Mimicry thought-based code dynamic obfuscation compiling method, system and equipment

Abstract

The invention discloses a mimicry thought-based code dynamic obfuscation compiling method, system and equipment. The method comprises the following steps of: sensing a source code, and performing compiler annotation on a key function in combination with a large language model and expert knowledge; a global character string constant is extracted, an ASCII value of a character is coded into an MBA expression, a decoding function is inserted into a position where the constant is used, mimicry replacement is performed on an original character string in a data segment, and functions of other programs are disguised; adding a clone block irrelevant to function logic, and constructing a mimicry branch by using a dynamic opaque predicate as a jump condition; adding an equivalent heterogeneous shadow branch, and using a random predicate as a jump condition; a flower instruction is inserted, and an MBA expression is used for instruction replacement; and performing control flow flattening on the function. According to the method, the mimicry multi-variant thought is combined, accurate diversified confusion compilation is performed, and key fragments of program codes in the fields of industrial control, power grids, Internet of Things and the like are effectively protected.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a code dynamic obfuscation compilation method, system and equipment. Background Art

[0002] Among the many areas of information security, software security is particularly critical. As the core of modern information systems, software security directly determines the reliability and stability of the entire system. The digital assets in software face an increasing number of uncertain security threats. Through unauthorized reverse engineering techniques such as code analysis, debugging, and tampering, malicious attackers can illegally obtain sensitive data from software, posing the risk of violating user privacy and intellectual property rights. Alternatively, attackers can analyze program logic to identify entry points for advanced persistent threat attacks. To protect software from these threats, the industry has implemented a variety of security measures, one of which is code obfuscation technology.

[0003] Code obfuscation is a software protection method that changes the presentation of program code without altering its execution results, making it difficult for attackers to understand the program's logic and functionality. Obfuscated code is difficult to read and analyze directly, making reverse engineering more challenging. This technology plays a vital role in protecting intellectual property, preventing malicious tampering, and ensuring software security.

[0004] While existing code obfuscation technologies have played an important role in improving software security, they also have drawbacks and shortcomings. Most source code obfuscation methods are language- or platform-dependent, making their effectiveness against reverse engineering extremely limited. Defenses are even more challenging when attackers use automated reverse engineering tools and exploit unknown software vulnerabilities. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a code dynamic obfuscation compilation method, system and device based on the mimetic idea. Combined with the mimetic random idea, it obfuscates the structure of key code fragments while keeping the program functionality unchanged, and dynamically defends against reverse engineering.

[0006] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0007] In a first aspect, a method for dynamically obfuscating and compiling code based on mimicry is provided, comprising the following steps:

[0008] Combining large language models with expert knowledge, we analyze code semantics and syntax through the LLVM infrastructure. We identify key code snippets based on syntax and semantics, perform compiler annotations on key code snippets, and specify obfuscation methods and parameters.

[0009] Use the LLVM compiler to convert the source code of the program to be obfuscated into the LLVM IR intermediate language;

[0010] Extract global string constants based on the LLVM IR intermediate language and encode the ASCII values ​​of the characters in the string constants into MBA expressions. Replace the original plaintext string with a pseudo-string, insert a decoding function, and decrypt it at runtime. The pseudo-string is a semantically unrelated string.

[0011] Based on the mimicry concept, pre-constructed mimic clone blocks are inserted into key code snippets to construct mimic branches. The code logic of the mimic clone blocks is completely independent of the program. By selecting constants and variables in the program to construct opaque predicates as the judgment conditions of the mimic branches, the program only executes the original blocks and not the mimic clone blocks.

[0012] Insert a shadow branch of the key code snippet, construct a random predicate by calling a random function, and use the random predicate as the judgment condition of the shadow branch statement. The two branches of the judgment condition are the key code snippet and the shadow branch of the key code snippet;

[0013] Inserting junk instructions into key code snippets. These junk instructions are some junk binary codes. While ensuring the correct execution of the original program, the binary program cannot be correctly decompiled.

[0014] Perform instruction replacement obfuscation, replacing the logical operations with a combination of arithmetic and Boolean operations;

[0015] Perform control flow flattening transformation on the entire program.

[0016] Furthermore, based on the code syntax and semantics, key code snippets are identified, including:

[0017] Combine large language models with expert knowledge to analyze code logic and perceive code semantics;

[0018] Obtain the code syntax based on the relevant interfaces provided by LLVM;

[0019] Identify important code snippets with key logical functions based on code syntax and semantics;

[0020] Compiler annotations are provided for key code snippets, specifying obfuscation methods and parameters, including:

[0021] Compiler annotations are performed at the fine-grained level of the function, and the obfuscation strategy and related parameters are specified in the annotations in a given format.

[0022] Furthermore, the global string constants are extracted, and the ASCII values ​​of the characters in the string constants are encoded into MBA expressions. The original plaintext string is replaced with a pseudo string, and a decoding function is inserted to decrypt it at runtime, including:

[0023] Extract the global string constant and encode the ASCII value of each character in the string into a nonlinear MBA expression;

[0024] Write a decryption function and insert it where the string constant is used. Dynamically calculate the ASCII value of each character and reassemble it into a string for the program to use. Decrypt it as needed at runtime and decrypt the string constant to the stack for use at runtime.

[0025] In the data segment, the original string constant is replaced with a pseudo string, which has nothing to do with the semantics of the original string.

[0026] Furthermore, insert the mimic clone block branch to construct the mimic branch, including:

[0027] Mimic clone blocks are pre-constructed, and their code logic and functionality are independent of the program;

[0028] Add if / else conditional statements, where the condition is a dynamic opaque predicate with a constant calculation result;

[0029] One branch of the judgment condition is the critical code fragment, and the other branch is a mimic branch that will never be executed.

[0030] Furthermore, the shadow branch of the key code snippet is constructed by the following method, including:

[0031] Clone all statements and information of key code snippets;

[0032] Insert junk instructions that do not affect program execution;

[0033] Use MBA expressions to replace operators with instructions.

[0034] Furthermore, shadow branches of key code snippets are inserted, including:

[0035] Use the random predicate as the judgment condition for the newly inserted branch statement;

[0036] Add if / else conditional statements, and the judgment condition is a random predicate;

[0037] One branch of the judgment condition is the key code fragment, and the other branch is a shadow branch that is equivalent and heterogeneous to the key code fragment.

[0038] Furthermore, the entire program is transformed into a control flow flattening transformation, including:

[0039] Split the function body into multiple basic statement blocks and build a flow chart;

[0040] All split statement blocks are processed with switch branches, and a state variable is used to control the execution order of basic blocks.

[0041] Secondly, a code dynamic obfuscation compilation system based on mimicry is provided, including:

[0042] Code Perception Module: This module combines a large language model with expert knowledge to analyze code syntax and semantics. It uses the LLVM infrastructure to obtain basic code information and analyze code syntax. Based on the code syntax and semantics, it identifies key code snippets. It also provides compiler annotations for key code snippets and specifies obfuscation methods and parameters.

[0043] Intermediate code IR generation module: used to convert the source code of the program to be obfuscated into LLVM IR intermediate language using the LLVM compiler;

[0044] String constant encryption module: used to extract global string constants based on the LLVM IR intermediate language, encode the ASCII values ​​of the characters in the string constants into MBA expressions; replace the original plaintext string with a pseudo-string, and insert a decoding function to decrypt it as needed at runtime. The pseudo-string is a semantically unrelated string.

[0045] Mimetic branch statement insertion module: Based on mimetic thinking, it is used to insert pre-constructed mimetic clone blocks into key code snippets to construct mimetic branches. The mimetic clone block code logic is completely independent of the program. By selecting constants and variables in the program to construct opaque predicates as the judgment conditions for the mimetic branch, the program only executes the original block and does not execute the mimetic clone block.

[0046] Shadow branch statement insertion module: used to insert shadow branches of key code snippets. It constructs random predicates by calling random functions and uses the random predicates as the judgment conditions of shadow branch statements. The two branches of the judgment conditions are the key code snippet and the shadow branch of the key code snippet.

[0047] Garbage instruction insertion module: used to insert garbage instructions into key code snippets. The garbage instructions are some junk binary codes. At the same time, they ensure the correct execution of the original program, but the binary program cannot be correctly decompiled.

[0048] MBA instruction replacement module: used to perform instruction replacement obfuscation, equivalently replacing the logical operations with a combination of arithmetic operations and Boolean operations;

[0049] Control flow flattening module: used to perform control flow flattening transformation on the entire program.

[0050] In a third aspect, the present invention also provides a computer device comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the code dynamic obfuscation compilation method based on mimicry as described in the first aspect is implemented.

[0051] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the code dynamic obfuscation compilation method based on mimicry as described in the first aspect.

[0052] Beneficial effects: The present invention provides a low-cost, efficient compile-time obfuscation method that is resistant to reverse analysis. By applying the concept of mimicry, the structure of key code fragments is obfuscated without changing the functionality of the program. By strengthening the program control flow and static elements during the compile-time period, it can effectively resist reverse analysis and defend against various unknown attacks and threats against the software. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 Schematic diagram of the flow of the code dynamic obfuscation compilation method based on the mimicry concept of the present invention;

[0054] Figure 2 A schematic diagram of the control flow of inserting a mimicking clone block in the present invention;

[0055] Figure 3 The structural block diagram of the code dynamic obfuscation compilation system based on the mimicry concept of the present invention. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings.

[0057] The embodiment of the present invention provides a method for dynamically obfuscating and compiling code based on mimicry. Figure 1 , the method comprises the following steps:

[0058] Step S10: Analyze the source code syntax and semantics to identify key and important code snippets;

[0059] The purpose of this step is to obtain characteristic information within the code and identify key code snippets, thereby performing precise obfuscation and reducing the program runtime overhead introduced by code obfuscation. The characteristic information of the code mainly includes two aspects: code semantics, that is, the actual meaning and logic of the code; and code syntax, that is, the structure and rules of the code. For code semantics, perception is achieved by combining a large language model with advanced reasoning capabilities and expert knowledge. Code syntax information is collected with the help of the LLVM compiler infrastructure. LLVM provides multiple interfaces that can traverse all functions in a module and all basic blocks in a function; use the pred_begin() and pred_end() methods of the BasicBlock object to calculate the in-degree of a basic block; determine the specific type of the instruction through the return value of getOpcode(); and traverse all GlobalVariables in the Module to obtain constants in the program.

[0060] By analyzing code syntax and semantics, it is possible to identify which code snippets are critical. The present invention selects critical code snippets based on instruction characteristics, including the following steps: obtaining all instructions; counting the number of system call or function call instructions in the code snippets, denoted as m; counting the total number of binary operation instructions in the code snippets, denoted as n; counting the total number of instructions in the code snippets, denoted as t; and when m>0 and n>0, selecting the code snippet with the largest t value as the critical code snippet.

[0061] Step S20: perform compiler annotation on key code snippets and specify obfuscation methods and parameters;

[0062] For code snippets that need to be obfuscated, specify the obfuscation strategy and related parameters in order to tag the compiler. Source code comments will be discarded and ignored during the pre-compilation phase, while compiler comments are used as metadata to

[0063] The @llvm.global.annotations format is retained in the LLVM intermediate representation, and compiler annotations are not retained in the final generated executable file. Specifically, in the embodiment of the present invention, the __attribute__((annotate("str"))) syntax provided by the LLVM-based compiler Clang is used to insert compiler annotations before the function declaration of the key code snippet. The specified obfuscation strategy and parameters are passed in the form of metadata, which allows for refined obfuscation in the subsequent specific implementation.

[0064] Step S30: using LLVM functions to convert the high-level language into IR intermediate language;

[0065] The overall architecture of LLVM also follows a three-stage design: front-end, optimizer, and back-end. Utilizing LLVM's functional features, different high-level language source codes are processed by the front-end to generate specific data structures, which are then used to generate the corresponding LLVM IR intermediate language, a unified representation independent of the source language and target architecture. LLVM IR is a complete and comprehensive code representation format. It is a RISC-style virtual instruction set that supports labels, is strongly typed, and follows the intermediate representation of the static single assignment (SSA) form. LLVM IR is the core architecture of LLVM, decoupling different high-level programming languages ​​(C / C++, Rust, Swift, etc.) from hardware architectures (X86, ARM, LoongArch, etc.), achieving "one-time optimization and multiple reuse."

[0066] Therefore, in the implementation of the present invention, the Clang compiler is used to convert the source code of the program to be obfuscated into LLVM IR, and the LLVM IR is obfuscated in the next step.

[0067] Step S40: extracting global string constants and encoding the ASCII values ​​of the characters into MBA expressions;

[0068] Using the LLVM interface, retrieve global variables from the entire program and determine whether they are strings. Treat each char character in the string as an 8-bit unsigned integer and encode each integer as a linear MBA expression. An MBA expression is a complex expression that mixes arithmetic and bitwise operators. The result of an MBA expression is constant; regardless of the input variables, the result is always the ASCII code of the character. For example, if the ASCII code for the character e is 101, the encoded MBA expression is: 0-111*(x&y)-101*(x&~y)+11*~(x&~y)-1*~(x^y)-111*~(x|y)-112*~(x|~y). This expression always evaluates to 101.

[0069] Step S50: Perform mimicry replacement on the original character string in the data segment and insert a decryption function where the character string is used;

[0070] The data segment is an area in the program's memory layout. The data in the initialized data segment will be directly stored in the binary file compiled by the program and will be extracted by reverse analysis, so it must be protected. The original string in the .data data segment stored in the binary program will be replaced with a pseudo-string to disguise the program with other functions. For example, in a C language program, a UTF-8 encoded string constant "Information Security" has the ASCII code 0xE4, 0xBF, 0xA1, 0xE6, 0x81, 0xAF, 0xE5, 0xAE, 0x89, 0xE5, 0x85, 0xA8. The present invention replaces this character with firefighters, whose ASCII code is 0x66, 0x69, 0x72, 0x65, 0x66, 0x69, 0x67, 0x68, 0x74, 0x65, 0x72, 0x73. The strings before and after the replacement are completely unrelated. The replaced mimicked strings will convey wrong information to the attacker and mislead the reverse analysis.

[0071] For each string constant, we iterate through all used locations and insert a decryption function. The decryption function's code logic is as follows: allocate a new memory segment on the stack with the same length as the original string; use the shuffle function to shuffle the character decoding order; use the ASCII code of the corresponding pseudo-character in the data segment as input, insert the calculation logic of the MBA expression to obtain the ASCII value of the original character; store the original character in the corresponding location in the new memory, and then reconstruct the original string; once all characters have been decoded and stored in the allocated memory, the memory segment containing the string is available for use by the program.

[0072] Step S60: inserting a logic-independent mimetic clone block, using a dynamic opaque predicate as a jump, and constructing a mimetic branch;

[0073] The user gives a probability based on the obfuscation strength requirement and decides whether to insert a mimic clone block into the basic block of the key code fragment to be obfuscated. The control flow of inserting a mimic clone block is shown as follows: Figure 2 shown.

[0074] Construct a mimetic clone block, whose code logic is completely unrelated to the obfuscated program, and is used to disguise the functions of other programs and confuse the code semantics. The steps to construct a mimetic clone block are: select other programs whose functions are unrelated to the program to be obfuscated; use Clang to compile the other programs into LLVM IR; select basic blocks from the other programs; based on the basic blocks selected from the other programs, align the variable types and bit lengths with the basic blocks to be obfuscated; finally, according to Figure 2 As shown, insert the mimic clone block.

[0075] According to the mimicry defense principle, the present invention uses dynamic opaque predicates as mimicry branch judgment conditions. A dynamic opaque predicate is an expression that is always true or always false. However, due to its complexity, decompilation tools such as IDA cannot reason about it and further simplify it. The predicate calculation no longer uses global variables in the BSS segment, but uses constants and variables normally used in the program. By using dynamic opaque predicates, it is ensured that the mimicry clone block will never be executed. An example of a dynamic opaque predicate is similar to (x 2 +x)%2 is always equal to 0, (x 2 -34y 2 ) is never equal to -1, these are mathematically proven formulas.

[0076] Step S70: inserting equivalent heterogeneous shadow branches and using random predicates as jumps;

[0077] The user also needs to give a probability to decide whether to insert a shadow branch for a basic block to be obfuscated. Construct a shadow branch for the critical code. Using software diversification techniques based on mimicry defense, a basic block in a function is processed in a diversified manner, achieving heterogeneous obfuscation while maintaining the original logic. Use a random predicate as the jump condition for the shadow branch. A random predicate means that the true or false result of the predicate is random. Use the rdrand instruction or call the time() function to generate random numbers and calculate the random predicate, which can interfere with the analysis of certain symbolic execution engines. An example of a random predicate is "randomVar%2==0," which is a formula with a random result that can be either true or false.

[0078] The present invention combines the construction of mimic branches and shadow branches to further enhance the anti-reverse analysis capability of key code fragments and reflect the heterogeneity and diversity in the mimicry concept.

[0079] Step S80: inserting flower instructions into the key code snippet;

[0080] It should be understood that junk instructions are a method of concealing code blocks (or other functionality) that are not intended to be reverse engineered. These instructions are carefully designed to address the process and flaws of disassembly algorithms, such as the inability to distinguish between data and code or the inability to accurately determine the destination address of indirect transfers. While ensuring the correct execution of the original program, they interfere with the disassembly results. A junk instruction library is pre-constructed, randomly selected from the library, and inserted into key code snippets using the LLVM interface in assembly language format.

[0081] Step S90: using MBA expressions to perform instruction replacement;

[0082] It should be understood that Mixed Boolean-Arithmetic (MBA), as an obfuscation method, is often used to protect core algorithms in malware and software reinforcement due to its low overhead, high robustness, and ease of use. This obfuscation technology replaces the original logical operations with arithmetic operations (ADD, IMUL) and Boolean operations (AND, OR, NOT) to achieve the obfuscation effect. However, current methods to combat MBA obfuscation are either designed for specific patterns or produce a large number of erroneous results in practice. The fundamental reason for the difficulty in resisting MBA obfuscation is that the mixture of arithmetic and Boolean operations makes conventional simplification rules (commutative law, associative law, distributive law) impossible to use.

[0083] To perform MBA instruction replacement, the user specifies the probability of instruction replacement for each operator. First, multiple MBA expressions are generated for each operator and converted into the Reverse Polish Notation (RPN) format. The operator of the RPN expression is placed after the operator, making it easier to replace. Second, the user specifies the probability of instruction replacement for each operator. Third, all operators in the key code snippet are traversed, and the decision on whether to replace is made based on the given probability. Finally, an MBA expression is randomly selected, and a calculation instruction is generated based on the MBA expression, the left operand, and the right operand of the replaced operator. Finally, the generated calculation instruction is replaced with the original instruction to complete the instruction replacement. Without changing the program semantics, some logical operation instructions or arithmetic operation instructions are equivalently converted into a combination of multiple instructions to achieve the purpose of obfuscating the program and increase the difficulty of reverse engineering.

[0084] Step S100: performing control flow flattening transformation on the entire program.

[0085] Control flow flattening is an obfuscation technique used to increase the logical complexity of a program: it splits the function body into multiple statement blocks and constructs a flow chart; it handles all split branch structure statement blocks with switch / case; it uses a state variable to control the logical order; and it reorganizes the program's control flow structure, converting the original branch structure into a series of linear code blocks. This makes the program's control flow difficult to understand and increases the difficulty of reverse engineering. According to an embodiment of the present invention, the if / else and for / while structures in the source code are equivalently replaced with switch / case structures, the basic block relationships in the function control flow graph are reorganized, and a "main dispatcher" is inserted to control the execution flow of the basic blocks.

[0086] The present invention provides a low-cost, efficient compile-time obfuscation method that is resistant to reverse analysis. By using the concept of mimicry, the structure of key code fragments is obfuscated while the program functionality remains unchanged. By strengthening the program control flow (inserting mimicry blocks and shadow blocks) and static elements (string encryption) during compile time, it can effectively resist reverse analysis and defend against various unknown attacks and threats against software.

[0087] Figure 3 This is a structural block diagram of the code dynamic obfuscation compilation device and system based on the mimicry concept of the present invention.

[0088] like Figure 3 As shown, the code dynamic obfuscation system proposed in the embodiment of the present invention includes: a code perception module 10, an intermediate code IR generation module 20, a string constant encryption module 30, a mimetic branch statement insertion module 40, a shadow branch statement insertion module 50, a junk instruction insertion module 60, an MBA instruction replacement module 70 and a control flow flattening module 80.

[0089] The code perception module 10 is used to perform code perception on program source code. It combines a large language model with expert knowledge to analyze code semantics; uses LLVM-related interfaces to collect basic code information; identifies key and important code snippets and adds compiler annotations.

[0090] The intermediate code IR generation module 20 is used to convert the source code into the LLVM IR intermediate language by using the LLVM compiler infrastructure.

[0091] The string constant encryption module 30 is used to encrypt global string variables. It encodes global string constants using MBA expressions, inserts decoding functions where the strings are used, and decrypts them at runtime. In addition, it replaces the original strings in the data segment with simulated strings.

[0092] The mimetic branch statement insertion module 40 is used to add mimetic branches. Based on the mimetic concept, it inserts a pre-constructed mimetic clone block and selects constants and variables in the program to construct an opaque predicate as the judgment condition for the mimetic branch. The program always executes only the original block and not the mimetic clone block.

[0093] The shadow branch statement inserting module 50 is used to insert a shadow branch, and uses a random predicate as a judgment condition for the newly inserted branch statement, wherein the two branches of the judgment condition are a key code fragment and a shadow branch of the key code fragment.

[0094] The junk instruction inserting module 60 is used to insert junk instructions into the key code segments. The junk instructions are some junk codes, which ensure the correct execution of the original program, but the binary program cannot be correctly decompiled.

[0095] The MBA instruction replacement module 70 is used to perform instruction replacement obfuscation. The logical operation in the equivalent replacement is a combination of arithmetic operations and Boolean operations.

[0096] The control flow flattening module 80 is used to perform control flow flattening transformation on the entire program.

[0097] It should be understood that the code dynamic obfuscation compilation system based on mimicry in this embodiment can implement all the technical solutions in the above method embodiments, and the functions of its various functional modules can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can refer to the relevant description in the above method embodiments, which will not be repeated here.

[0098] Another embodiment of the present invention provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the code dynamic obfuscation compilation method based on mimicry are implemented as described above.

[0099] Another embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the code dynamic obfuscation compilation method based on the mimicry concept are implemented as described above.

[0100] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus (systems), computer devices, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] The present invention is described with reference to flowcharts of methods according to embodiments of the present invention. It should be understood that each process in the flowcharts and combinations of processes in the flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts. Figure 1 A device that specifies functions in a process or multiple processes.

[0102] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A function specified in a process or multiple processes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 The steps of a specified function in a process or multiple processes.

Claims

1. A code dynamic obfuscation compilation method based on mimicry, characterized in that: The following steps are involved: Combining large language models with expert knowledge, we analyze code semantics and syntax through the LLVM infrastructure. We identify key code snippets based on syntax and semantics, perform compiler annotations on key code snippets, and specify obfuscation methods and parameters. Use the LLVM compiler to convert the source code of the program to be obfuscated into the LLVM IR intermediate language; Extract global string constants based on the LLVM IR intermediate language and encode the ASCII values ​​of the characters in the string constants into mixed Boolean arithmetic expressions (MBAs). Replace the original plaintext string with a pseudo-string, insert a decoding function, and decrypt it at runtime. The pseudo-string is a semantically unrelated string. Based on the mimicry concept, pre-constructed mimic clone blocks are inserted into key code snippets to construct mimic branches. The code logic of the mimic clone blocks is completely independent of the program. By selecting constants and variables in the program to construct opaque predicates as the judgment conditions of the mimic branches, the program only executes the original blocks and not the mimic clone blocks. Insert a shadow branch of the key code snippet, construct a random predicate by calling a random function, and use the random predicate as the judgment condition of the shadow branch statement. The two branches of the judgment condition are the key code snippet and the shadow branch of the key code snippet; Inserting junk instructions into key code snippets. These junk instructions are some junk binary codes. While ensuring the correct execution of the original program, the binary program cannot be correctly decompiled. Perform instruction replacement obfuscation, replacing the logical operations with a combination of arithmetic and Boolean operations; Perform control flow flattening transformation on the entire program.

2. The method according to claim 1, characterized in that Identify key code snippets based on code syntax and semantics, including: Combine large language models with expert knowledge to analyze code logic and perceive code semantics; Obtain the code syntax based on the relevant interfaces provided by LLVM; Identify important code snippets with key logical functions based on code syntax and semantics; Compiler annotations are provided for key code snippets, specifying obfuscation methods and parameters, including: Compiler annotations are performed at the fine-grained level of the function, and the obfuscation strategy and related parameters are specified in the annotations in a given format.

3. The method according to claim 1, characterized in that Extract the global string constant and encode the ASCII value of the characters in the string constant into an MBA expression; Replace the original plaintext string with a mimic string and insert a decoding function to decrypt it at runtime, including: Extract the global string constant and encode the ASCII value of each character in the string into a nonlinear MBA expression; Write a decryption function and insert it where the string constant is used. Dynamically calculate the ASCII value of each character and reassemble it into a string for the program to use. Decrypt it as needed at runtime and decrypt the string constant to the stack for use at runtime. In the data segment, the original string constant is replaced with a pseudo string, which has nothing to do with the semantics of the original string.

4. The method according to claim 1, wherein Insert the mimic clone block branch and construct the mimic branch, including: Mimic clone blocks are pre-constructed, and their code logic and functionality are independent of the program; Add if / else conditional statements, where the condition is a dynamic opaque predicate with a constant calculation result; One branch of the judgment condition is the critical code fragment, and the other branch is a mimic branch that will never be executed.

5. The method according to claim 1, characterized in that The shadow branch of the key code snippet is constructed by the following methods, including: Clone all statements and information of key code snippets; Insert junk instructions that do not affect program execution; Use MBA expressions to replace operators with instructions.

6. The method according to claim 1, characterized in that Insert shadow branches of key code snippets, including: Use the random predicate as the judgment condition for the newly inserted branch statement; Add if / else conditional statements, and the judgment condition is a random predicate; One branch of the judgment condition is the key code fragment, and the other branch is a shadow branch that is equivalent and heterogeneous to the key code fragment.

7. The method according to claim 1, characterized in that Perform control flow flattening transformation on the entire program, including: Split the function body into multiple basic statement blocks and build a flow chart; All split statement blocks are processed with switch branches, and a state variable is used to control the execution order of basic blocks.

8. A code dynamic obfuscation compilation system based on mimicry, characterized by: include: Code Perception Module: This module combines a large language model with expert knowledge to analyze code syntax and semantics. It uses the LLVM infrastructure to obtain basic code information and analyze code syntax. Based on the code syntax and semantics, it identifies key code snippets. It also provides compiler annotations for key code snippets and specifies obfuscation methods and parameters. Intermediate code IR generation module: used to convert the source code of the program to be obfuscated into LLVM IR intermediate language using the LLVM compiler; String constant encryption module: used to extract global string constants based on the LLVM IR intermediate language, encode the ASCII values ​​of the characters in the string constants into MBA expressions; replace the original plaintext string with a pseudo-string, and insert a decoding function to decrypt it at runtime. The pseudo-string is a semantically unrelated string. Mimetic branch statement insertion module: Based on mimetic thinking, it is used to insert pre-constructed mimetic clone blocks into key code snippets to construct mimetic branches. The mimetic clone block code logic is completely independent of the program. By selecting constants and variables in the program to construct opaque predicates as the judgment conditions for the mimetic branch, the program only executes the original block and does not execute the mimetic clone block. Shadow branch statement insertion module: used to insert shadow branches of key code snippets. It constructs random predicates by calling random functions and uses the random predicates as the judgment conditions of shadow branch statements. The two branches of the judgment conditions are the key code snippet and the shadow branch of the key code snippet. Garbage instruction insertion module: used to insert garbage instructions into key code snippets. The garbage instructions are some junk binary codes. At the same time, they ensure the correct execution of the original program, but the binary program cannot be correctly decompiled. MBA instruction replacement module: used to perform instruction replacement obfuscation, equivalently replacing the logical operations with a combination of arithmetic operations and Boolean operations; Control flow flattening module: used to perform control flow flattening transformation on the entire program.

9. A computer device comprising: one or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the code dynamic obfuscation compilation method based on mimicry concept as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for dynamically obfuscating and compiling code based on mimicry as claimed in any one of claims 1 to 7 is implemented.

Images