Hybrid CLR instruction out-of-order protection method and system, electronic equipment and storage medium

Abstract

The invention provides a Hybrid CLR instruction out-of-order protection method and system, electronic equipment and a storage medium. The method comprises the following steps: acquiring a source code of a Hybrid CLR interpreter from Unity; wherein the source code comprises a byte code file; extracting a to-be-modified instruction from the byte code file, and disordering the to-be-modified instruction; replacing the to-be-modified instruction in the byte code file with the disordered to-be-modified instruction to realize disorder of the byte code file to obtain a reinforced Hybrid CLR interpreter; obtaining a dynamic link library file, and reinforcing the dynamic link library file to obtain a reinforced dynamic link library file; and executing the reinforced dynamic link library file by reinforcing the Hybrid CLR interpreter, so as to realize the disorder of the Hybrid CLR instruction.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a HybridCLR instruction out-of-order protection method, system, electronic device and storage medium. Background Art

[0002] In the field of game development and real-time applications, Unity is highly praised for its powerful 3D rendering capabilities, rich resource libraries, and cross-platform support. However, for developers who need more complex logic or use the .NET ecosystem, the native Unity C# scripting language may be slightly insufficient, so how to introduce the powerful functions of .NET Framework or .NET Core into Unity so that developers can fully utilize the advantages of the .NET ecosystem is an urgent problem that needs to be solved.

[0003] In the prior art, the introduction of HybridCLR enables developers to run the complete .NET framework (or .NET Core) in Unity. That is to say, the introduction of HybridCLR enables developers to use advanced .NET class libraries, ASPNET services, and even machine learning frameworks in Uniy, greatly expanding the development possibilities. Among them, HybridCLR compiles C# scripts into dynamic link library files DLL and loads them into memory to achieve hot update function; when the game script is updated, HybridCLR automatically recompiles the new DLL and loads it into memory, thereby achieving hot update, which not only improves the game development efficiency, but also allows the game to update logic at runtime without the user having to re-download the entire game; Hot Update Files refers to dynamic link library files that can be dynamically updated when the game or application is running.

[0004] However, the dynamic link library files used by the hot update function of HyBridCLR introduced in game development are not protected. Attackers can use open source tools to use the dynamic link library files to restore the game script source code, which can easily lead to the leakage of game scripts.

[0005] Therefore, how to provide a HyBridCLR instruction out-of-order protection method to avoid the leakage of game scripts is a problem that urgently needs to be solved in this application. Summary of the invention

[0006] In view of this, the present application provides a HybridCLR instruction out-of-order protection method, system, electronic device and storage medium, so as to avoid modifying the source code and preventing the leakage of the game script when implementing the HyBridCLR instruction out-of-order protection.

[0007] A first aspect of the present application provides a HybridCLR instruction out-of-order protection method, the method comprising:

[0008] Obtain source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file;

[0009] Extracting instructions to be modified from the bytecode file, and shuffling the instructions to be modified;

[0010] Replacing the to-be-modified instructions in the bytecode file with the to-be-modified instructions after the disorder, so as to achieve disorder of the bytecode file and obtain a reinforced HybridCLR interpreter;

[0011] Acquire a dynamic link library file, and reinforce the dynamic link library file to obtain a reinforced dynamic link library file;

[0012] The reinforced dynamic link library file is executed by the reinforced HybridCLR interpreter to achieve HybridCLR instruction disorder.

[0013] Optionally, extracting the to-be-modified instructions from the bytecode file and shuffling the to-be-modified instructions includes:

[0014] Traversing the bytecode file to identify marked instructions from the bytecode file, and determining the marked instructions as instructions to be modified;

[0015] A random number is used to generate a shuffled array having the same size as the instruction to be modified, and the shuffled array is used to shuffle the instruction to be modified.

[0016] Optionally, the obtaining a dynamic link library file and reinforcing the dynamic link library file to obtain a reinforced dynamic link library file includes:

[0017] Acquire a dynamic link library file, and determine a metadata table structure from the dynamic link library file;

[0018] Determining a function table structure from the dynamic link library according to the metadata table structure; wherein the function table structure includes function information of a plurality of functions;

[0019] The bytecodes in the function code body of each function in the dynamic link library file are shuffled using the function information of each function to obtain a reinforced dynamic link library file.

[0020] Optionally, the obtaining of a dynamic link library file and determining a metadata table structure from the dynamic link library file includes:

[0021] Acquire a dynamic link library file, and parse the dynamic link library file to read a header structure of the dynamic link library file;

[0022] Acquire the offset position of the metadata table structure in the dynamic link library file from the header structure;

[0023] The metadata table structure is determined from the dynamic link library file according to the offset position, and the metadata table structure is acquired.

[0024] Optionally, determining a function table structure from the dynamic link library according to the metadata table structure includes:

[0025] Traversing the metadata table structure to determine the location information of the function table structure from the metadata table structure;

[0026] The function table structure is obtained from the dynamic link library according to the location information of the function table structure.

[0027] A second aspect of the present application provides a HybridCLR instruction out-of-order protection system, the system comprising:

[0028] A source code acquisition unit, used to acquire the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file;

[0029] A first scrambling unit, used for extracting instructions to be modified from the bytecode file and scrambling the instructions to be modified;

[0030] A first replacement unit is used to replace the to-be-modified instructions in the bytecode file with the to-be-modified instructions after being disordered, so as to achieve disordering of the bytecode file and obtain a reinforced HybridCLR interpreter;

[0031] A reinforcement unit, used for obtaining a dynamic link library file and reinforcing the dynamic link library file to obtain a reinforced dynamic link library file;

[0032] The execution unit is used to execute the hardened dynamic link library file through the hardened HybridCLR interpreter to achieve HybridCLR instruction disorder.

[0033] Optionally, the first out-of-order unit includes:

[0034] an identification unit, configured to traverse the bytecode file to identify marked instructions from the bytecode file, and determine the marked instructions as instructions to be modified;

[0035] The first scrambling sub-unit is used to use random numbers to generate a scrambled array with the same size as the instruction to be modified, and use the scrambled array to scramble the instruction to be modified.

[0036] Optionally, the reinforcement unit includes:

[0037] A first determining unit is used to obtain a dynamic link library file and determine a metadata table structure from the dynamic link library file;

[0038] A second determining unit, configured to determine a function table structure from the dynamic link library according to the metadata table structure; wherein the function table structure includes function information of a plurality of functions;

[0039] The second scrambling unit is used to scramble the bytecodes in the function code body of each function in the dynamic link library file by using the function information of each function to obtain a reinforced dynamic link library file.

[0040] The third aspect of the present application provides an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement a HybridCLR instruction out-of-order protection method provided in the first aspect of the present application.

[0041] The fourth aspect of the present application provides a storage medium, in which computer executable instructions are stored. The computer executable instructions are used to execute a HybridCLR instruction out-of-order protection method provided in the first aspect of the present application.

[0042] The present application provides a HybridCLR instruction disorder protection method, system, electronic device and storage medium, which obtains the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file; extracts the instructions to be modified from the bytecode file, and shuffles the instructions to be modified; replaces the instructions to be modified in the bytecode file with the shuffled instructions to achieve the disorder of the bytecode file, and obtains a reinforced HybridCLR interpreter; obtains a dynamic link library file, and reinforces the dynamic link library file to obtain a reinforced dynamic link library file; executes the reinforced dynamic link library file through the reinforced HybridCLR interpreter to achieve the HybridCLR instruction disorder. It can be seen that the technical solution provided by the present application is to obtain a reinforced HybridCLR interpreter by scrambling the bytecode file of the source code of the HybridCLR interpreter, and to obtain a reinforced dynamic link library file by scrambling the dynamic link library file, and finally to execute the reinforced dynamic link library file using the reinforced HybridCLR interpreter. At this time, the dynamic link library file used by the hot update function of HyBridCLR has been modified. Even if the attacker uses open source tools, he cannot use the modified dynamic link library file to restore the script source code, so that the game script is no longer easily reversed to leak the source code, which greatly increases the threshold for attackers. In other words, the attacker cannot use open source tools to get the original dynamic link library file, and thus cannot restore the game script. Not only does it increase the attacker's time, energy and cost, but also by modifying the dynamic link library file to achieve HybridCLR instruction scrambling, it can also effectively avoid modification of the source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0044] Figure 1 A flowchart of a HybridCLR instruction out-of-order protection method provided in an embodiment of the present application;

[0045] Figure 2 An example diagram of a HybridCLR instruction out-of-order protection method provided in an embodiment of the present application;

[0046] Figure 3 A schematic diagram of the structure of a HybridCLR instruction out-of-order protection system provided in an embodiment of the present application;

[0047] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0050] From the above background technology, it can be known that the leakage of game scripts can be avoided by protecting HyBridCLR from instruction disorder; however, if HyBridCLR is directly protected from instruction disorder, the problem of source code modification will be involved; therefore, how to implement HyBridCLR instruction disorder while achieving no source code modification and being compatible with the hot update function of HyBridCLR and integrating it into the game is a problem that urgently needs to be solved in this application.

[0051] The applicant has found through research that the dynamic link library file (hot update file) used by the hot update function of HyBridCLR introduced in game development is a built binary file. Therefore, by reordering the instructions of the dynamic link library file, not only can the HyBridCLR instruction reorder protection be achieved, but also the source code can be avoided from being modified. It can be seen that how to provide a HyBridCLR instruction reorder protection to achieve instruction reorder protection for HyBridCLR and avoid modifying the source code is a problem that the application urgently needs to solve.

[0052] Therefore, the present application provides a HybridCLR instruction disorder protection method, system, electronic device and storage medium, which obtains a reinforced HybridCLR interpreter by disordering the bytecode file of the source code of the HybridCLR interpreter, and obtains a reinforced dynamic link library file by disordering the dynamic link library file, and finally uses the reinforced HybridCLR interpreter to execute the reinforced dynamic link library file. At this time, the dynamic link library file used by the hot update function of HyBridCLR has been modified. Even if the attacker uses open source tools, he cannot use the modified dynamic link library file to restore the script source code, so that the game script is no longer easily reversed to leak the source code, which greatly increases the threshold for attackers. In other words, the attacker cannot use open source tools to get the original dynamic link library file, and thus cannot restore the game script. Not only does it increase the attacker's time, energy and cost, but also by modifying the dynamic link library file to achieve HybridCLR instruction disorder, it can also effectively avoid modification of the source code.

[0053] See also Figure 1 , shows a flow chart of a HybridCLR instruction out-of-order protection method provided in an embodiment of the present application, and the HybridCLR instruction out-of-order protection method specifically includes the following steps:

[0054] S101: Obtain source code of a HybridCLR interpreter from Unity; wherein the source code includes a bytecode file.

[0055] In the specific process of executing step S101, the source code of the HybridCLR interpreter can be added to the Unity's il2cpp engine in advance. At this time, the HybridCLR interpreter has become a part of the Unity's il2cpp engine; when HybridCLR instruction out-of-order protection is required, the source code of the HybridCLR interpreter can be obtained from the Unity's il2cpp engine.

[0056] It should be noted that the source code of the HybridCLR interpreter includes at least a bytecode file; the bytecode file includes a plurality of instructions; the plurality of instructions includes at least one instruction to be modified that is pre-specified to be modified.

[0057] In some embodiments, after the source code of the HybridCLR interpreter is added to the il2cpp engine of Unity, the instructions required for interpretation and execution in the bytecode file of the source code of the HybridCLR interpreter can be further marked as instructions to be modified; regarding which instructions in the bytecode file need to be marked as instructions to be modified, they can be marked according to actual applications, and are not limited in the embodiments of the present application.

[0058] S102: extracting instructions to be modified from the bytecode file, and reordering the instructions to be modified.

[0059] In the process of specifically executing step S102, corresponding shuffling rules may be pre-set, so that after the source code of the HybridCLR interpreter is obtained, the bytecode files in the source code of the HybridCLR interpreter may be traversed to extract at least one instruction to be modified from the bytecode files, and each instruction to be modified may be shuffled using the pre-set first shuffling rule.

[0060] Optionally, the process of extracting at least one instruction to be modified from the bytecode file and shuffling each instruction to be modified using a preset first shuffling rule can specifically include: traversing the bytecode file to identify marked instructions from the bytecode file, and determining the marked instructions as instructions to be modified; using random numbers to generate a shuffled array of the same size as the instructions to be modified, and using the shuffled array to shuffle the instructions to be modified.

[0061] In an embodiment of the present application, the preset first shuffle rule indicates that a shuffle array of the same size as the instruction to be modified is generated by a random number, and corresponding shuffle operations are performed according to the order of each variable in the generated shuffle array.

[0062] Therefore, in actual application, after extracting the corresponding instructions to be modified from the bytecode file, a random number can be used to generate a random array of the same size as the instructions to be modified according to a preset first random rule, and the order of each bytecode in the instructions to be modified can be replaced according to the order of each variable in the random array, thereby completing the randomization of the instructions to be modified.

[0063] S103: Replace the to-be-modified instructions in the bytecode file with the to-be-modified instructions after the disorder, so as to achieve disorder of the bytecode file and obtain a reinforced HybridCLR interpreter.

[0064] In the process of specifically executing step S103, after scrambling the corresponding instructions to be modified using the scrambled array corresponding to each instruction to be modified, the instructions to be modified in the bytecode file can be further replaced with the corresponding scrambled instructions to be modified to complete the scrambling of the bytecode file of the HybridCLR interpreter, that is, to achieve the reinforcement of the HybridCLR interpreter and obtain a reinforced HybridCLR interpreter.

[0065] It should be noted that since the HybridCLR interpreter is already part of Unity's il2cpp engine, the HybridCLR interpreter can be reinforced by scrambling the bytecode files of the HybridCLR interpreter source code and then regenerating Unity, thus obtaining a reinforced HybridCLR interpreter.

[0066] S104: Acquire a dynamic link library file, and reinforce the dynamic link library file to obtain a reinforced dynamic link library file.

[0067] In the specific process of executing step 104, a dynamic link library file compiled by the C# script through the HybridCLR parser is obtained, and a preset reinforcement tool is called to execute a preset reinforcement command to reinforce the dynamic link library file, thereby obtaining a reinforced dynamic link library file.

[0068] Optionally, a dynamic link library file is obtained and the dynamic link library file is reinforced. The process of obtaining the reinforced dynamic link library file can specifically be: obtaining the dynamic link library file, and determining the metadata table structure from the dynamic link library file; determining the function table structure from the dynamic link library according to the metadata table structure; wherein the function table interface includes function information of multiple functions; and utilizing the function information of each function to shuffle the bytecodes within the function code body of each function in the dynamic link library file to obtain the reinforced dynamic link library file.

[0069] As an implementation method of an embodiment of the present application, the process of obtaining a dynamic link library file and determining a metadata table structure from the dynamic link library file can specifically be: obtaining the dynamic link library file and parsing the dynamic link library file to read the header structure of the dynamic link library file; obtaining the offset position of the metadata table structure in the dynamic link library file from the header structure; determining the metadata table structure from the dynamic link library file according to the offset position, and obtaining the metadata table structure.

[0070] It should be noted that, since the header structure of the dynamic link library file stores information related to each structure in the dynamic link library file, when it is necessary to obtain the corresponding metadata table structure from the dynamic link library file, the offset position of the metadata table structure can be first determined from the corresponding header structure, so as to quickly locate the corresponding metadata table structure from the dynamic link library file according to the determined offset position; compared with directly traversing the dynamic link library file to obtain the corresponding metadata table structure, the corresponding metadata table structure can be quickly and accurately located.

[0071] As an implementation method of an embodiment of the present application, the process of determining the function table structure from the dynamic link library based on the metadata table structure can specifically be: traversing the metadata table structure to determine the location information of the function table structure from the metadata table structure; obtaining the function table structure from the dynamic link library based on the location information of the function table structure.

[0072] In some embodiments, the function table structure includes function information of multiple functions, and the function information of each function includes the function code body position corresponding to each function; therefore, after obtaining the metadata table structure, the function code body corresponding to each function can be quickly located from the dynamic link library file according to the function code body position of each function in the function table structure in the metadata table structure, and the bytecode in the function code body corresponding to each function can be shuffled, so that the dynamic link library file can be shuffled to obtain a reinforced dynamic link library file. Among them, the bytecode corresponding to each function is stored in the function code body of each function.

[0073] It should be noted that the pre-set reinforcement command can be: .\encryptDll.exe.\xxx.dll.\xxx.dll.byte, which can be set according to actual applications and is not limited in this embodiment of the present application.

[0074] In the actual application process, a pre-set reinforcement tool can be called to execute a pre-set reinforcement command to parse the dynamic link library file, so as to read the corresponding header structure from the dynamic link library file; obtain the offset position of the metadata table structure in the dynamic link library file from the header structure; locate the metadata table structure from the dynamic link library file according to the offset position, and extract the metadata table structure; traverse the metadata table structure to determine the position information of the function table structure from the metadata table structure; locate and extract the function table structure from the dynamic link library according to the position information of the function table structure; wherein the function table structure includes function code bodies of multiple functions Position; for each function, obtain the function code body of the function from the dynamic link library file according to the position of the function code body of the function, and generate a random array with the same size of the function code body according to a preset second random rule, so as to use the order of each variable in the generated random array to replace the order of each bytecode in the function code body of the function, so as to complete the randomization of the function code body of the function; finally, use the function code body of each function after randomization to replace the function code body corresponding to each function in the dynamic link library file, so as to complete the randomization of the dynamic link library file, that is, complete the reinforcement of the dynamic link library file, and obtain the reinforced dynamic link library file.

[0075] In an embodiment of the present application, the preset second shuffle rule indicates that a shuffle array with the same size as the function code body is generated by a random number, and corresponding shuffle operations are performed according to the order of each variable in the generated shuffle array.

[0076] It should be noted that the HybridCLR interpreter and the dynamic link library file may be reinforced at the same time, or the HybridCLR interpreter may be reinforced first and then the dynamic link library file may be reinforced, which is not limited in the embodiments of the present application.

[0077] S105: The hardened dynamic link library file is executed by the hardened HybridCLR interpreter to implement the HybridCLR instruction disorder.

[0078] In the specific process of executing step S105, after obtaining the reinforced HybridCLR interpreter and the reinforced dynamic link library file, the reinforced HybridCLR interpreter can be used in Unity to execute the reinforced dynamic link library file to implement HybridCLR instruction disorder protection.

[0079] Specifically, after obtaining the hardened HybridCLR interpreter and the hardened dynamic link library file, rerun Unity so that the hardened HybridCLR interpreter in Unity executes the hardened dynamic link library file according to the disordered bytecode file, thereby realizing the HybridCLR instruction disorder protection, that is, realizing the protection of the dynamic link library file, preventing attackers from using open source tools to use the dynamic link library file to restore the corresponding script source code, thereby avoiding the leakage of the game script.

[0080] The present application provides a HybridCLR instruction disorder protection method, which obtains the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file; extracts the instructions to be modified from the bytecode file, and shuffles the instructions to be modified; replaces the instructions to be modified in the bytecode file with the shuffled instructions to be modified, so as to shuffle the bytecode file and obtain a reinforced HybridCLR interpreter; obtains a dynamic link library file, and reinforces the dynamic link library file to obtain a reinforced dynamic link library file; executes the reinforced dynamic link library file through the reinforced HybridCLR interpreter to achieve HybridCLR instruction disorder. It can be seen that the technical solution provided by the present application is to obtain a reinforced HybridCLR interpreter by scrambling the bytecode file of the source code of the HybridCLR interpreter, and to obtain a reinforced dynamic link library file by scrambling the dynamic link library file, and finally to execute the reinforced dynamic link library file using the reinforced HybridCLR interpreter. At this time, the dynamic link library file used by the hot update function of HyBridCLR has been modified. Even if the attacker uses open source tools, he cannot use the modified dynamic link library file to restore the script source code, so that the game script is no longer easily reversed to leak the source code, which greatly increases the threshold for attackers. In other words, the attacker cannot use open source tools to get the original dynamic link library file, and thus cannot restore the game script. Not only does it increase the attacker's time, energy and cost, but also by modifying the dynamic link library file to achieve HybridCLR instruction scrambling, it can also effectively avoid modification of the source code.

[0081] In order to better understand the HybridCLR instruction out-of-order protection method provided in the embodiment of the present application, it is explained below by way of example.

[0082] For example, see Figure 2 When HybridCLR instruction disorder protection is required, the HybridCLR interpreter source code is obtained from Unity's il2cpp engine, that is, the source code of the HybridCLR interpreter is obtained; after obtaining the source code of the HybridCLR interpreter, the corresponding hardening interpreter operation can be performed, that is, at least one instruction to be modified is extracted from the bytecode file of the obtained source code; for each instruction to be modified, first, a random number is used to generate a disordered array with the same size as the instruction to be modified according to a preset first disorder rule; secondly, the order of each bytecode in the instruction to be modified is replaced according to the order of each variable in the generated disordered array, so as to complete the disorder of the instruction to be modified; finally, the disordered instruction to be modified is used to replace the instruction to be modified in the bytecode file, so as to achieve the disorder of the bytecode file and obtain the hardened HybridCLR interpreter.

[0083] The dynamic link library file is obtained, and a pre-set reinforcement tool is called to execute a pre-set reinforcement command to perform a reinforcement operation on the dynamic link library file, and a corresponding reinforced dynamic link library is obtained, so that the reinforced dynamic link library file is executed by the reinforced HybridCLR interpreter to achieve HybridCLR instruction disorder. Among them, calling a pre-set reinforcement tool to execute a pre-set reinforcement command to perform a reinforcement operation on the dynamic link library file can refer to the content shown under step 104, and this embodiment of the present application will not be repeated here.

[0084] Based on the HybridCLR instruction out-of-order protection method provided in the above embodiment of the present application, accordingly, the embodiment of the present application also provides a HybridCLR instruction out-of-order protection system, such as Figure 3 As shown, the HybridCLR instruction out-of-order protection system includes:

[0085] A source code acquisition unit 31 is used to acquire the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file;

[0086] A first de-ordering unit 32 is used to extract instructions to be modified from the bytecode file and de-order the instructions to be modified;

[0087] A first replacement unit 33 is used to replace the to-be-modified instructions in the bytecode file with the to-be-modified instructions after the disorder, so as to achieve disorder of the bytecode file and obtain a reinforced HybridCLR interpreter;

[0088] The reinforcement unit 34 is used to obtain a dynamic link library file and reinforce the dynamic link library file to obtain a reinforced dynamic link library file;

[0089] The execution unit 35 is used to execute the hardened dynamic link library file through the hardened HybridCLR interpreter to achieve HybridCLR instruction disorder.

[0090] The specific principles and execution processes of each unit in the HybridCLR instruction out-of-order protection system disclosed in the above-mentioned embodiment of the present application are the same as the HybridCLR instruction out-of-order protection method disclosed in the above-mentioned embodiment of the present application. Please refer to the corresponding parts of the HybridCLR instruction out-of-order protection method disclosed in the above-mentioned embodiment of the present application, and no further details will be given here.

[0091] The present application provides a HybridCLR instruction disorder protection system, which obtains the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file; extracts the instructions to be modified from the bytecode file, and shuffles the instructions to be modified; replaces the instructions to be modified in the bytecode file with the shuffled instructions to be modified to achieve the disorder of the bytecode file and obtain a reinforced HybridCLR interpreter; obtains a dynamic link library file, and reinforces the dynamic link library file to obtain a reinforced dynamic link library file; executes the reinforced dynamic link library file through the reinforced HybridCLR interpreter to achieve the HybridCLR instruction disorder. It can be seen that the technical solution provided by the present application is to obtain a reinforced HybridCLR interpreter by scrambling the bytecode file of the source code of the HybridCLR interpreter, and to obtain a reinforced dynamic link library file by scrambling the dynamic link library file, and finally to execute the reinforced dynamic link library file using the reinforced HybridCLR interpreter. At this time, the dynamic link library file used by the hot update function of HyBridCLR has been modified. Even if the attacker uses open source tools, he cannot use the modified dynamic link library file to restore the script source code, so that the game script is no longer easily reversed to leak the source code, which greatly increases the threshold for attackers. In other words, the attacker cannot use open source tools to get the original dynamic link library file, and thus cannot restore the game script. Not only does it increase the attacker's time, energy and cost, but also by modifying the dynamic link library file to achieve HybridCLR instruction scrambling, it can also effectively avoid modification of the source code.

[0092] Optionally, the first out-of-order unit comprises:

[0093] An identification unit, used for traversing the bytecode file to identify the marked instructions from the bytecode file, and determining the marked instructions as instructions to be modified;

[0094] The first shuffling sub-unit is used to generate a shuffling array with the same size as the instruction to be modified by using random numbers, and shuffle the instruction to be modified by using the shuffling array.

[0095] Optional, reinforcement unit, including:

[0096] A first determining unit is used to obtain a dynamic link library file and determine a metadata table structure from the dynamic link library file;

[0097] A second determining unit is used to determine a function table structure from the dynamic link library according to the metadata table structure; wherein the function table structure includes function information of a plurality of functions;

[0098] The second scrambling unit is used to scramble the bytecodes in the function code body of each function in the dynamic link library file by using the function information of each function to obtain a reinforced dynamic link library file.

[0099] Optionally, the first determining unit includes:

[0100] A parsing unit, used for acquiring a dynamic link library file and parsing the dynamic link library file to read a header structure of the dynamic link library file;

[0101] An offset position obtaining unit, used for obtaining an offset position of a metadata table structure in a dynamic link library file from a header structure;

[0102] The first determining subunit is used to determine the metadata table structure from the dynamic link library file according to the offset position and obtain the metadata table structure.

[0103] Optionally, the second determining unit includes:

[0104] The second determining subunit is used to traverse the metadata table structure to determine the location information of the function table structure from the metadata table structure;

[0105] The function table structure acquisition unit is used to acquire the function table structure from the dynamic link library according to the position information of the function table structure.

[0106] The present application also provides a storage medium (computer-readable storage medium), which stores computer-executable instructions. When the computer-readable instructions are loaded and executed by a processor, any of the above-mentioned HybridCLR instruction out-of-order protection method embodiments is implemented.

[0107] The present application also provides an electronic device, such as Figure 4 As shown, the electronic device includes a processor 401 and a memory 402; a program is stored in the memory; the processor calls the program in the memory to execute any one of the above-mentioned HybridCLR instruction out-of-order protection method embodiments.

[0108] The processor in the present application may be a CPU of a terminal, or an MCU integrated in the terminal, or a combination of a CPU and an MCU. Moreover, the processor includes a kernel, which retrieves a corresponding program from a memory, and one or more kernels may be provided.

[0109] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0110] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0111] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0112] The steps in the methods of the embodiments of the present application can be adjusted in order, combined, and deleted according to actual needs.

[0113] The modules and sub-modules in the devices and terminals in the embodiments of the present application can be combined, divided and deleted according to actual needs.

[0114] In the several embodiments provided in the present application, it should be understood that the disclosed terminals, devices and methods can be implemented in other ways. For example, the terminal embodiments described above are only schematic, for example, the division of modules or submodules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple submodules or modules can be combined or integrated into another module, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0115] The modules or submodules described as separate components may or may not be physically separated, and the components of the modules or submodules may or may not be physical modules or submodules, that is, they may be located in one place, or they may be distributed on multiple network modules or submodules. Some or all of the modules or submodules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] In addition, each functional module or submodule in each embodiment of the present application may be integrated into one processing module, or each module or submodule may exist physically separately, or two or more modules or submodules may be integrated into one module. The above-mentioned integrated modules or submodules may be implemented in the form of hardware or in the form of software functional modules or submodules.

[0117] Finally, it should be noted that, in this application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0118] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined in the present application may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown in the present application, but will conform to the widest scope consistent with the principles and novel features disclosed in the present application.

[0119] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A HybridCLR instruction out-of-order protection method, characterized in that: The method comprises: Obtain source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file; Extracting instructions to be modified from the bytecode file, and shuffling the instructions to be modified; Replacing the to-be-modified instructions in the bytecode file with the to-be-modified instructions after the disorder, so as to achieve disorder of the bytecode file and obtain a reinforced HybridCLR interpreter; Acquire a dynamic link library file, and reinforce the dynamic link library file to obtain a reinforced dynamic link library file; The reinforced dynamic link library file is executed by the reinforced HybridCLR interpreter to achieve HybridCLR instruction disorder.

2. The method according to claim 1, characterized in that The extracting the to-be-modified instructions from the bytecode file and shuffling the to-be-modified instructions comprises: Traversing the bytecode file to identify marked instructions from the bytecode file, and determining the marked instructions as instructions to be modified; A random number is used to generate a shuffled array having the same size as the instruction to be modified, and the shuffled array is used to shuffle the instruction to be modified.

3. The method according to claim 1, characterized in that The step of obtaining a dynamic link library file and reinforcing the dynamic link library file to obtain a reinforced dynamic link library file includes: Acquire a dynamic link library file, and determine a metadata table structure from the dynamic link library file; Determining a function table structure from the dynamic link library according to the metadata table structure; wherein the function table structure includes function information of a plurality of functions; The bytecodes in the function code body of each function in the dynamic link library file are shuffled using the function information of each function to obtain a reinforced dynamic link library file.

4. The method according to claim 3, characterized in that The obtaining of the dynamic link library file and determining the metadata table structure from the dynamic link library file includes: Acquire a dynamic link library file, and parse the dynamic link library file to read a header structure of the dynamic link library file; Acquire the offset position of the metadata table structure in the dynamic link library file from the header structure; The metadata table structure is determined from the dynamic link library file according to the offset position, and the metadata table structure is acquired.

5. The method according to claim 3, characterized in that: Determining the function table structure from the dynamic link library according to the metadata table structure includes: Traversing the metadata table structure to determine the location information of the function table structure from the metadata table structure; The function table structure is obtained from the dynamic link library according to the location information of the function table structure.

6. A HybridCLR instruction out-of-order protection system, characterized in that: The system comprises: A source code acquisition unit, used to acquire the source code of the HybridCLR interpreter from Unity; wherein the source code includes a bytecode file; A first scrambling unit, used for extracting instructions to be modified from the bytecode file and scrambling the instructions to be modified; A first replacement unit is used to replace the to-be-modified instructions in the bytecode file with the to-be-modified instructions after being disordered, so as to achieve disordering of the bytecode file and obtain a reinforced HybridCLR interpreter; A reinforcement unit, used for obtaining a dynamic link library file and reinforcing the dynamic link library file to obtain a reinforced dynamic link library file; The execution unit is used to execute the hardened dynamic link library file through the hardened HybridCLR interpreter to achieve HybridCLR instruction disorder.

7. The system according to claim 6, characterized in that The first out-of-order unit comprises: an identification unit, configured to traverse the bytecode file to identify marked instructions from the bytecode file, and determine the marked instructions as instructions to be modified; The first scrambling sub-unit is used to use random numbers to generate a scrambled array with the same size as the instruction to be modified, and use the scrambled array to scramble the instruction to be modified.

8. The system according to claim 6, characterized in that The reinforcement unit comprises: A first determining unit is used to obtain a dynamic link library file and determine a metadata table structure from the dynamic link library file; A second determining unit, configured to determine a function table structure from the dynamic link library according to the metadata table structure; wherein the function table structure includes function information of a plurality of functions; The second scrambling unit is used to scramble the bytecodes in the function code body of each function in the dynamic link library file by using the function information of each function to obtain a reinforced dynamic link library file.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement a HybridCLR instruction out-of-order protection method as described in any one of claims 1-5.

10. A storage medium, characterized in that: The storage medium stores computer executable instructions, and the computer executable instructions are used to execute a HybridCLR instruction out-of-order protection method as described in any one of claims 1-5.

Images