JavaScript language security reinforcement method based on virtual machine technology

Abstract

The invention discloses a JavaScript language security reinforcement method based on a virtual machine technology, and belongs to the field of JavaScript languages. The method comprises the following steps: firstly, building a test system comprising a compiler, an assembler, a virtual machine and a packer; then, a developer submits the JavaScript program or the function requirement to be tested to the test system; a test system constructs a to-be-tested program by using a Yarn environment, and a compiler compiles a JavaScript source code and analyzes and converts the JavaScript source code into an intermediate representation IR; the assembler converts the IR into byte codes, and converts the relative reference address into an absolute address by generating a character string table and a lookup table; and the generated byte code is optimized. The test system submits the optimized byte code to the virtual machine, the virtual machine runs a byte code program, and after execution is completed, the test system collects an execution result of the virtual machine and compares the execution result with an expected result; and finally generating a test report and delivering the test report to developers for confirmation. According to the method, the security of the JavaScript code is enhanced through a virtualization technology, and malicious access and analysis are prevented.

Description

Technical Field

[0001] The invention belongs to the field of JavaScript language, and specifically is a JavaScript language security reinforcement method based on virtual machine technology. Background Art

[0002] With the rapid development of the Internet and information technology, JavaScript, as an important language for front-end development, has become increasingly problematic in terms of code security. Traditional code obfuscation and encryption methods are powerless in the face of increasingly complex security threats. To meet this challenge, improving the protection strength of JavaScript code, ensuring the security of core algorithms and logic, and developing efficient code protection tools have become urgent issues to be addressed.

[0003] In the field of information security, the security and protection of JavaScript code are becoming increasingly prominent. Traditional JavaScript code is usually released in an open form, allowing malicious users to easily analyze, tamper with, and reverse engineer the code. To address the above threats, a stack-based JavaScript virtual machine is designed to convert JavaScript source code into a more secure and difficult-to-access format, fundamentally improving the security of the code. Summary of the invention

[0004] This paper proposes a JavaScript language security reinforcement method based on virtual machine technology, focusing on achieving efficient JavaScript code protection and execution optimization, aiming to enhance the security of JavaScript code through virtualization technology and prevent malicious access and analysis;

[0005] The JavaScript language security reinforcement method based on virtual machine technology has the following specific steps:

[0006] Step 1: Build a test system including compiler, assembler, virtual machine and packager;

[0007] Compiler: Responsible for parsing JavaScript source code into an abstract syntax tree (AST), converting the AST into an intermediate representation (IR) and optimizing it.

[0008] Assembler: responsible for converting the intermediate representation (IR) into bytecode, converting relative reference addresses into absolute addresses by generating string tables and lookup tables; and optimizing the generated bytecode.

[0009] Virtual Machine: Provides a runtime environment and is responsible for interpreting and executing bytecode instructions. Maintains the execution context and call stack, manages function calls and returns, and ensures the stability and security of code execution.

[0010] Packer: Place the generated bytecode and string table into the virtual machine and mix and package them with the virtual machine. The generated bytecode eventually produces an output package body with an immediately executed function (IIFE) structure.

[0011] This system uses the TypeScript module and the Babel library to parse and convert code, generate an abstract syntax tree (AST) and an intermediate representation (IR), and generate bytecode through a bytecode compiler. The bytecode is executed in a virtual machine, and Rollup is used for code packaging and obfuscation. The system also includes a disassembler for easy debugging and verification. The automated testing framework ensures the correctness and stability of the system by loading and executing test cases.

[0012] Step 2: The developer submits the JavaScript program or functional requirements to be tested to the test system;

[0013] Step 3: The test system uses the yarn (or npm) environment to build the JavaScript program to be tested. The compiler compiles the JavaScript source code and parses and converts it into an intermediate representation IR.

[0014] The details are as follows: Use a syntax parser to parse the JavaScript source code into an abstract syntax tree AST, traverse the AST, convert it into an intermediate representation IR, and optimize the generated intermediate representation.

[0015] Step 4: The assembler converts the intermediate representation IR into bytecode, converts the relative reference address into an absolute address by generating a string table and a lookup table, and optimizes the generated bytecode.

[0016] The working of the assembler includes the following steps:

[0017] First, a string table and a lookup table are generated to store and find the strings and all relative address mapping data required during program execution.

[0018] Then, each instruction in the intermediate representation is converted into the corresponding bytecode, and the relative reference address is converted into an absolute address according to the lookup table.

[0019] Finally, the generated bytecode is optimized.

[0020] Step 5: The test system submits the compiled bytecode to the virtual machine, and the virtual machine runs the bytecode program.

[0021] Step 6: After the virtual machine is executed, the test system collects the execution results of the virtual machine and compares them with the expected results.

[0022] Step 7. The test system generates a test report based on the comparison results to determine whether there are any problems. If so, the problem is fed back to the developer. The developer optimizes the code based on the problem reported by the test and submits it to the test system again, returning to step 3. Otherwise, the test passes, and the test system delivers the final test report to the developer for confirmation and use.

[0023] The advantages of the present invention are:

[0024] 1) The present invention proposes and implements specific optimization algorithms for JavaScript code, such as removing useless code and constant folding, which can significantly improve bytecode execution efficiency and code security.

[0025] 2) The present invention designs and implements a new bytecode generation and optimization strategy, which significantly reduces the bytecode volume and improves execution efficiency through methods such as instruction merging and removing redundant instructions.

[0026] 3) The present invention enhances the anti-debugging capability of the code through technologies such as control flow flattening and inserting junk instructions, making the code more difficult to be reverse engineered and analyzed, thereby improving overall security.

[0027] 4) The present invention implements a new code compression algorithm and compatibility processing method, which can significantly reduce the code volume and improve the compatibility of the code under different JavaScript versions while ensuring the functional integrity of the code.

[0028] 5) The present invention proposes a new virtual machine execution efficiency optimization strategy, which improves the execution performance and stability of the virtual machine by improving the execution context and call stack management mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of a JavaScript language security reinforcement method based on virtual machine technology of the present invention;

[0030] Figure 2 This is a schematic diagram of the JavaScript language security reinforcement method based on virtual machine technology of the present invention;

[0031] Figure 3 A working framework diagram of the test system constructed for the present invention;

[0032] Figure 4 The working principle diagram of the test system built for the present invention; DETAILED DESCRIPTION

[0033] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0034] The present invention proposes a JavaScript language security reinforcement method based on virtual machine technology, which realizes comprehensive code protection and optimization by compiling JavaScript source code into bytecode and running it in a virtual machine.

[0035] The "JavaScript Security Hardening Application Platform" is based on virtual machine technology. By compiling JavaScript source code into bytecode and running it in a virtual machine, code obfuscation and protection are achieved from the bottom up. The platform consists of four core modules: compiler, assembler, virtual machine, and packager. It provides a high-intensity code protection mechanism, effectively preventing the code from being reverse engineered and tampered with, and ensuring the security and execution efficiency of JavaScript code in Web applications, mobile applications, and commercial software; so that it can be used by subsequent developers and product testers.

[0036] like Figure 1 and Figure 2 As shown, the specific steps are as follows:

[0037] Step 1: Build a test system including compiler, assembler, virtual machine and packager;

[0038] Compiler: Responsible for parsing JavaScript source code into an abstract syntax tree (AST), converting the AST into an intermediate representation (IR) and optimizing it, such as removing useless code and constant folding, to improve code execution efficiency and security.

[0039] Assembler: responsible for converting the intermediate representation (IR) into bytecode, converting relative reference addresses into absolute addresses by generating string tables and lookup tables; and optimizing the generated bytecode, such as merging instructions and removing redundant instructions, to improve the execution efficiency of the bytecode.

[0040] Virtual Machine: Provides a runtime environment and is responsible for interpreting and executing bytecode instructions. Maintains the execution context and call stack, manages function calls and returns, and ensures the stability and security of code execution.

[0041] Packer: Packs the generated bytecode and related data into the final executable file. Implements anti-debugging technologies such as code compression, control flow flattening, and insertion of junk instructions to improve the anti-debugging capability and security of the code.

[0042] The JavaScript security hardening application platform aims to achieve efficient protection and secure execution of JavaScript code through multi-level protection measures such as compilation, optimization and virtual machine execution.

[0043] like Figure 3 and Figure 4As shown in the figure, this system uses the TypeScript module and the Babel library to parse and convert the code, generate the abstract syntax tree (AST) and intermediate representation (IR), and generate bytecode through the bytecode compiler. The bytecode is executed in the virtual machine, and Rollup is used for code packaging and obfuscation. The system also includes a disassembler for easy debugging and verification. The automated testing framework ensures the correctness and stability of the system by loading and executing test cases.

[0044] This system implements a multi-level code protection mechanism:

[0045] (1) Compiler level

[0046] Abstract syntax tree (AST) parsing and intermediate representation (IR) conversion: Generate AST by parsing JavaScript source code and convert it into IR, which helps to deeply optimize the code.

[0047] Code optimization: including techniques such as removing unused code and constant folding to improve code execution efficiency and reduce the risk of code exposure.

[0048] (2) Assembler level

[0049] String Tables and Lookup Tables: Create and manage string and address mappings to further obfuscate code structure and increase code unreadability.

[0050] Bytecode optimization: Bytecode is optimized by methods such as instruction merging and removing redundant instructions to improve execution efficiency and increase the difficulty of reverse engineering.

[0051] (3) Virtual Machine Level

[0052] Bytecode: The virtual machine interprets and executes bytecode instructions one by one, and accurately controls the execution flow of the code. In existing work, the obfuscation and optimization of JavaScript code is mainly achieved by directly modifying the source code or using technical means such as WebAssembly. The present invention compiles JavaScript code into bytecode and interprets and executes it in a virtual machine, thereby achieving code obfuscation and protection from the bottom layer, making it more difficult to be reverse engineered.

[0053] Context management: Ensure the safety of function calls and returns by maintaining the execution context and call stack.

[0054] (4) Packager level

[0055] Code compression and anti-debugging measures: including control flow flattening, constant folding, execution merging, insertion of junk instructions and other technologies, to further enhance the anti-reversing capability of the code.

[0056] JavaScript version downgrade: Ensure that the generated bytecode can run in different JavaScript engines and environments without additional dependencies or conversion steps, and have good compatibility. Native compatibility makes the project more widely applicable and can be directly applied to the existing JavaScript ecosystem, which greatly facilitates developers to use.

[0057] Step 2: The developer submits the JavaScript program or functional requirements to be tested to the test system;

[0058] Step 3: The test system uses the yarn (or npm) environment to build the JavaScript program to be tested. The compiler compiles the JavaScript source code and parses and converts it into an intermediate representation IR.

[0059] The details are as follows: Use a syntax parser to parse the JavaScript source code into an abstract syntax tree AST, which can represent the syntax structure of the source code in a tree form.

[0060] The AST is traversed and converted into an intermediate representation (IR), which is a low-level representation containing a set of instructions and operands.

[0061] The generated intermediate representation is optimized, such as removing useless code and constant folding, to improve code execution efficiency.

[0062] Step 4: The assembler converts the intermediate representation IR into bytecode, converts the relative reference address into an absolute address by generating a string table and a lookup table, and optimizes the generated bytecode.

[0063] Bytecode is a low-level representation that can be directly executed by a virtual machine. The work of an assembler consists of the following steps:

[0064] First, a string table and a lookup table are generated to store and find the strings and all relative address mapping data required during program execution.

[0065] Then, each instruction in the intermediate representation is converted into the corresponding bytecode, and the relative reference address is converted into an absolute address according to the lookup table.

[0066] Finally, the generated bytecode is optimized to complete instruction merging, remove redundant instructions, etc., to further improve execution efficiency.

[0067] Step 5: The test system submits the compiled bytecode to the virtual machine, and the virtual machine runs the bytecode program.

[0068] The virtual machine runs the template code and is responsible for loading and executing the bytecode at runtime. The functions of the virtual machine include:

[0069] 1) Create the initial run stack frame and jump to the program entry point.

[0070] 2) Read and interpret the bytecode instructions one by one.

[0071] 3) Maintain the execution context and call stack, and manage function calls and returns.

[0072] The execution context includes function parameters, local variables, call stack and other information.

[0073] Step 6: After the virtual machine is executed, the test system collects the execution results of the virtual machine and compares them with the expected results.

[0074] The packager is responsible for placing the generated bytecode and string table into the virtual machine, and mixing and packaging them with the virtual machine, and finally generating an immediately executable function (IIFE) file as the final generated result. The functions of the packager include:

[0075] 1) Replace the bytecode and string table values ​​in the virtual machine template with the actual payload generated;

[0076] 2) Complete code compression, control flow flattening, insert junk instructions and other anti-debugging codes;

[0077] 3) Complete the downgrade (polyfill) of high-version JavaScript dependency to improve compatibility;

[0078] 4) Generate the output package body of the immediately executed function structure;

[0079] Step 7. The test system generates a test report based on the comparison results to determine whether there are any problems. If so, the problem is fed back to the developer. The developer optimizes the code based on the problem reported by the test and submits it to the test system again, returning to step 3. Otherwise, the test passes, and the test system delivers the final test report to the developer for confirmation and use.

[0080] Example:

[0081] The virtual machine architecture used in this embodiment includes:

[0082] The VM stack (vmStack) performs runtime data storage;

[0083] The code counter (programCounter) records the current bytecode;

[0084] Dependencies store external objects;

[0085] The test set content is as follows:

[0086]

[0087]

[0088]

[0089] The purpose of the test process is to ensure that the results of the bytecode generated by the system running in the virtual machine are consistent with the results of direct execution outside the virtual machine (browser environment or Node.js), thereby verifying the correctness and stability of the system. Figure 4 As shown, the test process is as follows:

[0090] 1) Single program test:

[0091] The test system executes the given JavaScript code directly outside the virtual machine, and collects and records the running results.

[0092] Compile the same code into bytecode through the system, execute it in the virtual machine, and collect and record the running results.

[0093] Compare the direct execution result outside the virtual machine with the execution result inside the virtual machine. If the two are consistent, the use case is considered to have passed the test.

[0094] 2) Test set test:

[0095] Write multiple sets of test code and their expected outputs in the system's test suite directory (such as . / test / cases).

[0096] The test system executes each set of test code directly outside the virtual machine and collects and records the results.

[0097] The test system compiles each set of test code into bytecode, executes it in a virtual machine, and collects and records the results.

[0098] Compare the results of each set of test code executed directly outside the virtual machine with the results of the execution inside the virtual machine. If the two are consistent, the test case is considered to have passed the test.

[0099] 3) Result analysis:

[0100] Compare the running results of each test case outside the virtual machine and inside the virtual machine.

[0101] Record the use cases that passed the test and the use cases that failed the test, and analyze the reasons for failure (such as code compatibility issues, virtual machine interpreter errors, etc.).

[0102] · Debug and correct the test cases that failed the test to ensure that all test cases can pass the verification.

[0103] The traditional solution is https: / / www.json.cn / jshx / . In addition to replacing the variable name and the value with hexadecimal, there is no other encryption method. The program logic is obvious.

[0104] The traditional solution is https: / / tool.chinaz.com / js.aspx. In the encrypted result, the number in the first parameter corresponds to the array index after splitting in the fourth parameter. The original code can be obtained through simple processing. The variable name and method name are also retained; the same website also provides a decryption tool, after decryption, the original program is perfectly restored.

[0105] This example uses the https: / / www.jsjiami.com / jsjiami.v6.html tool for encryption and obfuscation. The encryption result is difficult to discover the original logic through direct observation.

[0106] The corresponding decryption tool is https: / / github.com / LouisSina / JsjiamiV6-Decryptor. After decryption, the decryption result is:

[0107]

[0108] It can be seen that after the decryption tool decrypts the traditional obfuscation encryption, the original program logic is exposed, which directly shows that the traditional obfuscation encryption has limited protection for the program.

[0109] The virtual machine of this instance embeds the compiled bytecode for decryption, and the operating environment configuration is shown in Table 1:

[0110] Configure the Node.js environment: Make sure Node.js is installed (version 14.x or later is recommended), install the Yarn package manager, and make sure the version is 1.22.19 or later.

[0111] Configure the workspace: Run the yarn install command in the project root directory to install all dependent packages.

[0112] Install project dependencies: Make sure to run yarn install in the project root directory to install all necessary dependencies, including dependencies for each workspace.

[0113] Table 1

[0114]

[0115]

[0116] Before officially compiling the JavaScript code, the user needs to complete the construction and function verification of the virtual machine.

[0117] 1) Run the following command to build each module:

[0118] yarn build:compiler

[0119] yarn build:vm

[0120] yarn build:debugger

[0121] 2) Configure the unit test environment to ensure that all test cases can run correctly:

[0122] yarn unit

[0123] 3) Make sure all modules are installed and built correctly, and run the following command to debug:

[0124] yarn workspace@kprotect / test test

[0125] 4) Configure the operating environment through the above steps to ensure that the test system runs normally when all modules are correctly installed and configured.

[0126] Formal compilation

[0127] After completing the operating environment configuration, you can proceed with the formal compilation operation. The specific steps are as follows:

[0128] 1) Prepare the source code file: Name the JavaScript source code file to be compiled as sourcefile.js and place it in the project directory.

[0129] 2) Run the protection command: Execute the following command in the project root directory:

[0130] yarn protect -i sourcefile.js -o bundle.js

[0131] 3) Command parameter description:

[0132] -i sourcefile.js: specifies the input source code file.

[0133] -o bundle.js: specifies the output protected bytecode file.

[0134] Once compiled, the bundle.js file will contain protected bytecode that can be safely run in a browser environment.

Claims

1. A JavaScript language security reinforcement method based on virtual machine technology, characterized in that: The specific steps are as follows: Step 1: Build a test system including compiler, assembler, virtual machine and packager; This system uses the TypeScript module and the Babel library to parse and convert code, generate abstract syntax tree AST and intermediate representation IR, and generate bytecode through the bytecode compiler; Execute bytecode in a virtual machine and use Rollup for code packaging and obfuscation; Step 2: The developer submits the JavaScript program or functional requirements to be tested to the test system; Step 3: The test system uses the yarn environment to build the JavaScript program to be tested. The compiler compiles the JavaScript source code and parses and converts it into an intermediate representation IR. The details are as follows: Use a syntax parser to parse the JavaScript source code into an abstract syntax tree AST, traverse the AST, convert it into an intermediate representation IR, and optimize the generated intermediate representation; Step 4: The assembler converts the intermediate representation IR into bytecode, converts the relative reference address into an absolute address by generating a string table and a lookup table, and optimizes the generated bytecode; The working of the assembler includes the following steps: First, a string table and a lookup table are generated to store and find the strings and all relative address mapping data required during program execution; Then, each instruction in the intermediate representation is converted into the corresponding bytecode, and the relative reference address is converted into an absolute address according to the lookup table; Finally, the generated bytecode is optimized; Step 5: The test system submits the compiled bytecode to the virtual machine, and the virtual machine runs the bytecode program; Step 6: After the virtual machine is executed, the test system collects the execution results of the virtual machine and compares them with the expected results; Step 7. The test system generates a test report based on the comparison results to determine whether there are any problems. If so, the problem is fed back to the developer. The developer optimizes the code based on the problem reported by the test and submits it to the test system again, returning to step 3. Otherwise, the test passes, and the test system delivers the final test report to the developer for confirmation and use.

2. A JavaScript language security reinforcement method based on virtual machine technology as claimed in claim 1, characterized in that: The compiler is responsible for parsing the JavaScript source code into an abstract syntax tree (AST), converting the AST into an intermediate representation (IR) and optimizing it. Assembler: responsible for converting the intermediate representation IR into bytecode, converting relative reference addresses into absolute addresses by generating string tables and lookup tables, and optimizing the generated bytecode; Virtual machine: provides a runtime environment, is responsible for interpreting and executing bytecode instructions; maintains the execution context and call stack, manages function calls and returns, and ensures the stability and security of code execution; Packager: Place the generated bytecode and string table into the virtual machine and package them together with the virtual machine. The generated bytecode will eventually produce an output package body of an immediately executed function (IIFE) structure.

3. A JavaScript language security reinforcement method based on virtual machine technology as claimed in claim 1, characterized in that: The test system also includes a disassembler to facilitate debugging and verification; The automated testing framework ensures the correctness and stability of the system by loading and executing test cases.

Images