Code processing method and device, computing equipment and storage medium

Abstract

The invention discloses a code processing method and device, computing equipment and a storage medium. The method comprises the steps that JavaScript source codes needing to be protected are acquired; generating an instruction mapping table, wherein the instruction mapping table generated each time has uniqueness; according to the current instruction mapping table, the source code is compiled into a target code containing a virtual instruction, and the virtual instruction is an instruction which does not have the actual operation meaning and is only used for mapping; an interpreter is generated, the interpreter is matched with the current instruction mapping table and used for analyzing the target code generated through current compiling and analyzing a virtual instruction in the target code into a virtual machine instruction, and the virtual machine instruction is an instruction capable of being recognized and executed by a JavaScript engine; outputting the interpreter and the target code; therefore, dynamic instruction obfuscation is realized, a code structure which is difficult to predict through historical codes is constructed, the difficulty of code reverse cracking is improved, static decompilation analysis is effectively prevented, and the code security is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a code processing method, apparatus, computing device, and storage medium. Background Technology

[0002] With the rapid development of internet technology and web applications, JavaScript has become the mainstream scripting language in web front-end development. It is widely used to implement rich page interactive functions and security-sensitive functions such as front-end risk control, anti-crawler detection, and device fingerprinting. However, because JavaScript scripts are transmitted in plaintext and executed in the client browser, attackers can easily use browser-built-in developer tools (such as Chrome DevTools) or abstract syntax tree (AST) parsing tools (such as Babel) to analyze, decompile, and extract JavaScript code, thereby exposing sensitive logic, algorithms, and business rules in the code, posing a huge security risk.

[0003] The information disclosed in this background section is included only to enhance the understanding of the context of this disclosure, and therefore may contain information that does not constitute relevant technology currently known to those skilled in the art. Summary of the Invention

[0004] This application provides a code processing method, apparatus, computing device, and storage medium to address the problem of insufficient protection strength in JavaScript protection schemes in related technologies.

[0005] The technical solution adopted in this application is as follows.

[0006] Firstly, this application provides a code processing method, the method comprising: Obtain the JavaScript source code that needs protection; An instruction mapping table is generated, which is obtained by establishing a randomized mapping relationship between source code operations and virtual instructions, wherein each generated instruction mapping table is unique; According to the current instruction mapping table, the source code is compiled into object code containing virtual instructions, which are instructions that have no actual operational meaning and are only used for mapping. Generate an interpreter, which matches the current instruction map to parse the target code generated by the current compilation, and parses the virtual instructions in the target code into virtual machine instructions, which are instructions that the JavaScript engine can recognize and execute; Outputs the interpreter and the target code.

[0007] Thus, this application achieves JavaScript code obfuscation protection by regenerating a unique instruction mapping table with each compilation. This dynamic instruction mapping table, through randomized mapping relationships, makes each generated table unpredictable and difficult to reconstruct, enhancing code security. Similarly, the interpreter matching the current instruction mapping table is also regenerated each time the code is compiled. This dynamic instruction obfuscation constructs a code structure that is difficult to predict using historical code, increasing the difficulty of reverse engineering and effectively preventing static decompilation analysis, thereby improving code security. Furthermore, this application is a pure JavaScript obfuscation, and the resulting product is suitable for running in a pure JS environment. It achieves compatibility with older browsers, solving the problems of browser incompatibility and obvious call characteristics inherent in WebAssembly protection detection schemes.

[0008] In conjunction with the first aspect, in one possible implementation, a randomized mapping relationship is established between source code operations and virtual instructions, including: randomly sorting multiple nodes of a pre-prepared abstract syntax tree, and determining the randomized sequence number corresponding to each node as a virtual instruction, thereby establishing a mapping relationship between nodes and virtual instructions.

[0009] Thus, by establishing a mapping relationship through random sorting of the nodes of the abstract syntax tree, this application effectively prevents attackers from reconstructing the mapping relationship through static analysis of the abstract syntax tree nodes, thereby further increasing the difficulty of reverse analysis.

[0010] In conjunction with the first aspect, in one possible implementation, the instruction mapping table includes the mapping relationship between the nodes of the abstract syntax tree and the virtual instructions; the method also includes: parsing the source code into an abstract syntax tree, preprocessing the abstract syntax tree, and obtaining a node sequence formed by arranging multiple nodes of the abstract syntax tree in order. According to the current instruction mapping table, the source code is compiled into target code containing virtual instructions, including: querying the instruction mapping table, converting the nodes in the node sequence into corresponding virtual instructions, thereby obtaining target code containing virtual instructions.

[0011] In conjunction with the first aspect, in one possible implementation, the instruction map table includes the mapping relationship between nodes of the abstract syntax tree and virtual instructions; the generator interpreter includes: for each virtual instruction in the instruction map table, querying a preset instruction set to obtain the virtual machine instruction corresponding to the virtual instruction, and establishing a parsing logic between each virtual instruction and its corresponding virtual machine instruction; wherein, the preset instruction set includes multiple nodes of a pre-prepared abstract syntax tree and their corresponding multiple virtual machine instructions.

[0012] Thus, establishing the parsing logic between virtual instructions and virtual machine instructions in the interpreter based on the instruction mapping table is beneficial for the interpreter to quickly convert the virtual instructions of the target code into executable virtual machine instructions after the interpreter is loaded in the front end.

[0013] In conjunction with the first aspect, one possible implementation method also includes: performing syntax downgrading on the source code when it is obtained.

[0014] In this way, the source code is downgraded in syntax, and instruction set is simplified through syntax-level compression, thereby improving compilation speed, reducing interpreter size, and enhancing obfuscation effects.

[0015] In conjunction with the first aspect, in one possible implementation, the output of the interpreter and the target code includes: obfuscating the interpreter and the target code and then outputting them as a JavaScript file.

[0016] Thus, based on achieving dynamic instruction obfuscation, the interpreter and target code are further obfuscated and output as a single JavaScript file, which destroys the derivability of the instruction set mapping relationship and fundamentally eliminates the possibility of hackers forging custom interpreters.

[0017] In conjunction with the first aspect, in one possible implementation, generating the interpreter includes: establishing environment monitoring logic, which is used to determine whether the attributes of the interpreter's host environment belong to the characteristic attributes of the automation framework; if so, an error is thrown.

[0018] In this way, by using environmental monitoring logic, the interpreter can be effectively prevented from executing in abnormal browser environments (such as debuggers or automation tools), thus preventing the code from being maliciously debugged or analyzed and further improving the security of the code.

[0019] Secondly, this application also provides code processing methods, including: Obtain the interpreter and target code, wherein: the interpreter matches the instruction map; both the instruction map and the interpreter are generated once during each compilation of the JavaScript source code, and each generated instruction map is unique. The instruction map is obtained by establishing a randomized mapping relationship between the operations of the source code and virtual instructions; the target code contains virtual instructions and is obtained by compiling the source code according to the instruction map. Virtual instructions are instructions that do not have actual operational meaning and are only used for mapping. The parsing results, which contain virtual machine instructions, obtained by the interpreter from the target code, are executed to achieve the functionality corresponding to the source code. Virtual machine instructions are instructions that the JavaScript engine can recognize and execute.

[0020] Thus, because the instruction mapping table and interpreter change dynamically with each compilation, dynamic instruction obfuscation is achieved, creating a code structure that is difficult to predict using historical code. This increases the difficulty of reverse engineering the code, effectively preventing static decompilation analysis and improving code security. Furthermore, since the interpreter is generated synchronously at compile time and matched with the instruction mapping table, the process of the interpreter parsing virtual instructions to restore virtual machine instructions ensures that the protected code's functionality is consistent with the source code's functionality, thereby enhancing code security.

[0021] Thirdly, this application also provides a code processing apparatus. The code processing apparatus includes modules for executing the code processing method in the first aspect or any optional implementation of the first aspect. For example, the code processing apparatus includes: The code retrieval module is used to retrieve the JavaScript source code that needs to be protected. The mapping table generation module is used to generate an instruction mapping table before compiling the source code into target code each time. The instruction mapping table is obtained by establishing a randomized mapping relationship between the operation of the source code and the virtual instruction. Each instruction mapping table generated is unique. The source code compilation module is used to compile the source code into object code containing virtual instructions according to the current instruction mapping table. Virtual instructions are instructions that have no actual operational meaning and are only used for mapping. The interpreter generation module is used to generate an interpreter, which matches the current instruction map and is used to parse the currently compiled target code, converting virtual instructions in the target code into virtual machine instructions. Virtual machine instructions are instructions that the JavaScript engine can recognize and execute. The output module is used to output the interpreter and the object code.

[0022] For more detailed implementation information on the code processing device, please refer to the description of any of the implementation methods in the first aspect above.

[0023] Fourthly, this application also provides a code processing apparatus. The code processing apparatus includes modules for executing the code processing method in the second aspect or any optional implementation of the second aspect. For example, the code processing apparatus includes: The acquisition module is used to acquire the interpreter and the target code, wherein: the interpreter is matched with the instruction map; both the instruction map and the interpreter are generated once in each compilation process of the JavaScript source code, and the instruction map generated each time is unique. The instruction map is obtained by establishing a randomized mapping relationship between the operations of the source code and virtual instructions; the target code contains virtual instructions and is obtained by compiling the source code according to the instruction map. Virtual instructions are instructions that do not have actual operational meaning and are only used for mapping. The execution module is used to execute the parsed results, which contain virtual machine instructions, obtained by the interpreter from the target code, in order to implement the functions corresponding to the source code. Virtual machine instructions are instructions that the JavaScript engine can recognize and execute.

[0024] For more detailed implementation information on the code processing device, please refer to the description of any of the implementation methods in the second aspect above.

[0025] Fifthly, this application provides a computing device. The computing device includes a memory and a processor. The memory stores computer programs or instructions, which, when executed by the processor, implement the methods described in the first aspect or any possible implementation thereof, or implement the methods described in the second aspect or any possible implementation thereof.

[0026] Sixthly, this application provides a computer-readable storage medium. The storage medium stores a computer program or instructions that, when executed by a processor, implement the method described in the first aspect or any possible implementation thereof, or implement the method described in the second aspect or any possible implementation thereof.

[0027] Seventhly, this application provides a computer program product. The computer program product includes a computer program or instructions that, when executed by a processor, implement the method in the first aspect or any possible implementation thereof, or implement the method in the second aspect or any possible implementation thereof.

[0028] The beneficial effects of aspects two through seven above can be referred to in aspect one or any possible implementation of aspect one, and will not be elaborated here. Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0029] Other advantages, objectives and features of this application will be partly apparent from the description below, and partly understood by those skilled in the art through study and practice of this application. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0031] Figure 1This is one of the flowcharts illustrating a code processing method in an exemplary embodiment of this application; Figure 2 This is one of the flowcharts for generating an interpreter; Figure 3 This is the second flowchart for generating the interpreter; Figure 4 This is a second flowchart illustrating a code processing method in an exemplary embodiment of this application; Figure 5 This is the third flowchart illustrating a code processing method in an exemplary embodiment of this application; Figure 6 This is one of the flowcharts for the interpreter to parse the target code; Figure 7 This is the second part of the flowchart for the interpreter parsing the target code; Figure 8 This is one of the schematic block diagrams of a code processing apparatus shown in an exemplary embodiment of this application; Figure 9 This is a second schematic block diagram of a code processing apparatus shown in an exemplary embodiment of this application; Figure 10 This is a schematic block diagram of a computing device illustrated in an exemplary embodiment of this application; Figure 11 This is a schematic diagram of the implementation environment of the code processing method provided in the embodiments of this application; Figure 12 This is a block diagram of the JSVmp principle. Detailed Implementation

[0032] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0033] The term "and / or" as used in this application includes any and all combinations of one or more of the associated listed items. In this application, "at least one" means one or more, and "more than one" means two or more. The terms "first," "second," and other ordinal terms used in this application may be used to describe various constituent elements, but these constituent elements are not limited by these terms. The purpose of using these terms is solely to distinguish one constituent element from others and should not be construed as indicating or implying relative importance. For example, without departing from the scope of this application, a first constituent element may be named a second constituent element, and similarly, a second constituent element may be named a first constituent element.

[0034] Before introducing the embodiments of this application, the technical terms and background technology involved in this application will be introduced first.

[0035] Headless browser: A browser operating mode without a user interface, which controls the complete browser engine to perform page rendering and script parsing through a command-line interface.

[0036] Control flow flattening: a code obfuscation technique that transforms nested code logic into a linear execution structure, controlling the execution order of basic blocks through a scheduler.

[0037] Pseudo-random algorithms: deterministic numerical generation methods that generate reproducible sequences of statistically similar random numbers by initializing with a seed value.

[0038] Abstract Syntax Tree (AST): A representation of source code structure that uses a tree-like data structure to precisely describe the hierarchical relationships between program syntax elements.

[0039] With the rapid development of internet technology and web applications, JavaScript has become the mainstream scripting language in web front-end development. It is widely used to implement rich page interactive functions and security-sensitive functions such as front-end risk control, anti-crawler detection, and device fingerprinting. However, because JavaScript scripts are transmitted in plaintext and executed in the client browser, attackers can easily use browser-built-in developer tools (such as Chrome DevTools) or abstract syntax tree (AST) parsing tools (such as Babel) to analyze, decompile, and extract JavaScript code, thereby exposing sensitive logic, algorithms, and business rules in the code, posing a huge security risk.

[0040] To prevent sensitive JavaScript code from being easily analyzed and restored, code obfuscation techniques are widely used in the industry. These techniques increase the difficulty for attackers to analyze the code by changing variable names, inserting redundant code, or modifying the code structure. However, this static obfuscation method is essentially still a simple transformation of the code text and fails to fundamentally change the code's execution method and structural characteristics. Therefore, it is still easy for attackers to deobfuscate the code and restore its original logic using AST tools or manual analysis.

[0041] Recently, some studies have proposed virtualization protection schemes for front-end JavaScript code, attempting to hide its original execution logic by compiling JavaScript code into specific virtual instructions. The technical approach involves transcoding JavaScript code into WebAssembly (WASM) bytecode and executing it using the browser's built-in WebAssembly engine to enhance code protection. While this scheme offers advantages in performance and security, it suffers from the following significant drawbacks: WebAssembly is not supported by all browsers, especially older or lower versions, resulting in poor compatibility and limited widespread application; WebAssembly's call characteristics are readily apparent, making it easy for attackers to identify and analyze its module call patterns and instruction encoding rules; existing WebAssembly virtualization schemes typically employ fixed instruction encoding methods, lacking the ability to dynamically update and adapt, leading to a gradual decrease in protection strength as attackers accumulate analytical experience.

[0042] Therefore, current front-end JavaScript protection solutions still have significant shortcomings, specifically: JavaScript code is stored in plaintext or simple static obfuscation, making it easy for browser debugging tools to extract and analyze it; statically obfuscated code is easily reverse-analyzed and restored by AST tools; existing WebAssembly solutions have limited compatibility and are difficult to be compatible with all browsers; virtualization protection solutions with fixed instruction sets are easily identified and cracked by attackers, making it difficult to guarantee security in the long term.

[0043] In summary, existing JavaScript protection schemes suffer from insufficient protection strength. To address this issue, this application provides a code processing method that can significantly improve code security.

[0044] like Figure 12 This application pertains to a JavaScript code virtualization protection scheme based on the JSVmp (JavaScript Virtual Machine Protection) concept. The idea behind this application is that the compiler dynamically generates an instruction map and a matching interpreter each time it compiles. The compiler compiles part or all of the source code into virtual instructions according to this instruction map. The compiled target code is executed in the simulation environment of the front-end virtual machine. Specifically, the interpreter generated during compilation interprets the target code. The interpreter matches the instruction map and parses the virtual instructions into instructions that can be recognized and executed by the front-end virtual machine (which is essentially the JavaScript engine).

[0045] The following first describes one or more exemplary operating environments to facilitate a clearer understanding of the functions and intentions of the various implementation methods in the embodiments of this application. For example... Figure 11 This is a schematic diagram illustrating the implementation environment of the method provided in the embodiments of this application. The method provided in the embodiments of this application can be applied to... Figure 11 In this environment, there are three components: the development team, the server, and the client. Both the development team and the client communicate with the server. The client includes any type of terminal device, such as iOS or Android, including smartphones, tablets, iMacs, and tablets. The server should be interpreted broadly as any entity capable of responding to external requests and providing data, resources, or services. A server can be a single server or a server cluster. The development team can consist of one or more computers with code development tools installed, enabling the development of JavaScript source code. Source code compilation can be done either by the development team writing the source code and sending it to the server for compilation by a compiler on the server side, or by the compiler installed on the development team. In practice, developers are typically responsible for writing and compiling the JavaScript source code on the development team's computer. The resulting JavaScript file is then uploaded to the server, and the client retrieves the JavaScript file (JS file) from the server, which is then loaded and executed by the client's JavaScript engine. The JavaScript source code that needs to be protected in this application is first compiled into a JS file on the development side, and the compiled JS file is deployed in various front-end web pages, applications and other environments on the client side, within the scope of execution or practice, including any host environment that can execute the JS file, as long as it can provide the ability to execute the JS file.

[0046] The technical solutions of this application are described below through several embodiments. It should be understood that these embodiments can be implemented in many different forms and should not be construed as being limited to the embodiments set forth herein.

[0047] refer to Figure 1 Firstly, this application provides a code processing method, which can be executed by a server (in which case the development end is only responsible for writing the source code) or by the development end. This application is not limited in this respect. The following embodiments illustrate the method as being executed by the development end. Figure 1 As shown, the code processing method provided in this application embodiment includes steps S101-S109: S101: Obtain the JavaScript source code that needs protection; S103: Generate an instruction mapping table, wherein each generated instruction mapping table is unique; S105: Compile the source code into object code containing virtual instructions according to the current instruction mapping table. Virtual instructions are instructions that have no actual operational meaning and are only used for mapping. S107: Generate an interpreter, where the interpreter matches the current instruction map and is used to parse the target code generated by the current compilation, and parse the virtual instructions in the target code into virtual machine instructions, which are instructions that the JavaScript engine can recognize and execute; S109: Output the interpreter and the object code.

[0048] Thus, this application achieves obfuscation protection for JavaScript code during the compilation phase. A unique instruction mapping table is regenerated with each compilation, meaning the instruction mapping table is dynamic. Similarly, the interpreter matching the current instruction mapping table is also regenerated with each compilation and matched against the instruction mapping table. This dynamic instruction obfuscation constructs a code structure that is difficult to predict using historical code, increasing the difficulty of reverse engineering and effectively preventing static decompilation analysis, thereby improving code security. Furthermore, this application uses pure JavaScript obfuscation, resulting in an output suitable for running in a pure JS environment. It achieves compatibility with older browsers within the output, solving the problems of browser incompatibility and obvious call characteristics inherent in WebAssembly protection detection schemes.

[0049] The following combination Figure 2-7 The steps in steps S101-S109 and other optional steps are described in detail.

[0050] Regarding S101 : Obtain the JavaScript source code that needs protection; The development side has a compiler (or compilation tool) installed, and the method in this embodiment can be specifically implemented by this compiler. Developers can use the development tool to write the JavaScript source code that needs protection, and then import this code into the compiler, which can then obtain the JavaScript source code that needs protection.

[0051] refer to Figure 2 The method also includes step S201 after step S101: parsing the source code into an abstract syntax tree, preprocessing the abstract syntax tree, and obtaining a node sequence formed by arranging multiple nodes of the abstract syntax tree in order.

[0052] For example, using Babel to parse source code generates an Abstract Syntax Tree (AST), which is then traversed for preprocessing, and finally converted into a sequence of nodes. The node sequence is essentially formed by arranging multiple nodes of the Abstract Syntax Tree (AST nodes, hereinafter referred to as AST nodes) in sequence. AST node representation is a low-level representation.

[0053] Preprocessing ASTs is a mature technique, including collecting string literals into arrays, flattening control flow, adding code dead zones, adding random dead code blocks, transforming object literals, and renaming object properties. For example... Figure 12 Preprocessing can be implemented by the compiler's preprocessor.

[0054] For example, for the source code console.log('hello world'), after step S101, the resulting node sequence P is: P=[debugger, ifJump, typeof, debugger, params, '=', RegExpLiteral, debugger, typeof, get, RegExpLiteral, tryNumber], which has a total of 12 AST nodes, as shown in Table 1 below: Table 1 lists the nodes corresponding to sequence P.

[0055] Regarding S103 Generate an instruction mapping table; In this embodiment, an instruction mapping table is generated after each compilation. Each generated instruction mapping table is unique and cannot be reused. That is, each generated instruction mapping table can only be used for the current compilation and cannot be used for other compilations.

[0056] The generation of the instruction mapping table includes: establishing a randomized mapping relationship between source code operations and virtual instructions.

[0057] Virtual instructions are instructions used solely for mapping and do not have any actual operational meaning. For example, virtual instructions can be numbers 1, 2, 3, etc., letters a, b, c, ax, dge, etc., or any symbols that do not have operational meaning such as $, #, %, etc., or any combination of the above.

[0058] The establishment of randomized mapping relationships can be achieved using pseudo-random algorithms. In one possible implementation, establishing a randomized mapping relationship between source code operations and virtual instructions includes: randomly sorting multiple nodes of a pre-prepared abstract syntax tree (AST) (e.g., using a pseudo-random algorithm), and determining the randomized sequence number corresponding to each node as a virtual instruction, thereby establishing the mapping relationship between nodes and virtual instructions. In other words, the instruction mapping table includes the mapping relationship between nodes of the abstract syntax tree (i.e., AST nodes) and virtual instructions.

[0059] For example, multiple pre-prepared AST nodes can be placed in array A, where each element in array A represents an AST node: A =['tryNumber', 'RegExpLiteral', 'try','ifJump', 'params', 'typeof','=', '++', 'def_v','--', 'localScope', 'property',...]; Then the Fisher-Yates shuffle algorithm (as shown in the shuffleArray function below) can be used to shuffle the order of the elements in array A: function shuffleArray(array: Array <string>): Array <string>{ for (let i = array.length - 1; i>0; i--) { const j = Math.floor(Math.random() * (i + 1)) ;[array[i], array[j]]= [array[j], array[i]] } return array } By inputting array A into the function parameters above, you can obtain the shuffled array A1, for example: A1=['new','globalScope','switchJump','ifJump','>>>>','typeof','>>', '++', 'def_v','--','<<','property',...]; The sorting index corresponding to each element in A1 is a virtual instruction. Organizing the elements and indices in A1 into Table 2 below yields the instruction mapping table MIT-1: Table 2 Instruction Mapping Table MIT-1

[0060] During the next compilation, the Fisher-Yates shuffle algorithm is used again to shuffle the order of elements in array A, resulting in: A2=['tryNumber','RegExpLiteral','try','ifJump','params','typeof','=','++','def_v','--','localScope','property','debugger',...]; The sorting index corresponding to the element in A2 is a virtual instruction. Organizing the elements and indices in A2 into Table 3 below yields the instruction mapping table MIT-2: Table 3 Instruction Mapping Table MIT-2

[0061] As can be seen, the instruction mapping table generated each time is different; that is, the virtual instructions corresponding to the AST nodes are not fixed. During each compilation process, the sorting index (virtual instruction) corresponding to the elements (AST nodes) inside array A is shuffled. Thus, this application effectively prevents attackers from reconstructing the mapping relationship through static analysis of the abstract syntax tree nodes by establishing the mapping relationship for the AST nodes, further increasing the difficulty of reverse analysis.

[0062] Regarding S105 : Compile the source code into object code containing virtual instructions according to the current instruction mapping table; Specifically, according to the current instruction mapping table, the source code is compiled into target code containing virtual instructions, including: querying the instruction mapping table, converting the nodes in the node sequence into corresponding virtual instructions, thereby obtaining target code containing virtual instructions.

[0063] It should be noted that the source code can be entirely or partially transcoded into virtual instructions. That is, the target code can be entirely virtual instructions or partially virtual instructions, while other parts are handled in the traditional way; all of these are within the scope of protection of this application. Whether all or part of the source code is transcoded into virtual instructions can be achieved by configuring the AST nodes in the virtual instructions. Only AST nodes supported by the instruction mapping table can be transcoded into virtual instructions; AST nodes not supported by the instruction mapping table can be handled in the traditional way. For example, typical source code includes operators (such as addition, subtraction, multiplication, and division) and delimiters (such as for loops, delete operations, etc.). In some embodiments, the AST nodes supported by the instruction mapping table can cover all operators and delimiters; in one embodiment, the AST nodes supported by the instruction mapping table only need to cover delimiters to achieve the desired obfuscation effect.

[0064] For example, suppose that in the current compilation, the node sequence obtained in step S101 is P, i.e., Table 1. The instruction mapping table generated in step S103 is MIT-2, i.e., Table 3. By referring to Table 1 and Table 3, a series of virtual instructions (represented by "instruction") can be obtained, as shown in Table 4 below: Table 4 shows an example of virtual instructions obtained from the AST node conversion in step S101.

[0065] As can be seen, the node sequence in step S101 (Table 1) all belong to the AST nodes supported by the instruction mapping table MIT-2 (Table 3). By transcoding the node sequence in step S101 according to the instruction mapping table MIT-2, a series of virtual instructions in the second column of Table 4 can be obtained. That is, the target code in step S105 is entirely composed of virtual instructions. The target code corresponding to the final source code console.log('hello world') is a sequence of 12 virtual instructions, represented as an array as follows: [12, 3, 5, 12, 4, 6, 1, 12, 5, 30, 1, 0]; As can be seen, the virtual instructions in the target code have no operational information and are a series of numbers (or other characters in other embodiments) that have no operational meaning. Even if this target code is obtained, the source code cannot be decoded.

[0066] It is understood that the above transcoding process in this application also supports the source code of signature algorithms such as MD5 and SHA256. The transcoding process in this application achieves dynamic obfuscation, such as... Figure 12 As shown, this transcoding process is implemented by the compiler's obfuscator. In addition to maintaining the instruction map table mentioned above, the compiler also needs to maintain the same functionalities as other compilers, such as the index pool and operators. Figure 12 As shown, this part is similar to that of a regular compiler, and will not be repeated here.

[0067] Regarding S107 Generate an interpreter; The interpreter matches the current instruction map to parse the currently compiled target code, converting virtual instructions in the target code into virtual machine instructions.

[0068] Virtual machine instructions are instructions that the JavaScript engine can recognize and execute, including stack operation instructions, heap operation instructions, register operation instructions, control flow instructions, arithmetic instructions, and environment interaction instructions.

[0069] refer to Figure 2 In one possible implementation, generating the interpreter includes steps S201-S203: S201: For each virtual instruction in the instruction mapping table, query the preset instruction set to obtain the virtual machine instruction corresponding to the virtual instruction; The preset instruction set includes multiple pre-prepared nodes (which are completely consistent with multiple nodes in the instruction mapping table) and their corresponding virtual machine instructions.

[0070] For example, in the preset instruction set, the virtual machine instruction corresponding to the AST node tryNumber is: t0 = stack.pop(); t0 = Number(t0); if (isNaN(t0)) t0 = -1; stack.push(t0); For a virtual instruction in the instruction mapping table where instruction == 0, and its corresponding AST node is tryNumber, the virtual machine instruction can be found by locating the AST node tryNumber according to the preset instruction set.

[0071] S203: Establish a parsing logic between each virtual instruction and its corresponding virtual machine instruction.

[0072] The parsing logic can be an if statement or a case statement, etc. The conditions in the if or case statements are the specific values ​​of the virtual instructions, and the execution logic when the if or case conditions are met is the virtual machine instruction. Therefore, the parsing logic in the example of S201 above can be established as follows: if (instruction == 0) { t0 = stack.pop(); t0 = Number(t0); if (isNaN(t0)) t0 = -1; stack.push(t0); } Similarly, for each other virtual instruction in the instruction mapping table, the corresponding virtual machine instruction in the preset instruction set can be queried based on the AST node in the instruction mapping table corresponding to the virtual instruction, and the parsing logic can be established.

[0073] In this way, based on the instruction mapping table and the preset instruction set, the parsing logic between virtual instructions and virtual machine instructions can be established in the interpreter. This is beneficial because after the interpreter is loaded in the front end, the interpreter can quickly convert the virtual instructions of the target code into executable virtual machine instructions.

[0074] In one possible implementation, refer to Figure 3 The generator interpreter also includes: S301: Establish environment monitoring logic. The environment monitoring logic is used to determine whether the attributes of the interpreter's host environment belong to the characteristics of the automation framework. If so, an error is thrown.

[0075] The environment monitoring logic and parsing logic reside in the same JavaScript document, with the environment monitoring logic preceding the parsing logic. The environment monitoring logic checks whether the window and document objects corresponding to the host environment contain properties set by automation frameworks (including headless browsers, automated debugging tools, bots, or simulation environments). Specifically, it categorizes the host environment based on whether it belongs to different automation frameworks by scanning specific strings or regular expressions. For example, a property mapping table can be constructed, containing various possible automation framework types and their corresponding properties. The environment monitoring logic iterates through each automation framework type in the property mapping table, checking whether the window and document objects corresponding to the currently iterated automation framework type contain any property corresponding to that type (such as awesomium, CefSharp, __nightmare, or a matching regular expression). If present, the host environment is identified and marked as belonging to that automation framework type. For example, if the CefSharp property is found in the window object, it will identify a possible CefSharp environment.

[0076] In this way, the environment monitoring logic detects different network automation frameworks by matching the unique known attribute names of each technology. It can return an object in which each automation framework type corresponds to a boolean value describing whether any unique attributes have been identified. Once it detects that the code's runtime environment comes from an automation framework, it will throw an exception, which can effectively prevent the interpreter from executing in abnormal browser environments (such as debuggers or automation tools), prevent the code from being maliciously debugged or analyzed, and further improve the code's security.

[0077] In addition to the parsing logic and environment monitoring logic mentioned above, the interpreter also needs to maintain the same functionalities as other regular interpreters, such as its own scope, constant pool, and global variables. Figure 12 This part is similar to the generation of a regular interpreter, so it will not be elaborated further.

[0078] Regarding S109 Outputs the interpreter and the target code.

[0079] In one possible implementation, the output of the interpreter and the target code includes: obfuscating the interpreter and the target code and then outputting them as a JavaScript file.

[0080] This involves merging the interpreter code and target code to be output, then obfuscating the result to generate a single JS file. Specifically, the target code is first appended to the interpreter code, followed by obfuscation of the merged code. Obfuscation can employ conventional code protection techniques, such as code compression, variable and function name obfuscation, and dead code injection. These measures ensure that the obfuscated code can still be correctly recognized and executed by the virtual machine or runtime environment, while preventing malicious actors from directly obtaining and analyzing the interpreter and target code. Finally, the obfuscated code is exported as a JS file, which can be uploaded to a server and then distributed to the client's browser.

[0081] Thus, based on the implementation of dynamic instruction obfuscation, further obfuscation of the interpreter and target code is carried out to achieve static protection. Based on this dual defense system of dynamic obfuscation and static protection, the security strength is geometrically improved, the derivability of instruction set mapping relationship is destroyed, and the possibility of hackers forging custom interpreters is fundamentally eliminated.

[0082] refer to Figure 4 In some embodiments, the method further includes step S401 after step S101: performing syntax downgrading on the source code.

[0083] As an example, converting the syntax of higher-version JavaScript (such as ES6+) to lower-version (such as ES5) syntax can be done using the Babel tool, specifying the target environment as ES5. For example, converting `const` / `let` to `var`, arrow functions to regular functions, and template strings to string concatenation, etc.

[0084] Because downgraded code reduces syntax variations, subsequent AST node types become more uniform, simplifying the instruction map generation logic and reducing the instruction set size of the instruction map. For example, ES6 classes are downgraded to prototype syntax, avoiding extra handling of class-related instructions by the virtual machine. Instruction simplification also leads to improved compilation speed. Code downgrading can further enhance obfuscation effects because downgraded code loses the features of higher-version syntax (such as the simplicity of arrow functions). Combined with subsequent obfuscation steps, this further increases the difficulty of manual analysis, blocking AST reconstruction attacks. Attackers cannot infer source code logic by reconstructing higher-version syntax features (such as reversing prototype code to class). In summary, this embodiment performs syntax downgrading on the source code, achieves instruction set simplification through syntax-level compression, improves compilation speed, reduces interpreter size, and enhances obfuscation effects.

[0085] In summary, the embodiments of this application have the following beneficial effects: 1) Dynamic Obfuscation Defense System Based on Instruction Mapping Table: This system uses a pseudo-random algorithm to generate an instruction mapping table, achieving dynamic instruction obfuscation and constructing a code structure that is difficult to predict using historical code. This significantly increases the difficulty of reverse engineering and effectively prevents static decompilation analysis. Furthermore, the obfuscation process is pure JavaScript obfuscation; virtual instructions are not machine code and have no operational meaning. The interpreter simply interprets the virtual instructions into virtual machine instructions. The compiled output is a JS file suitable for running in a pure JS environment, enabling compatibility with older browsers. This solves the problems of browser incompatibility and obvious call characteristics present in WebAssembly protection detection schemes.

[0086] 2) Dual protection architecture for instruction set: The code after dynamic instruction obfuscation is obfuscated again with the interpreter, which destroys the derivability of instruction set mapping relationship and fundamentally eliminates the possibility of hackers forging custom interpreters.

[0087] 3) Environment-aware anti-debugging mechanism: Environment monitoring logic is implanted in the interpreter. By randomly triggering abnormal environments, it actively interferes with the debugging process, significantly increases the time cost of dynamic analysis, and blocks the virtual machine image cloning attack path.

[0088] 4) Compilation-optimized obfuscation paradigm: Design JS syntax dimensionality reduction transformation, combined with dynamic instruction obfuscation technology, to achieve instruction set simplification through syntax level compression, thereby improving compilation speed and reducing interpreter size.

[0089] In summary, this application's embodiments construct a four-in-one defense matrix of "dynamic obfuscation + instruction protection + environment awareness + compilation optimization," achieving a balance between security protection strength and execution efficiency while maintaining code equivalence.

[0090] It should be noted that this specification provides method operation steps as shown in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many steps and does not represent the only execution order. In practice, when the method program is executed, it can be executed in the order shown in the embodiments or drawings or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0091] Based on the same technical concept, and referencing Figure 5 Secondly, this application provides a code processing method executed by the client. This method can be implemented by the JavaScript engine (e.g., V8, Webkit) of various front-end web pages, applications, and other environments on the client, loading and executing JavaScript files. (See references.) Figure 5 The method includes steps S501-S503: S501: Obtain the interpreter and object code; S503: Execute the parsing result containing virtual machine instructions obtained by the interpreter from parsing the target code, so as to implement the function corresponding to the source code.

[0092] The interpreter matches the instruction map. Both the instruction map and the interpreter are generated once during each compilation of the JavaScript source code, and each generated instruction map is unique. The object code contains virtual instructions, which are compiled from the source code according to the instruction map. Virtual instructions are instructions that have no actual operational meaning and are only used for mapping.

[0093] An instruction map table carries a randomized mapping between operations in the source code and virtual instructions. This randomized mapping is established by randomly sorting multiple nodes of the abstract syntax tree (AST) and assigning the randomized index of each node to a virtual instruction. In some embodiments, the instruction map table includes the mapping between nodes of the AST and virtual instructions. The object code is obtained by querying the instruction map table and converting nodes in the node sequence into their corresponding virtual instructions. The node sequence is formed by arranging multiple preprocessed nodes of the AST in the source code in sequence.

[0094] It is understood that the interpreter and the target code are output by the method implementation of the first aspect, so more details can be found in the implementation method steps of the development side, which will not be repeated here.

[0095] refer to Figure 6 In some embodiments, the interpreter mentioned in S503 parses the target code, specifically including steps S601-S603: S601: The interpreter reads the object code sequentially; Specifically, the JavaScript file sent by the server is obtained. The content of the JavaScript file is obtained after obfuscating the interpreter and target code. The obfuscation of the interpreter and target code is a type of code obfuscation, which does not affect the JavaScript engine's ability to recognize the code.

[0096] S603: When a virtual instruction is read, the parsing logic corresponding to the virtual instruction is located, and the virtual machine instruction in the parsing logic is obtained as the parsing result of the currently read virtual instruction.

[0097] For example, in the example in step S105, the obtained target code is a sequence of 12 virtual instructions: [12,3, 5, 12, 4, 6, 1, 12, 5, 30, 1, 0], which the interpreter will read sequentially.

[0098] 1) If the interpreter first reads the virtual instruction "12", the interpretation will redirect to the following parsing logic: if (instruction == 12) { debugger; } This leads to the virtual machine instruction being "debugger".

[0099] 2) When the interpreter continues reading the virtual instruction "3", the interpretation will redirect to the following parsing logic: if (instruction == 3) { t0 = stack.pop(); t1 = bytecode[index++]; if (!t0) index = t1; } The resulting virtual machine instructions are: t0 = stack.pop(); t1 = bytecode[index++]; if (!t0) index = t1; By analogy, a series of virtual machine instructions can be obtained to achieve the effect of the source code console.log('helloworld').

[0100] When this application embodiment is applied to a browser environment, refer to... Figure 7 In some embodiments, the method further includes: S701: After the interpreter starts, it executes the environment monitoring logic. The environment monitoring logic determines whether the attributes of the interpreter's host environment belong to the characteristics of the automation framework. If so, it throws an error.

[0101] After the browser receives the JS file from the server, the JavaScript engine in the browser loads the JS file and starts the interpreter within it. The environment monitoring logic within the interpreter is activated. This logic checks the properties of the window and document objects corresponding to the host environment by scanning specific strings or regular expressions to determine if they belong to an automation framework. Specifically, the environment monitoring logic maintains an attribute mapping table containing various possible automation framework types and their corresponding attributes (a type may have multiple attributes). The logic iterates through each automation framework type in the attribute mapping table, checking whether the window and document objects corresponding to the current automation framework type contain any attribute corresponding to that type (such as awesomium, CefSharp, nightmare, or a matching regular expression). If so, the host environment is identified and marked as belonging to that automation framework type. For example, if the CefSharp attribute is found in the window object, it will identify a possible CefSharp environment. This process can prevent dynamic debugging and automated attacks.

[0102] Based on the same technical concept, in the third aspect, refer to Figure 8 This application also provides a code processing apparatus, specifically a compiler. The code processing apparatus includes modules for executing the code processing method of the first aspect described above. For example, the code processing apparatus includes: Code acquisition module 801 is used to acquire the JavaScript source code that needs to be protected; The instruction mapping table generation module 802 is used to generate an instruction mapping table before each compilation of source code into object code, wherein each generated instruction mapping table is unique; The source code compilation module 803 is used to compile the source code into object code containing virtual instructions according to the current instruction mapping table. Virtual instructions are instructions that have no actual operational meaning and are only used for mapping. The interpreter generation module 804 is used to generate an interpreter, wherein the interpreter matches the current instruction map table and is used to parse the target code generated by the current compilation, and parse the virtual instructions in the target code into virtual machine instructions, which are instructions that the JavaScript engine can recognize and execute; Output module 805 is used to output the interpreter and object code.

[0103] The apparatus of this application embodiment can execute the method provided in the embodiment of this application, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of the first aspect of this application. For detailed functional descriptions of each module of the apparatus, please refer to the description in the method embodiment of the first aspect above, which will not be repeated here.

[0104] It should be noted that the various modules described herein are divided into modules for clarity. However, in actual implementation, the boundaries between modules may be blurred. For example, any or all functional modules in this application may share various hardware and / or software elements. As another example, any and / or all functional modules in this application may be wholly or partially implemented by a shared processor executing software instructions. Furthermore, various software sub-modules executed by one or more processors may be shared among various software modules. Accordingly, unless expressly required, the scope of this application is not limited by mandatory boundaries between various hardware and / or software elements.

[0105] Based on the same technical concept, the fourth aspect, refer to Figure 9 This application also provides a code processing apparatus, specifically a JavaScript engine installed on the front end. The code processing apparatus includes modules for executing the code processing method in the second aspect or any optional implementation of the second aspect. For example, the code processing apparatus includes: The module 901 is used to obtain the interpreter and the target code, wherein: the interpreter matches the instruction map; both the instruction map and the interpreter are generated once in each compilation process of the JavaScript source code, and the instruction map generated each time is unique; the target code contains virtual instructions, and is obtained by compiling the source code according to the instruction map. Virtual instructions are instructions that have no actual operational meaning and are only used for mapping. Execution module 902 is used to execute the parsing result containing virtual machine instructions obtained by the interpreter from parsing the target code, so as to implement the function corresponding to the source code. The virtual machine instructions are instructions that the JavaScript engine can recognize and execute.

[0106] The apparatus of this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of the second aspect of this application embodiment. For detailed functional descriptions of each module of the apparatus, please refer to the description in the method embodiment of the second aspect above, which will not be repeated here.

[0107] Based on the same technical concept, the fifth aspect, refer to Figure 10 This application embodiment also provides a computing device 1000, including components such as a memory 1001, a processor 1002, a communication module 1003, and an input / output interface 1004. Optionally, the components can be connected and communicate with each other via a bus 1005. The memory 1001 is used to store computer programs or instructions; when the processor 1002 executes the computer program or instructions, it implements the method steps in any of the method embodiments of the first or second aspect. It should be noted that... Figure 10 The structure of the device 1000 shown is merely illustrative and does not constitute a limitation on the device to which the method provided in the embodiments of this application applies.

[0108] The specific entity of the computing device may be a server or a computer on the development end, used to implement the method steps in any method embodiment of the first aspect; the specific entity of the computing device may also be a computer on the client side, used to implement the method steps in any method embodiment of the second aspect.

[0109] The memory 1001 can be used to store operating systems and computer programs or instructions, which, when invoked by the processor 1101, implement the methods shown in the embodiments of the first or second aspect of the present invention. The memory 1001 can also store programs for implementing other functions or services. The memory 1001 includes at least one type of computer-readable storage medium, including flash memory, hard disk, multimedia card, random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), magnetic disk, optical disk, etc. In some embodiments, the computer-readable storage medium can be an internal storage unit of a computing device, such as the hard disk or memory of the computing device. In other embodiments, the computer-readable storage medium can also be an external storage device of the computing device, such as a plug-in hard disk, a secure digital card (SD card), a flash memory card, etc., provided on the computing device. Of course, the computer-readable storage medium can also include both internal storage units and external storage devices of the computing device. In this embodiment, the computer-readable storage medium is typically used to store software installed on the computing device, such as program code of the methods of the embodiments of the first or second aspect. Furthermore, the computer-readable storage medium can also be used to temporarily store various types of data that have been output or will be output.

[0110] The processor 1002 is connected to the memory 1102 via bus 1005 and performs corresponding functions by calling the application programs stored in the memory 1102. In some embodiments, it may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other chips. The processor 1002 is typically used to control the overall operation of the processing device, such as performing control and processing related to data interaction or communication with other entities. In this embodiment, the processor 1002 is used to run program code stored in the memory 1001 or process data.

[0111] The computing device 1000 can connect to a network via a communication module 1003 (which may include, but is not limited to, components such as a network interface) to communicate with other devices (such as user terminals or servers) through the network and achieve data interaction, such as sending data to or receiving data from other devices. The communication module 1003 may include a wired network interface and / or a wireless network interface, meaning the communication module may include at least one of a wired communication module or a wireless communication module.

[0112] The computing device 1000 can connect to necessary input / output devices, such as a keyboard and display device, via the input / output interface 1004. The device 110 itself may have a display device, and other display devices can also be connected externally via interface 1004. It is understood that the input / output interface 1004 can be a wired interface or a wireless interface. Depending on the actual application scenario, the device connected to the input / output interface 1004 can be a component of the device 1000, or an external device connected to the device 1000 when needed.

[0113] The bus 1005 used to connect the components may include a path for transmitting information between the components. The bus 1005 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Depending on its function, the bus 1005 may be divided into an address bus, a data bus, a control bus, etc.

[0114] Based on the same technical concept, this application also provides a computer-readable storage medium storing a computer program or instructions. When the computer program or instructions are executed by a processing device, they implement the method steps in any of the method embodiments of the first or second aspect. Further details can be found in the method embodiments, which will not be repeated here. In this embodiment, the computer-readable storage medium can be non-volatile or volatile. Computer-readable storage media include flash memory, hard disks, multimedia cards, random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), magnetic disks, optical disks, etc. In some embodiments, the computer-readable storage medium can be an internal storage unit of a computing device, such as the hard disk or memory of the computing device. In other embodiments, the computer-readable storage medium can also be an external storage device of the computing device, such as a plug-in hard disk, a secure digital card (SD card), a flash memory card, etc., equipped on the computing device. Of course, the computer-readable storage medium can also include both internal storage units and external storage devices of the computing device. In this embodiment, the computer-readable storage medium is typically used to store software installed on the computing device, such as program code of the methods of the embodiments of the first or second aspect. In addition, computer-readable storage media can also be used to temporarily store various types of data that have been output or will be output.

[0115] Based on the same technical concept, embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in the first or second aspect of the above-described method embodiments.

[0116] It should be noted that the order in which the embodiments are described in this application is not intended to limit the priority of the embodiments. The reference to "embodiment" herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0117] Unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this application and in its specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0118] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many forms under the guidance of this application without departing from the spirit and scope of protection of the claims. All equivalent transformations made under the inventive concept of this application using the content of this application's specification and drawings, or direct / indirect applications in other related technical fields, are included within the patent protection scope of this application.< / string> < / string>

Claims

1. A code processing method, characterized in that, The method includes: Obtain the JavaScript source code that needs protection; An instruction mapping table is generated, which is obtained by establishing a randomized mapping relationship between source code operations and virtual instructions, wherein each generated instruction mapping table is unique; According to the current instruction mapping table, the source code is compiled into target code containing virtual instructions, which are instructions that have no actual operational meaning and are only used for mapping. An interpreter is generated, wherein the interpreter matches the current instruction mapping table and is used to parse the currently compiled target code, and to parse the virtual instructions in the target code into virtual machine instructions, wherein the virtual machine instructions are instructions that can be recognized and executed by the JavaScript engine; Output the interpreter and the target code.

2. The method according to claim 1, characterized in that, The randomized mapping relationship between the operation of establishing source code and virtual instructions includes: The nodes of the pre-prepared abstract syntax tree are randomly sorted, and the randomized sequence number corresponding to each node is determined as a virtual instruction, thereby establishing a mapping relationship between nodes and virtual instructions.

3. The method according to any one of claims 1-2, characterized in that, The instruction mapping table includes the mapping relationship between nodes of the abstract syntax tree and virtual instructions; The method further includes: parsing the source code into an abstract syntax tree, preprocessing the abstract syntax tree, and obtaining a node sequence formed by arranging multiple nodes of the abstract syntax tree in order; The step of compiling the source code into target code containing virtual instructions according to the current instruction mapping table includes: querying the instruction mapping table, converting the nodes in the node sequence into corresponding virtual instructions, thereby obtaining the target code containing virtual instructions.

4. The method according to any one of claims 1-3, characterized in that, The instruction mapping table includes the mapping relationship between nodes of the abstract syntax tree and virtual instructions; The generator interpreter includes: for each virtual instruction in the instruction mapping table, querying a preset instruction set to obtain the virtual machine instruction corresponding to the virtual instruction, and establishing a parsing logic between each virtual instruction and its corresponding virtual machine instruction; The preset instruction set includes multiple nodes of a pre-prepared abstract syntax tree and their corresponding multiple virtual machine instructions.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: when the source code is obtained, performing syntax downgrading processing on the source code.

6. The method according to any one of claims 1-5, characterized in that, The generator interpreter includes: An environmental monitoring logic is established, which is used to determine whether the attributes of the host environment of the interpreter belong to the characteristic attributes of the automation framework. If so, an error is thrown.

7. A code processing method, characterized in that, include: The process involves obtaining an interpreter and target code, wherein: the interpreter matches an instruction map; both the instruction map and the interpreter are generated once during each compilation of the JavaScript source code, and each generated instruction map is unique; the instruction map is obtained by establishing a randomized mapping relationship between source code operations and virtual instructions; the target code contains virtual instructions and is obtained by compiling the source code according to the instruction map, wherein the virtual instructions are instructions that have no actual operational meaning and are only used for mapping; The parsing result, which contains virtual machine instructions, obtained by the interpreter from parsing the target code, is executed to achieve the function corresponding to the source code. The virtual machine instructions are instructions that the JavaScript engine can recognize and execute.

8. The method according to claim 7, characterized in that, The interpreter parses the target code in the following ways: Read the target code in sequence; When a virtual instruction is read, the parsing logic corresponding to that virtual instruction is located, and the virtual machine instruction in the parsing logic is obtained as the parsing result of the currently read virtual instruction.

9. The method according to any one of claims 7-8, characterized in that, The method further includes: After the interpreter starts, it executes environment monitoring logic. The environment monitoring logic determines whether the attributes of the interpreter's host environment belong to the characteristics of the automation framework. If so, it throws an error.

10. A code processing device, characterized in that, include: The code retrieval module is used to retrieve the JavaScript source code that needs to be protected. The mapping table generation module is used to generate an instruction mapping table before compiling the source code into target code each time. The instruction mapping table is obtained by establishing a randomized mapping relationship between the operation of the source code and virtual instructions, wherein the instruction mapping table generated each time is unique. The source code compilation module is used to compile the source code into target code containing virtual instructions according to the current instruction mapping table. The virtual instructions are instructions that have no actual operational meaning and are only used for mapping. An interpreter generation module is used to generate an interpreter, wherein the interpreter matches the current instruction mapping table and is used to parse the currently compiled target code, and parse the virtual instructions in the target code into virtual machine instructions, wherein the virtual machine instructions are instructions that can be recognized and executed by the JavaScript engine; The output module is used to output the interpreter and the target code.

11. A code processing device, characterized in that, include: An acquisition module is used to acquire an interpreter and target code, wherein: the interpreter matches an instruction map; both the instruction map and the interpreter are generated once during each compilation of the JavaScript source code, and each generated instruction map is unique; the instruction map is obtained by establishing a randomized mapping relationship between source code operations and virtual instructions; the target code contains virtual instructions and is obtained by compiling the source code according to the instruction map, wherein the virtual instructions are instructions that have no actual operational meaning and are only used for mapping; An execution module is used to execute the parsing result containing virtual machine instructions obtained by the interpreter from the target code, so as to implement the function corresponding to the source code. The virtual machine instructions are instructions that can be recognized and executed by the JavaScript engine.

12. A computing device, characterized in that, It includes a memory and a processor, the memory being used to store computer programs or instructions; when the computer programs or instructions are executed by the processor, they implement the method of any one of claims 1 to 6 or any one of claims 7 to 9.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program or instructions that, when executed by a processor, implement the method of any one of claims 1 to 6 or any one of claims 7 to 9.

Images