtime libraries that can be run under multiple system architectures, including runtime libraries that can be run under multiple system architectures and correspond to at least one processing method specified by the user;

[0125] S142, re-encrypting the runtime library obtained after the second decryption.

[0126] The embodiment of the present application also provides a method for running a protected Python script, the execution subject of which can be a Python interpreter or an electronic device equipped with a Python interpreter. The following takes the Python interpreter in the device 3 of the script user as an example to further illustrate the running method.

[0127] The protected Python script includes the protected script and the corresponding runtime library package. Figure 6 , the method comprising:

[0128] S210, loading runtime library package;

[0129] S220, calling the first file in the runtime library package to search for a code object that matches the version of the Python interpreter from multiple versions of code objects in the protected script;

[0130] S230, based on the runtime library package, decrypt and execute the found code object.

[0131] For the implementation methods of the runtime library package, the first file, the version of the Python interpreter, the code object, etc., which have been previously introduced in the protection tool embodiment, please refer to the aforementioned related description paragraphs and will not be repeated here.

[0132] Optionally, before step S230, the method may further include: S240, calling a second file in the runtime library package to search for a runtime library that is compatible with the system architecture of the device where the Python interpreter is located from the runtime libraries that can be run under the multiple system architectures. The second file can be used to control which platform's runtime library in the runtime library package is imported during operation. Exemplarily, this step may include: obtaining the system architecture information of the current device (i.e., device 3), and searching the runtime library package for a runtime library that matches the system architecture information of the current device.

[0133] In the case where the encryption method of the code object includes the aforementioned (d), optionally, step S230 may include:

[0134] S231, calling a decryption module or a runtime library in the runtime library package for implementing bytecode decryption to decrypt the bytecode;

[0135] S232, executing the decrypted bytecode;

[0136] S233, calling the encryption module in the runtime library package for implementing bytecode encryption or the runtime library encryption bytecode.

[0137] Here, the encryption and decryption of the bytecode are corresponding, and the modules or runtime libraries for implementing the decryption and decryption can be two corresponding modules or runtime libraries, or can be implemented by the same module or runtime library, and this application does not limit this. In this way, the encrypted code object is decrypted and executed at the same time, and is re-encrypted after the execution is completed, thereby avoiding the bytecode of the script from being dumped out of the memory of the device 3 at one time.

[0138] Optionally, the step S230 may include: S234, in the case where it is detected that the code object includes a decryption stub, calling a decryption module or a runtime library corresponding to the decryption stub to perform decryption.

[0139] For example, when a decryption stub corresponding to the encryption method (a) of the aforementioned code object is detected, a decryption module or a runtime library included in the runtime library package for implementing string decryption is called to decrypt the string.

[0140] For another example, when a decryption stub corresponding to the encryption method (b) of the aforementioned code object is detected, a decryption module or runtime library included in the runtime library package for implementing class attribute name decryption is called to decrypt the class attribute name.

[0141] Optionally, the step of S230 may include: S235, when it is detected that the code object includes a check stub, calling a check module or a runtime library corresponding to the check stub to perform a check to determine whether the checked object is protected by a protector.

[0142] For example, when a check stub corresponding to a module check is detected, a module or a runtime library for implementing module check contained in the runtime library package is called to check whether the imported custom module has been protected by the protector. For another example, when a check stub corresponding to a function check is detected, a module or a runtime library for implementing function check contained in the runtime library package is called to check whether the function calling the custom module has been protected by the protector. Only protected custom modules or functions calling custom modules are allowed to be imported or executed.

[0143] An embodiment of the present invention provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned protection method or operation method is implemented.

[0144] It should be understood that in some implementations, when implementing the above protection method, the specific product embodied by the instructions in the above computer-readable storage medium may be the aforementioned protector, or a protection tool including the protector and a Python extension package.

[0145] An embodiment of the present invention provides a computer program product, including computer instructions, which implement the above-mentioned protection method or operation method when executed by a processor.

[0146] It should be understood that in some implementations, when implementing the above protection method, the specific product embodied by the above computer program product may be the aforementioned protector, or a protection tool including the protector and a Python extension package.

[0147] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed tools and methods can be implemented in other ways. For example, the tool embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0148] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0150] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0151] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0152] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A Python script protection tool, characterized in that: include: A Python extension package, wherein the underlying protector in the Python extension package includes multiple versions of Python interpreter cores, and the multiple versions of Python interpreter cores are used to generate corresponding multiple versions of code objects; A protector, the protector comprising a script protection module and a local program protection module, wherein: The script protection module is used to call the underlying protector to generate multiple versions of code objects corresponding to the source code of the Python script to be protected, and generate a protected script, wherein the protected script includes the encrypted multiple versions of the code objects; The local program protection module is used to generate a runtime library package corresponding to the protected script, and the runtime library package is used to support the running of the protected script. The runtime library package includes a first file, and the first file is used to search for a code object that matches the version of the Python interpreter that runs the protected script from the multiple versions of code objects.

2. The protection tool according to claim 1, characterized in that: The protection tool also includes runtime libraries corresponding to multiple system architectures, which can be used by the local program protection module to generate runtime library packages; The runtime library package also includes a second file, and the second file is used to search the runtime library package for a runtime library that is compatible with the system architecture of the device running the protected script.

3. The protection tool according to any one of claims 1 to 2, characterized in that: The Python extension package also includes an operating environment file, and the operating environment file includes an environment required to run the script protection module.

4. The protection tool according to claim 3, characterized in that: The operating environment file is a compiled and compressed file; and / or, the operating environment file only includes the dependent library required to run the script protection module; and / or, the script protection module is implemented in Python language, and the operating environment file is a Python environment.

5. The protection tool according to any one of claims 1 to 2, characterized in that: The source code form of the script protection module is an original protection module, the original protection module is implemented in Python language, and the script protection module is obtained through copy protection of the protector; The protector has a built-in runtime library module for supporting the operation of the script protection module.

6. The protection tool according to claim 5, characterized in that: The sensitive function included in the protector is protected by an encryption tool, wherein the sensitive function is a function implemented in a second language different from Python and involves decryption / license verification; and / or, The local program protection module is implemented in the second language and can be called by the script protection module to protect the runtime library package.

7. The protection tool according to any one of claims 1 to 2, characterized in that: The encrypted versions of the code objects may be encrypted using at least one of the following encryption methods: (a) Encrypt the strings in the source code; (b) Encrypting class attribute names in source code; (c) Confusing local variables of functions in source code; (d) Dynamically encrypting the bytecode in the code object; (e) Name obfuscation of code objects.

8. The protection tool according to claim 7, characterized in that: The script protection module comprises: a processing module, in the case of adopting at least one of (a) and (b), the processing module is used to modify the source code according to the encryption method, and to add stub marks corresponding to the encryption method before and after the modified source code statements; and / or, The script protection module includes: a generation module, in the case of adopting (d), the generation module is used to encrypt the multiple versions of code objects generated by the underlying protector according to the encryption method; The runtime library package includes a decryption module or a runtime library corresponding to the adopted encryption method.

9. A method for protecting a Python script, characterized in that: include: The protector receives the Python script to be protected; The script protection module of the protector calls the underlying protector in the Python extension package, so that the underlying protector uses the multiple versions of Python interpreter cores included to generate multiple versions of code objects corresponding to the source code of the Python script respectively; The script protection module of the protector generates a post-protection script, wherein the post-protection script includes the encrypted code objects of the multiple versions; The local program protection module of the protector generates a runtime library package corresponding to the protected script, and the runtime library package is used to support the running of the protected script; the runtime library package also includes a first file, and the first file is used to search for a code object that matches the version of the Python interpreter that runs the protected script from the multiple versions of code objects.

10. A method for running a protected Python script, characterized in that: The protected Python script includes a protected script and a runtime library package corresponding to the protected script; wherein the protected script includes multiple versions of encrypted code objects, and the runtime library package is used to support the running of the protected script; The method is run by the Python interpreter and includes: Loading the runtime library package; Calling the first file in the runtime library package to search for a code object that matches the version of the Python interpreter from multiple versions of code objects in the protected script; Based on the runtime library package, the found code object is decrypted and executed.

11. The method according to claim 10, characterized in that The runtime library package includes runtime libraries that can be run under multiple system architectures; The method further comprises: The second file in the runtime library package is called to search for a runtime library that is compatible with the system architecture of the device where the Python interpreter is located from the runtime libraries that can be run under the multiple system architectures.

12. The method according to any one of claims 10 to 11, characterized in that: The steps of decrypting and executing the found code object based on the runtime library package include: Calling a decryption module or runtime library in the runtime library package for implementing bytecode decryption to decrypt the bytecode in the code object; Execute the decrypted bytecode; An encryption module or a runtime library encryption bytecode for implementing bytecode encryption in the runtime library package is called.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 9 to 12 is implemented.

14. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the method described in any one of claims 9 to 12 is implemented.

Images