Source code obfuscation method and system

Abstract

The invention discloses a source code obfuscation method and system, and belongs to the technical field of software development. According to the source code obfuscation method, in the preprocessing obfuscation stage, all first compiling units in a source code to be obfuscated are subjected to lexical analysis one by one to obtain corresponding lexical units, and a preprocessing instruction tree is generated according to all the lexical units; confusion is carried out in a corresponding mode based on the category of each preprocessing node in the preprocessing instruction tree, so that the purposes of deleting the to-be-confused source code annotation and expanding an internal header file of the to-be-confused source code annotation are achieved; in the symbol name obfuscation stage, all second compiling units in a first source code are analyzed one by one to obtain an abstract syntax tree, a symbol table is constructed according to the abstract syntax tree, the first source code is compiled based on the symbol table to obtain an obfuscated code, and the purpose of renaming information such as variables, functions and types in the source code is achieved; according to the method, the difficulty of quickly analyzing the source code is improved, and the protection strength of the source code is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a source code obfuscation method and system. Background Art

[0002] Most existing code obfuscation tools usually use virtualization, instruction replacement and other technical means to process the binary files of the program, so as to achieve the purpose of protecting technological achievements and preventing reverse engineering. However, the above-mentioned processing methods are difficult to achieve the purpose of delaying the rapid replication of technological achievements in the process of source code delivery projects. Currently, there are few tools for direct source code level obfuscation for C and C++ language source code, and their functions are relatively simple and lack flexible configuration. The source code of C and C++ languages is very complex in itself. Obfuscation through simple pattern matching and replacement methods has low protection for source code and it is difficult to ensure the predictability and correctness of the final obfuscation results of large projects. The current C and C++ language source code analysis tools are difficult to fully match the functions and lack the necessary flexibility. The implementation of these tools themselves is also relatively complex and difficult to customize according to the actual needs of the project. Summary of the Invention

[0003] In response to the problem that existing C and C++ language source code obfuscation tools have low protection for source code, a source code obfuscation method and system are provided to enhance the protection of source code and effectively prevent the source code from being quickly copied.

[0004] The present invention provides a source code obfuscation method, comprising:

[0005] Performing lexical analysis on all first compilation units in the source code to be obfuscated one by one to obtain corresponding lexical units, and generating a preprocessing instruction tree based on all the lexical units;

[0006] Obfuscating the preprocessing nodes in the preprocessing instruction tree in a corresponding manner based on the category of the preprocessing nodes to generate a first source code;

[0007] Parsing all second compilation units in the first source code one by one to obtain an abstract syntax tree;

[0008] Constructing a symbol table according to the abstract syntax tree;

[0009] The first source code is compiled based on the symbol table to obtain obfuscated code.

[0010] Preferably, the preprocessing instruction tree includes at least one of the following types of preprocessing nodes:

[0011] Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes;

[0012] The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node;

[0013] The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit;

[0014] The obfuscation method of the comment node is to delete the comment corresponding to the comment node.

[0015] The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

[0016] Preferably, constructing a symbol table according to the abstract syntax tree includes:

[0017] The abstract syntax tree is analyzed using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and the symbol table is generated according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0018] The present invention also provides a source code obfuscation method, comprising:

[0019] Parse all third compilation units in the obfuscated source code one by one to obtain an abstract syntax tree;

[0020] Constructing a symbol table according to the abstract syntax tree;

[0021] The source code to be obfuscated is compiled based on the symbol table to obtain obfuscated code.

[0022] Preferably, constructing a symbol table according to the abstract syntax tree includes:

[0023] The abstract syntax tree is analyzed using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and the symbol table is generated according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0024] The present invention also provides a source code obfuscation system, comprising:

[0025] A preprocessing unit, configured to perform lexical analysis on all first compilation units in the source code to be obfuscated one by one to obtain corresponding lexical units, and generate a preprocessing instruction tree according to all the lexical units;

[0026] A first obfuscation unit is configured to perform obfuscation in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree to generate a first source code;

[0027] a parsing unit, configured to parse all second compilation units in the first source code one by one to obtain an abstract syntax tree;

[0028] A construction unit, configured to construct a symbol table according to the abstract syntax tree;

[0029] The second obfuscation unit is configured to compile the first source code based on the symbol table to obtain obfuscated code.

[0030] Preferably, the preprocessing instruction tree includes at least one of the following types of preprocessing nodes:

[0031] Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes;

[0032] The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node;

[0033] The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit;

[0034] The obfuscation method of the comment node is to delete the comment corresponding to the comment node.

[0035] The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

[0036] Preferably, the construction unit adopts a table-driven method to analyze the abstract syntax tree to obtain the symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0037] The present invention also provides a source code obfuscation system, comprising:

[0038] A parsing unit, used to parse all third compilation units in the obfuscated source code one by one to obtain an abstract syntax tree;

[0039] A construction unit, configured to construct a symbol table according to the abstract syntax tree;

[0040] The second obfuscation unit is configured to compile the source code to be obfuscated based on the symbol table to obtain obfuscated code.

[0041] Preferably, the construction unit adopts a table-driven method to analyze the abstract syntax tree to obtain the symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0042] Beneficial effects of the above technical solution:

[0043] In the present technical solution, the source code obfuscation method and system of the present invention obtain corresponding lexical units by performing lexical analysis on all first compilation units in the source code to be obfuscated one by one in the preprocessing obfuscation stage, and generate a preprocessing instruction tree based on all lexical units; obfuscation is performed in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree, thereby achieving the purpose of deleting the source code comments to be obfuscated and expanding its internal header files; in the symbol name obfuscation stage, abstract syntax trees are obtained by parsing all second compilation units in the first source code one by one, a symbol table is constructed according to the abstract syntax tree, and the first source code is compiled based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming variables, functions, types and other information in the source code; the present invention greatly improves the difficulty of rapid parsing of the source code through two-stage source code obfuscation, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a method flow chart of an embodiment of the source code obfuscation method according to the first embodiment of the present invention;

[0045] Figure 2 This is a method flow chart of an embodiment of the source code obfuscation method according to the second embodiment of the present invention;

[0046] Figure 3 A module of an embodiment of the source code obfuscation system described in the third embodiment of the present invention;

[0047] Figure 4 This is a module of an embodiment of the source code obfuscation system described in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0048] The advantages of the present invention are further described below with reference to the accompanying drawings and specific embodiments.

[0049] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0050] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0051] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0052] In the description of the present invention, it should be understood that the numerical labels before the steps do not identify the order in which the steps are executed, but are only used to facilitate the description of the present invention and to distinguish each step, and therefore should not be understood as a limitation of the present invention.

[0053] The source code obfuscation method and system provided by the present application can enhance the protection of source code and effectively prevent the source code from being quickly copied. It can be applied to the fields of education, automobiles, finance, etc. The source code obfuscation method mainly includes a preprocessing obfuscation stage and a symbol name obfuscation stage. In the preprocessing obfuscation stage, all the first compilation units in the obfuscated source code are lexically analyzed one by one to obtain corresponding lexical units, and a preprocessing instruction tree is generated based on all the lexical units; obfuscation is performed in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree, thereby achieving the purpose of deleting the comments of the source code to be obfuscated and expanding its internal header files; in the symbol name obfuscation stage, all the second compilation units in the first source code are parsed one by one to obtain an abstract syntax tree, a symbol table is constructed based on the abstract syntax tree, and the first source code is compiled based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming variables, functions, types and other information in the source code; the present invention greatly increases the difficulty of rapid parsing of the source code through two stages of source code obfuscation, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result.

[0054] Example 1

[0055] In order to solve the problem that existing C language and C++ language source code obfuscation tools have low protection for source code, this invention proposes a source code obfuscation method that can improve the protection of source code and effectively prevent the source code from being quickly copied. Figure 1 , which is a flow chart of a source code obfuscation method according to a preferred embodiment of the present invention. As can be seen from the figure, the source code obfuscation method provided in this embodiment mainly includes the following steps:

[0056] S1. Perform lexical analysis on all first compilation units in the obfuscated source code one by one to obtain corresponding lexical units, and generate a preprocessing instruction tree based on all the lexical units;

[0057] It should be noted that the preprocessing instruction tree includes at least one of the following types of preprocessing nodes:

[0058] Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes.

[0059] In this embodiment, the source code obfuscation method is mainly used to confuse C source code and C++ source code. The first compilation unit generally uses a source code file in the format of .c or .cpp. In actual application, the libclang tool can be used to perform lexical analysis on all the first compilation units in the obfuscated source code one by one to obtain the corresponding lexical units. The lexical units in the first compilation unit can be directly obtained through tu.get_tokens (extent = tu.cursor.extent), and the extent of the header file introduced internally, that is, the source code position range SourceRange, can be obtained by using a hack method to obtain the source code position.

[0060] In this embodiment, the LL(1) algorithm is adopted to distribute instruction processing functions from top to bottom through a table-driven method to construct a pre-processing instruction tree.

[0061] S2. Obfuscate the preprocessing nodes in the preprocessing instruction tree in a corresponding manner to generate a first source code;

[0062] In this embodiment, different obfuscation methods are used for different types of preprocessing node categories. The specific obfuscation methods are as follows:

[0063] The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node;

[0064] The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit;

[0065] The obfuscation method of the comment node is to delete the comment corresponding to the comment node.

[0066] The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

[0067] In this embodiment, conditional instructions may include: #if, #ifdef, #ifndef, #elif, #else, #endif, etc. Conditional instructions are generally used to record and store information related to compilation conditions and file guards (__HEADER_GURARD__). When the conditional instruction is enabled and the __HEADER_GURARD_ attribute is true (True), if the corresponding preprocessing instruction can be deleted, the corresponding preprocessing instruction is deleted; otherwise, the instruction is written to the destination memory (dst) as is.

[0068] The obfuscation method for file include directive nodes is as follows: for expandable internal header files, recursively perform the replacement operation of the preprocessing module it points to, and write the result to dst. Avoid repeated expansion, for example: if the Top-Level (top-level node) is expanded for the first time, it will not be expanded again in all subsequent or sub-conditional contexts; for non-expandable header files: if it can be moved to the top, collect it; otherwise, write the directive as is to dst. File include directive records in the #include format (<angle brackets> or "double quotes"), if it is an internal header file, it points to the corresponding preprocessing module. The speed of preprocessing module search can be optimized, and the module relationship graph can be pre-built through TranslationUnit.get_includes(). Only those modules that are not included in the current compilation unit due to conditional compilation are re-parsed using libclang.

[0069] Macro definition directives (#define) in macro definition directive nodes only recognize the __HEADER_GUARD__ macro, which is enabled by the --preprocess-remove-headerguard-directives-possible parameter. For macro definition directive nodes, the obfuscation method is to retain the macro definition and not perform macro expansion.

[0070] In this embodiment, steps S1 and S2 belong to the pre-processing obfuscation stage. This pre-processing obfuscation stage is different from the existing compilation pre-processing. Its main functions are as follows:

[0071] (1) Internal header file expansion: Only internal header files are expanded, and interface and external header files are not expanded; if possible, delete the __HEADER_GUARD__ related preprocessing directives such as: #if, #ifdef, #ifndef, #elif, #else, #endif, etc.; if possible, promote the unexpanded #include and directives to the top of the corresponding compilation unit;

[0072] (2) Delete the comments in the source code to be obfuscated;

[0073] (3) Keep the macro definition and do not expand the macro.

[0074] The pre-obfuscation phase uses lexical units, the product of libclang lexical analysis, as input. By analyzing the lexical units, it generates a pre-processing instruction tree. It then traverses the pre-processing instruction tree corresponding to the compilation unit to implement pre-obfuscation. Optional subsequent actions include formatting the results and cleaning up internal header files. After the pre-obfuscation phase is complete, it traverses the cached pre-processing modules and cleans up any header files that have already been internally expanded.

[0075] S3. Parsing all second compilation units of the first source code one by one to obtain an abstract syntax tree;

[0076] In practical applications, the entire first source code can be parsed into a second translation unit (TranslationUnit) instance through the libclang library.

[0077] S4 constructs a symbol table based on the abstract syntax tree;

[0078] Furthermore, step S4 may include: analyzing the abstract syntax tree using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generating the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0079] In this embodiment, a symbol is a unique name for a grammatical structure instance such as a variable, function, type, namespace, etc. For example, when referring to this symbol, no matter where it appears or how many times it appears, this symbol refers to the same symbol.

[0080] In this embodiment, the abstract syntax tree (AST) of each TranslationUnit instance can be traversed in sequence by calling the feed_tu of the scope (ScopeTree), analyzing the symbols, module scopes, and subscopes contained in the compilation unit, thereby completing the construction of the symbol table. During the symbol table construction process, the symbols are also renamed and recorded in the rename result module (RenameResultModule).

[0081] S5. Compile the first source code based on the symbol table to obtain obfuscated code.

[0082] Furthermore, step S5 may include: replacing corresponding symbols in the first source code based on the renamed names of the respective scope mappings in the symbol table to obtain obfuscated code.

[0083] In this embodiment, for a local scope, a strategy of prefix plus counter may be used for renaming; for a global scope, a strategy of type id plus prefix plus counter may be used for renaming.

[0084] In this embodiment, ScopeTree adopts a table-driven approach to AST analysis. It provides a walk_ series API (interface) with a visit callback parameter for traversing the AST, which provides convenience and flexibility for default and customized AST traversal. For example, in the example code _def_method: after the definition of the SymbolDef of the member function, the traversal of the member function scope is completed by reusing the _walk_scope and _visit_node combination.

[0085] In this embodiment, steps S3 to S5 belong to the symbol name obfuscation stage. The symbol name obfuscation stage uses the abstract syntax tree (AST) produced by libclang syntax analysis as input, constructs a scope-based symbol table through analysis, and simultaneously generates symbol renaming records in the process and stores them in the rename result module (RenameResultModule). Finally, the final source code obfuscation work is completed through the rename command (clang-rename command line) tool.

[0086] The symbol name obfuscation stage completes the replacement operation of the first source code content according to the symbol name obfuscation record in the RenameResultModule. In this embodiment, the clang-rename command line tool can be used to complete the symbol renaming and replacement work. This method only needs to build a symbol table containing symbol declarations and definitions.

[0087] In this embodiment, the source code obfuscation method performs lexical analysis on all first compilation units in the source code to be obfuscated one by one in the preprocessing obfuscation stage to obtain corresponding lexical units, and generates a preprocessing instruction tree based on all lexical units; obfuscation is performed in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree, thereby achieving the purpose of deleting the source code comments to be obfuscated and expanding its internal header files; in the symbol name obfuscation stage, all second compilation units in the first source code are parsed one by one to obtain an abstract syntax tree, a symbol table is constructed based on the abstract syntax tree, and the first source code is compiled based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming information such as variables, functions, and types in the source code; the present invention greatly increases the difficulty of rapid parsing of the source code through two-stage source code obfuscation, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result.

[0088] The source code obfuscation method of this embodiment can be implemented in Python, using the libclang library and clang-rename command. The method includes a pre-processing obfuscation stage and a symbol name obfuscation stage. In actual applications, the two stages can be controlled by command line parameters to execute in combination. This embodiment increases the difficulty of secondary development of source code by removing comments from C source code or C++ source code, expanding internal header files, and renaming variables, functions, and types, so as to ensure or delay the rapid replication of technological achievements. The advantages of the source code obfuscation method are: (1) the parsed product of the obfuscated source code is analyzed based on the libclang tool, ensuring the predictability and accuracy of the final obfuscation result; (2) the source code obfuscation method is implemented using Python scripts, with a simple algorithm and low development and maintenance costs.

[0089] The source code obfuscation method of this embodiment is not only an obfuscation tool for C and C++ language source code, but also serves as a universal model for source code analysis and processing, allowing for customized development based on actual project needs. For most projects that adhere to development standards, the source code obfuscation method of this embodiment can implement all obfuscation operations without any modifications. For projects that do not adhere to development standards, individual variables, functions, classes, files, and other problematic code can be masked using parameters.

[0090] Example 2

[0091] See Figure 2 As shown, this embodiment provides a source code obfuscation method comprising the following steps:

[0092] A1. Parse each third compilation unit in the obfuscated source code one by one to obtain an abstract syntax tree;

[0093] In practical applications, all source codes to be obfuscated can be parsed into second translation unit (TranslationUnit) instances through the libclang library.

[0094] A2 constructs a symbol table based on the abstract syntax tree;

[0095] Furthermore, step A2 may include: analyzing the abstract syntax tree using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generating the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0096] In this embodiment, a symbol is a unique name for a grammatical structure instance such as a variable, function, type, namespace, etc. For example, when referring to this symbol, no matter where it appears or how many times it appears, this symbol refers to the same symbol.

[0097] In this embodiment, the abstract syntax tree (AST) of each TranslationUnit instance can be traversed in sequence by calling the feed_tu of the scope (ScopeTree), analyzing the symbols, module scopes, and subscopes contained in the compilation unit, thereby completing the construction of the symbol table. During the symbol table construction process, the symbols are also renamed and recorded in the rename result module (RenameResultModule).

[0098] A3. Compile the source code to be obfuscated based on the symbol table to obtain obfuscated code.

[0099] Furthermore, step A3 may include: replacing corresponding symbols in the source code to be obfuscated based on the renamed names of the respective scope mappings in the symbol table to obtain the obfuscated code.

[0100] In this embodiment, for a local scope, a strategy of prefix plus counter may be used for renaming; for a global scope, a strategy of type id plus prefix plus counter may be used for renaming.

[0101] In this embodiment, ScopeTree adopts a table-driven approach to AST analysis. It provides a walk_ series API (interface) with a visit callback parameter for traversing the AST, which provides convenience and flexibility for default and customized AST traversal. For example, in the example code _def_method: after the definition of the SymbolDef of the member function, the traversal of the member function scope is completed by reusing the _walk_scope and _visit_node combination.

[0102] In this embodiment, the source code obfuscation method is mainly used for symbol name obfuscation. It takes the abstract syntax tree (AST) produced by libclang syntax analysis as input, constructs a scope-based symbol table through analysis, and simultaneously generates symbol renaming records in the process and stores them in the rename result module (RenameResultModule). Finally, the final source code obfuscation work is completed through the rename command (clang-rename command line) tool.

[0103] The method completes the replacement operation of the obfuscated source code content according to the symbol name obfuscation record in RenameResultModule. In this embodiment, the clang-rename command line tool can be used to complete the symbol renaming and replacement work. The method only needs to build a symbol table containing symbol declarations and definitions.

[0104] In this embodiment, an abstract syntax tree is obtained by parsing all third compilation units in the obfuscated source code one by one, a symbol table is constructed according to the abstract syntax tree, and the obfuscated source code is compiled based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming information such as variables, functions, and types in the source code; the present invention increases the difficulty of quickly parsing the source code, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result.

[0105] Example 3

[0106] See Figure 3 As shown, this embodiment provides a source code obfuscation system 3 which may include: a pre-processing unit 31 , a first obfuscation unit 32 , a parsing unit 33 , a construction unit 34 and a second obfuscation unit 35 .

[0107] A preprocessing unit 31 is configured to perform lexical analysis on all first compilation units in the source code to be obfuscated one by one to obtain corresponding lexical units, and generate a preprocessing instruction tree based on all the lexical units;

[0108] It should be noted that the preprocessing instruction tree includes at least one of the following types of preprocessing nodes:

[0109] Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes.

[0110] In this embodiment, the source code obfuscation system 3 is mainly used to confuse C source code and C++ source code. The first compilation unit generally uses a source code file in the .c or .cpp format. In actual application, the libclang tool can be used to perform lexical analysis on all the first compilation units in the obfuscated source code one by one to obtain the corresponding lexical units. The lexical units in the first compilation unit can be directly obtained through tu.get_tokens (extent = tu.cursor.extent), and the extent of the header file introduced internally, that is, the source code position range SourceRange, can be obtained by using a hack method to obtain the source code position.

[0111] In this embodiment, the LL(1) algorithm may be used to distribute instruction processing functions from top to bottom through a table-driven method to construct a pre-processing instruction tree.

[0112] A first obfuscation unit 32 is configured to perform obfuscation in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree to generate a first source code;

[0113] In this embodiment, different obfuscation methods are used for different types of preprocessing node categories. The specific obfuscation methods are as follows:

[0114] The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node;

[0115] The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit;

[0116] The obfuscation method of the comment node is to delete the comment corresponding to the comment node.

[0117] The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

[0118] In this embodiment, conditional instructions may include: #if, #ifdef, #ifndef, #elif, #else, #endif, etc. Conditional instructions are generally used to record and store information related to compilation conditions and file guards (__HEADER_GURARD__). When the conditional instruction is enabled and the __HEADER_GURARD_ attribute is true (True), if the corresponding preprocessing instruction can be deleted, the corresponding preprocessing instruction is deleted; otherwise, the instruction is written to the destination memory (dst) as is.

[0119] The obfuscation method for file include directive nodes is as follows: for expandable internal header files, recursively perform the replacement operation of the preprocessing module it points to, and write the result to dst. Avoid repeated expansion, for example: if the Top-Level (top-level node) is expanded for the first time, it will not be expanded again in all subsequent or sub-conditional contexts; for non-expandable header files: if it can be moved to the top, collect it; otherwise, write the directive as is to dst. File include directive records in the #include format (<angle brackets> or "double quotes"), if it is an internal header file, it points to the corresponding preprocessing module. The speed of preprocessing module search can be optimized, and the module relationship graph can be pre-built through TranslationUnit.get_includes(). Only those modules that are not included in the current compilation unit due to conditional compilation are re-parsed using libclang.

[0120] Macro definition directives (#define) in macro definition directive nodes only recognize the __HEADER_GUARD__ macro, which is enabled by the --preprocess-remove-headerguard-directives-possible parameter. For macro definition directive nodes, the obfuscation method is to retain the macro definition and not perform macro expansion.

[0121] In this embodiment, the processing of the preprocessing unit 31 and the first obfuscation unit 32 belongs to the preprocessing obfuscation stage. This preprocessing obfuscation stage is different from the existing compilation preprocessing. Its main functions are as follows:

[0122] (1) Internal header file expansion: Only internal header files are expanded, and interface and external header files are not expanded; if possible, delete the __HEADER_GUARD__ related preprocessing directives such as: #if, #ifdef, #ifndef, #elif, #else, #endif, etc.; if possible, promote the unexpanded #include and directives to the top of the corresponding compilation unit;

[0123] (2) Delete the comments in the source code to be obfuscated;

[0124] (3) Keep the macro definition and do not expand the macro.

[0125] The pre-obfuscation phase uses lexical units, the product of libclang lexical analysis, as input. By analyzing the lexical units, it generates a pre-processing instruction tree. It then traverses the pre-processing instruction tree corresponding to the compilation unit to implement pre-obfuscation. Optional subsequent actions include formatting the results and cleaning up internal header files. After the pre-obfuscation phase is complete, it traverses the cached pre-processing modules and cleans up any header files that have already been internally expanded.

[0126] A parsing unit 33, configured to parse all second compilation units in the first source code one by one to obtain an abstract syntax tree;

[0127] In practical applications, the entire first source code can be parsed into a second translation unit (TranslationUnit) instance through the libclang library.

[0128] A construction unit 34, configured to construct a symbol table according to the abstract syntax tree;

[0129] Furthermore, the construction unit 34 uses a table-driven method to analyze the abstract syntax tree to obtain the symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0130] In this embodiment, a symbol is a unique name for a grammatical structure instance such as a variable, function, type, namespace, etc. For example, when referring to this symbol, no matter where it appears or how many times it appears, this symbol refers to the same symbol.

[0131] In this embodiment, the abstract syntax tree (AST) of each TranslationUnit instance can be traversed in sequence by calling the feed_tu of the scope (ScopeTree), analyzing the symbols, module scopes, and subscopes contained in the compilation unit, thereby completing the construction of the symbol table. During the symbol table construction process, the symbols are also renamed and recorded in the rename result module (RenameResultModule).

[0132] The second obfuscation unit 35 is configured to compile the first source code based on the symbol table to obtain obfuscated code.

[0133] Furthermore, the second obfuscation unit 35 replaces corresponding symbols in the first source code based on the renamed names of the respective scope mappings in the symbol table to obtain obfuscated code.

[0134] In this embodiment, for a local scope, a strategy of prefix plus counter may be used for renaming; for a global scope, a strategy of type id plus prefix plus counter may be used for renaming.

[0135] In this embodiment, ScopeTree adopts a table-driven approach to AST analysis. It provides a walk_ series API (interface) with a visit callback parameter for traversing the AST, which provides convenience and flexibility for default and customized AST traversal. For example, in the example code _def_method: after the definition of the SymbolDef of the member function, the traversal of the member function scope is completed by reusing the _walk_scope and _visit_node combination.

[0136] In this embodiment, the processing of the parsing unit 33, the construction unit 34 and the second obfuscation unit 35 belongs to the symbol name obfuscation stage. The symbol name obfuscation stage takes the abstract syntax tree (AST) produced by the libclang syntax analysis as input, constructs a scope-based symbol table through analysis, and simultaneously generates symbol renaming records in this process and stores them in the rename result module (RenameResultModule). Finally, the final source code obfuscation work is completed through the rename command (clang-rename command line) tool.

[0137] The symbol name obfuscation stage completes the replacement operation of the first source code content according to the symbol name obfuscation record in the RenameResultModule. In this embodiment, the clang-rename command line tool can be used to complete the symbol renaming and replacement work. The source code obfuscation system 3 only needs to build a symbol table containing symbol declarations and definitions.

[0138] In this embodiment, in the preprocessing obfuscation stage, the source code obfuscation system 3 performs lexical analysis on all first compilation units in the source code to be obfuscated one by one through the preprocessing unit 31 to obtain corresponding lexical units, and generates a preprocessing instruction tree based on all lexical units; the parsing unit 33 uses a corresponding method to perform obfuscation based on the category of each preprocessing node in the preprocessing instruction tree, thereby achieving the purpose of deleting the comments of the source code to be obfuscated and expanding its internal header files; in the symbol name obfuscation stage, the parsing unit 33 parses all second compilation units in the first source code one by one to obtain an abstract syntax tree, the construction unit 34 constructs a symbol table based on the abstract syntax tree, and the second obfuscation unit 35 compiles the first source code based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming variables, functions, types and other information in the source code; the present invention greatly increases the difficulty of rapid parsing of the source code through two-stage source code obfuscation, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result.

[0139] Example 4

[0140] See Figure 4 As shown, this embodiment provides a source code obfuscation system 4 which may include: a parsing unit 41 , a construction unit 42 and a second obfuscation unit 43 .

[0141] A parsing unit 41 is configured to parse all third compilation units in the source code to be obfuscated one by one to obtain an abstract syntax tree;

[0142] In practical applications, all source codes to be obfuscated can be parsed into second translation unit (TranslationUnit) instances through the libclang library.

[0143] A construction unit 42, configured to construct a symbol table according to the abstract syntax tree;

[0144] Furthermore, the construction unit 42 uses a table-driven method to analyze the abstract syntax tree to obtain the symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

[0145] In this embodiment, a symbol is a unique name for a grammatical structure instance such as a variable, function, type, namespace, etc. For example, when referring to this symbol, no matter where it appears or how many times it appears, this symbol refers to the same symbol.

[0146] In this embodiment, the abstract syntax tree (AST) of each TranslationUnit instance can be traversed in sequence by calling the feed_tu of the scope (ScopeTree), analyzing the symbols, module scopes, and subscopes contained in the compilation unit, thereby completing the construction of the symbol table. During the symbol table construction process, the symbols are also renamed and recorded in the rename result module (RenameResultModule).

[0147] The second obfuscation unit 43 is configured to compile the source code to be obfuscated based on the symbol table to obtain obfuscated code.

[0148] Furthermore, the second obfuscation unit 43 replaces corresponding symbols in the source code to be obfuscated based on the renamed names of the scope mappings in the symbol table to obtain obfuscated code.

[0149] In this embodiment, for a local scope, a strategy of prefix plus counter may be used for renaming; for a global scope, a strategy of type id plus prefix plus counter may be used for renaming.

[0150] In this embodiment, ScopeTree adopts a table-driven approach to AST analysis. It provides a walk_ series API (interface) with a visit callback parameter for traversing the AST, which provides convenience and flexibility for default and customized AST traversal. For example, in the example code _def_method: after the definition of the SymbolDef of the member function, the traversal of the member function scope is completed by reusing the _walk_scope and _visit_node combination.

[0151] In this embodiment, the source code obfuscation system 4 is mainly used for symbol name obfuscation. It takes the abstract syntax tree (AST) produced by libclang syntax analysis as input, constructs a scope-based symbol table through analysis, and simultaneously generates symbol renaming records in the process and stores them in the rename result module (RenameResultModule). Finally, the final source code obfuscation work is completed through the rename command (clang-rename command line) tool.

[0152] The source code obfuscation system 4 completes the replacement operation of the obfuscated source code content based on the symbol name obfuscation record in the RenameResultModule. In this embodiment, the clang-rename command line tool can be used to complete the symbol renaming and replacement work. The source code obfuscation system 4 only needs to build a symbol table containing symbol declarations and definitions.

[0153] In this embodiment, the parsing unit 41 parses all the third compilation units in the obfuscated source code one by one to obtain an abstract syntax tree, uses the construction unit 42 to construct a symbol table according to the abstract syntax tree, and uses the second obfuscation unit 43 to compile the obfuscated source code based on the symbol table to obtain the obfuscated code, thereby achieving the purpose of renaming variables, functions, types and other information in the source code; the present invention increases the difficulty of quickly parsing the source code, thereby achieving the purpose of preventing the source code from being quickly copied, improving the protection of the source code, and ensuring the predictability and accuracy of the final obfuscation result.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A source code obfuscation method, characterized in that: include: Performing lexical analysis on all first compilation units in the source code to be obfuscated one by one to obtain corresponding lexical units, and generating a preprocessing instruction tree based on all the lexical units; Obfuscating the preprocessing nodes in the preprocessing instruction tree in a corresponding manner based on the category of the preprocessing nodes to generate a first source code; Parsing all second compilation units in the first source code one by one to obtain an abstract syntax tree; Constructing a symbol table according to the abstract syntax tree; The first source code is compiled based on the symbol table to obtain obfuscated code.

2. The source code obfuscation method according to claim 1, characterized in that: The preprocessing instruction tree includes at least one of the following types of preprocessing nodes: Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes; The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node; The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit; The obfuscation method of the comment node is: deleting the comment corresponding to the comment node; The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

3. The source code obfuscation method according to claim 1, characterized in that: The step of constructing a symbol table according to the abstract syntax tree comprises: The abstract syntax tree is analyzed using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and the symbol table is generated according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

4. A source code obfuscation method, characterized in that: include: Parse all third compilation units in the obfuscated source code one by one to obtain an abstract syntax tree; Constructing a symbol table according to the abstract syntax tree; The source code to be obfuscated is compiled based on the symbol table to obtain obfuscated code.

5. The source code obfuscation method according to claim 4, characterized in that: The step of constructing a symbol table according to the abstract syntax tree comprises: The abstract syntax tree is analyzed using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and the symbol table is generated according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

6. A source code obfuscation system, characterized in that: include: A preprocessing unit, configured to perform lexical analysis on all first compilation units in the source code to be obfuscated one by one to obtain corresponding lexical units, and generate a preprocessing instruction tree according to all the lexical units; A first obfuscation unit is configured to perform obfuscation in a corresponding manner based on the category of each preprocessing node in the preprocessing instruction tree to generate a first source code; a parsing unit, configured to parse all second compilation units in the first source code one by one to obtain an abstract syntax tree; A construction unit, configured to construct a symbol table according to the abstract syntax tree; The second obfuscation unit is configured to compile the first source code based on the symbol table to obtain obfuscated code.

7. The source code obfuscation system according to claim 6, characterized in that: The preprocessing instruction tree includes at least one of the following types of preprocessing nodes: Conditional instruction nodes, file include instruction nodes, macro definition instruction nodes, comment nodes and preprocessing instruction nodes; The obfuscation method of the conditional instruction node is: deleting the file protection character corresponding to the conditional instruction node; The obfuscation method of the file inclusion instruction node is: promoting the file inclusion instruction corresponding to the file inclusion instruction node to the top of the corresponding first compilation unit; The obfuscation method of the comment node is: deleting the comment corresponding to the comment node; The obfuscation method of the preprocessing instruction node is: deleting the preprocessing instruction corresponding to the preprocessing instruction node.

8. The source code obfuscation system according to claim 6, characterized in that: The construction unit analyzes the abstract syntax tree using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

9. A source code obfuscation system, characterized in that: include: A parsing unit, used to parse all third compilation units in the obfuscated source code one by one to obtain an abstract syntax tree; A construction unit, configured to construct a symbol table according to the abstract syntax tree; The second obfuscation unit is configured to compile the source code to be obfuscated based on the symbol table to obtain obfuscated code.

10. The source code obfuscation system according to claim 9, characterized in that: The construction unit analyzes the abstract syntax tree using a table-driven method to obtain symbols, parent scopes, and child scopes corresponding to each syntax node in the abstract syntax tree, and generates the symbol table according to the symbols, parent scopes, and child scopes corresponding to the syntax nodes.

Images