Code obfuscation method, business execution method, medium, equipment and product

Abstract

The invention discloses a code obfuscation method, a business execution method, a medium, equipment and a product. According to the scheme, the to-be-mixed first language code and the to-be-mixed second language code are firstly obtained, then the second language code serves as the character string constant in the first language code and is written into the first language code, the mixed code is obtained, finally, the mixed code is subjected to obfuscation processing through the preset security compiler, and the safety of the mixed code is improved. And obtaining an executable file corresponding to the mixed code.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of computer technology, and more particularly to a code obfuscation method, a business execution method, a medium, a device and a product. BACKGROUND

[0002] With the increasing complexity of software functions, a single programming language often cannot meet the development needs, so cross-language code integration emerges as the times require.

[0003] Cross-language code integration refers to the technical practice of integrating code modules written in different programming languages in the same software system and making them work together. This integration allows developers to choose the most suitable programming language according to specific tasks (such as performance, library ecology or domain characteristics), effectively breaking through the limitations of a single language, thereby improving development efficiency while optimizing the overall performance of the system.

[0004] For a software system built by cross-language code integration, its core business logic and algorithm code are crucial assets. Therefore, these codes must be protected to prevent attackers from obtaining the actual implementation details of the system through reverse engineering methods such as decompilation and disassembly.

[0005] Currently, code obfuscation is a common technique for protecting software code from reverse analysis. Its core principle is to convert source code or intermediate representations (such as bytecodes) into functionally equivalent but complex and poorly readable versions.

[0006] However, existing code obfuscation tools and techniques are usually focused on single language environments. Due to significant differences in programming languages in aspects such as running mechanism and compilation, there is currently a lack of unified and efficient means to systematically obfuscate the mixed code as a whole after cross-language integration, which leads to the fact that software products obtained through cross-language code integration cannot be effectively protected. SUMMARY

[0007] Therefore, one or more embodiments of the present specification provide technical solutions as follows:

[0008] According to a first aspect of one or more embodiments of the present specification, a code obfuscation method is provided, comprising:

[0009] acquire a first language code to be mixed and a second language code, the first language code is used to provide a target service, the second language code is called by the first language code to realize a specified function required when the target service is executed, the first language code is compiled into machine code and executed by an operating system based on the first language code, and the second language code is compiled into bytecode by an interpreter corresponding to the second language code and executed;

[0010] write the second language code into the first language code as a string constant in the first language code to obtain mixed code;

[0011] obfuscate the mixed code by a preset secure compiler to obtain an executable file corresponding to the mixed code.

[0012] Optionally, the second language code is written into the first language code as a string constant in the first language code to obtain mixed code, and the method specifically comprises the following steps.

[0013] determine a function description text of the second language code;

[0014] perform semantic analysis on the function description text to determine a keyword used to describe a function feature;

[0015] determine a target function used to call the second language code to realize a specified function in the first language code according to the keyword;

[0016] determine an embedding position corresponding to the second language code according to the target function;

[0017] write the second language code into the first language code as a string constant in the first language code according to the embedding position to obtain mixed code.

[0018] Optionally, the first language code comprises C++ code or C code, and the second language code comprises python code, and when the second language code is python code, the interpreter is a python interpreter.

[0019] According to a second aspect of one or more embodiments of the present specification, a service execution method is provided, comprising:

[0020] Obtaining an executable file, the executable file being obtained by obfuscating a mixed code by a preset secure compiler, the mixed code being obtained by writing a second language code as a string constant into a first language code, the first language code being used to provide a target service, the second language code being called by the first language code to implement a specified function required when the target service is executed, the first language code being compiled into machine code and executed by an operating system based on which the first language code is, and the second language code being compiled into bytecode by an interpreter corresponding to the second language code and executed;

[0021] When the target service is executed by running the executable file, loading the executable file into a preset memory, and starting the interpreter corresponding to the second language code;

[0022] When the first language code calls the second language code, executing the second language code by the interpreter to obtain an execution result.

[0023] Optionally, the first language code includes C++ code or C code, and the second language code includes python code, and when the second language code is python code, the interpreter is a python interpreter;

[0024] When the first language code calls the second language code, executing the second language code by the interpreter to obtain an execution result, specifically including:

[0025] When the first language code calls the second language code, initializing the python interpreter by pybind11, and creating each function module by the python interpreter, different function modules being used to provide different python functions;

[0026] Executing the python code to determine a function module required to be called from the each function module as a target module, and obtaining an execution result by calling a python function provided in the target module.

[0027] Optionally, obtaining an execution result by calling a python function provided in the target module, specifically including:

[0028] Determining parameters required to be transmitted by the first language code when calling the second language code;

[0029] Converting a data type of the parameters into a data type specified by python by pybind11 to obtain converted parameters;

[0030] Call the target module to process the converted parameters through a python function in the target module to obtain an execution result.

[0031] Optionally, the second language code is executed to determine the function module that needs to be called from the function modules as the target module, and specifically includes:

[0032] The second language code is compiled through the compiled module created by the python interpreter to obtain the bytecode corresponding to the second language code.

[0033] The bytecode is executed through a preset python virtual machine to determine the function module that needs to be called from the function modules as the target module.

[0034] According to a third aspect of one or more embodiments of the present specification, an electronic device is provided, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the above-mentioned code obfuscation method or service execution method by running the executable instructions.

[0035] According to a fourth aspect of one or more embodiments of the present specification, a computer readable storage medium is provided, which stores computer instructions, and the instructions are executed by a processor to implement the steps of the above-mentioned code obfuscation method or service execution method.

[0036] According to a fifth aspect of one or more embodiments of the present specification, a computer program product is provided, including computer program / instructions, and the computer program / instructions are executed by a processor to implement the steps of the above-mentioned code obfuscation method or service execution method.

[0037] As can be seen from the above embodiments, the first language code and the second language code to be mixed are first obtained, then the second language code is written into the first language code as a string constant in the first language code to obtain mixed code, and finally the mixed code is obfuscated by a preset secure compiler to obtain an executable file corresponding to the mixed code.

[0038] As can be seen from the above method, the second language code is written into the first language code as a string constant, and the obtained mixed code is obfuscated as a whole using a secure compiler. In this way, the finally obtained executable file can effectively resist reverse attacks, thereby effectively improving the overall security of the mixed code. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The code obfuscation method provided in the present specification involves the steps of a schematic diagram;

[0040] Figure 2A step schematic diagram of a business execution method provided in the specification;

[0041] Figure 3 A schematic diagram of a preparation stage in a business execution provided in the specification;

[0042] Figure 4 A schematic diagram of an actual execution stage in a business execution process provided in the specification;

[0043] Figure 5 A schematic structural diagram of an apparatus provided in the specification;

[0044] Figure 6 A block diagram of a code obfuscation device provided in the specification;

[0045] Figure 7 A block diagram of a business execution device provided in the specification. DETAILED DESCRIPTION

[0046] The user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the specification are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0047] Existing code obfuscation tools and technologies usually focus on a single language environment. Since different programming languages have significant differences in many aspects such as running mechanism, compilation, etc., there is currently a lack of unified and efficient means to systematically obfuscate the mixed code as a whole after cross-language integration, resulting in software products obtained through cross-language code integration being unable to be effectively protected.

[0048] Therefore, the specification provides a code obfuscation method and a business execution method, which first acquires a first language code and a second language code to be mixed, then writes the second language code as a string constant in the first language code into the first language code to obtain a mixed code, and finally performs obfuscation processing on the mixed code through a preset secure compiler to obtain an executable file corresponding to the mixed code. In this way, an executable file resistant to reverse engineering can be effectively obtained, thereby improving the execution security of the mixed code as a whole.

[0049] In the present specification, the first language code can refer to code compiled into machine code and directly executed by an operating system based on the first language code, can refer to code written in a programming language such as C++, C, etc., and the second language code can refer to code compiled into bytecode by an interpreter corresponding to the second language code and executed, can refer to code written in a programming language such as python.

[0050] For ease of description, the present specification will only take C++ code as the first language code and python code as the second language code as an example to describe a code obfuscation and business execution method provided by the present specification, and other cases, such as C code as the first language code and python code as the second language code, are also applicable.

[0051] In order to clearly describe the code obfuscation and business execution method provided by the present specification, some concepts appearing in the present specification will be explained in advance.

[0052] Python interpreter: mainly used to read the written python code, and then "translate" it into instructions (machine code) that the computer can understand and execute, and execute these instructions.

[0053] In the process of executing python code, the python interpreter usually performs lexical analysis first to extract various lexical units such as keywords, variable names, operators, etc. contained in the code, and checks whether there are obvious spelling errors in the python code. Then, the python interpreter further checks whether the combination of these lexical units conforms to the syntax rules of python, and in the case where the combination of these lexical units conforms to the syntax rules of python, the python interpreter constructs an abstract syntax tree for the python code, and through this abstract syntax tree, the python code is compiled to obtain the bytecode corresponding to the python code. Finally, through the core component of the python interpreter: the python virtual machine, the bytecode is read and translated into machine code that the current operating system and CPU can execute and immediately executed.

[0054] In addition, in the process of executing python code, various built-in modules are created through the python interpreter, among which, a part of the built-in modules are mainly used to provide python functions with different functions, such as math, datetime, re, etc., for implementing different functions. Another part of the built-in modules are used to provide the execution environment required for executing the python code, such as the built-in module containing a compilation module, through which the compilation of the python code can be implemented to obtain the corresponding bytecode.

[0055] In addition, during the execution of the python code, the python interpreter can also initialize the memory allocator to allocate the required memory space for the compiled bytecode during the execution of the python code through the memory allocator.

[0056] In summary, the python interpreter can provide the required environment and various modules during the execution of the python code to ensure the smooth running of the python code.

[0057] Python virtual machine: an abstract computer that provides a runtime environment for python programs and can execute instructions compiled into python bytecode.

[0058] The python virtual machine is actually more like a "translator" that can read common bytecode and then tell the underlying hardware what to do by calling the functions of the local operating system. Therefore, after the python code is compiled into bytecode using the compilation module, this bytecode is not specific to any particular hardware machine, and as long as the python virtual machine is installed on the operating system of these machines, the bytecode can be run.

[0059] pybind11: a lightweight C++ library that only contains header files, its main function is to act as a "bridge" between C++ code and python code, through pybind11, seamless two-way interaction between the two languages can be achieved.

[0060] The main function of pybind11 is to convert data types, that is, since this specification is embedded in python code in C++ code, the data type of the parameter transmitted by the C++ code needs to be converted to the data type specified by python during the call of the python code by the C++ code, for example, the int type parameter is converted to pyLong type.

[0061] In addition, pybind11 is also used to manage the python interpreter, such as initializing and starting the python interpreter when the python code needs to be executed, and releasing the python interpreter and cleaning up various resources required to run the python interpreter after the python code is executed.

[0062] Obfuscated compilation: refers to the process of compiling source code into executable files or intermediate code, using special obfuscation methods to convert and transform the code, making the final generated code difficult for humans to read and understand, but at the same time completely retaining its original functionality. The core idea is that the obfuscated code becomes obscure and difficult to understand. However, this obfuscation process is not intended to achieve encryption, but to increase the difficulty of understanding and analysis to increase the attack cost.

[0063] Common obfuscation methods include the following:

[0064] Name obfuscation: renaming meaningful names such as classes, methods, variables, fields, etc. to meaningless short characters (e.g., renaming calculateTotalRevenue to a).

[0065] Control flow obfuscation: changing the execution flow structure of the code, such as breaking down simple if-else or while loops into branches and jumps connected by goto statements, which are logically chaotic but equivalent.

[0066] Code and data obfuscation: inserting useless code (such as flower instructions) that will never be executed, or implementing simple instructions in a complex way.

[0067] Debug information removal: stripping all debug symbols, file names, line numbers, etc. from the compiled product.

[0068] In addition, the code obtained by obfuscation through obfuscated compilation does not need to be de-obfuscated during execution, and the obfuscated code can be directly executed by the machine's execution engine (such as an interpreter, virtual machine, etc.). This is mainly because the purpose of obfuscation is to increase the difficulty of human understanding, not to increase the difficulty of machine execution. Because the obfuscated code is still completely correct code in terms of syntax, the machine's execution engine does not care about variable names and code logic, only about the correctness of the syntax.

[0069] Next, a code obfuscation method provided by the present specification will be described.

[0070] The obfuscation method provided by the present specification can be roughly divided into several processes, such as Figure 1 as shown.

[0071] Figure 1 The steps involved in the code obfuscation method provided by the present specification are shown in the following schematic diagram.

[0072] S100: Obtain the first language code and the second language code to be mixed.

[0073] In the code obfuscation method provided in the specification, the execution subject can be an application or a server used by a developer of a client, or a server cluster composed of multiple servers in a platform to which the developer belongs, or a client installed in a server or a server cluster. Of course, the execution subject can also be a terminal device (such as a desktop computer, a notebook computer, or other electronic devices) used by the developer, or a client installed in the terminal device. For ease of illustration, the code obfuscation method provided in the specification will be described below by taking the terminal device as an example of the execution subject.

[0074] In actual applications, cross-code integration can allow developers to take advantage of multiple programming languages to build complex and high-performance applications, especially in system programming, high-performance computing, embedded development, or specific field applications. Therefore, developers can write the required code in the terminal device used according to actual needs. For the case of embedding python code in C++ code, the C++ code can be used to execute the target business required by the developer and determine when and how to call the python code. The python code embedded therein is mainly used to be called by the C++ code when executing the target business to implement the specified functions required for executing the target business.

[0075] For example, a developer develops a client for quantitative trading, and the main body of the client is written in C++ programming language. For the function module of the client that provides trading strategies, the python programming language can be used for writing.

[0076] For another example, a developer develops a game program based on C++, in which the core graphics, physics / audio engines involved in the game are written in C++ to ensure performance. However, the developer also hopes that some communities or mod authors can create plugins such as implementing custom tasks, damage statistics, etc. in the game. These plugins can be written by python code.

[0077] In actual applications, there are many application examples of cross-code integration of embedding python code in C++ code, which will not be illustrated one by one here.

[0078] In the specification, the developer can input the C++ code and python code written in the input interface by using various programming software running on the terminal device, so that the terminal device can obtain the C++ code and python code written by the developer.

[0079] S102: write the second language code as a string constant in the first language code into the first language code to obtain a mixed code.

[0080] In practical applications, the executable files such as.exe,.dll and the like which are compiled by a compiler are often finally distributed to users. For C++ code, the executable file (binary machine code) obtained after the C++ code is compiled has good anti-decompilation characteristics, because some key information is lost in the executable file after the compilation, so that the decompiled code cannot be interpreted or errors occur.

[0081] For example, clear function names are usually contained in C++ code, which can reflect the original intention of the function. However, in the executable file obtained after the C++ code is compiled, the functions are usually represented only as a memory address (such as 0x00411A30), so the function name modified based on the memory address (such as sub_411A30) can be finally obtained by the decompiler. However, it can be obviously seen that the original intention of the function cannot be seen from the function name.

[0082] For another example, the decompilation process can be roughly divided into two steps: the first step is disassembly, that is, the binary machine code is read byte by byte from the executable file by the disassembler, so as to translate the machine code into corresponding assembly code; the second step is decompilation, that is, the assembly code is analyzed by the decompiler. The second step is actually full of guesses and inferences, so that the variable types in the executable file compiled by the decompilation often have errors.

[0083] Specifically, in the process of executing the executable file, the processor does not care about the specific type (such as int, float, etc.) of the data to be processed, and the processor only knows that there is a string of bytes at a certain memory address, which needs to be specified by the assembly code to perform operations (such as addition, comparison, movement, etc.) on the bytes. After the decompilation tool sees the assembly code, it needs to guess the type of the data read from the memory by the assembly code, which causes the situation that the decompiler guesses the wrong data type.

[0084] For another example, high-level for, while, if / else are all compiled into simple jump instructions (such as jmp, je, jne) at the bottom. The decompiler needs to try to reconstruct the high-level control flow from these jumps, which is very complex and prone to errors.

[0085] There are many situations of decompilation errors of the executable file corresponding to the C++ code by the decompiler, which will not be illustrated one by one here.

[0086] Compared with C++, the bytecode obtained by compiling the python code does not have a good decompilation effect, which is mainly because the bytecode obtained is essentially different from the binary machine code. The bytecode is designed to be interpreted and executed by the python virtual machine, and it retains a lot of high-level semantic information. Therefore, through the retained high-level semantic information, the corresponding code can be well compiled by the decompiler.

[0087] Due to the above reasons, it is necessary to embed the python code as part of the C++ code in the C++ code, so that the python code part also has good decompilation characteristics. For this purpose, in this specification, the terminal device can embed the python code as a string constant in the C++ code, that is, hardcode the python code into the C++ code by hardcoding. Because the executable file obtained by compiling the C++ code has good decompilation characteristics, the python code as a string constant part also has good decompilation characteristics, thereby further protecting the python code.

[0088] S104: The mixed code is obfuscated by a preset secure compiler to obtain an executable file corresponding to the mixed code.

[0089] After obtaining the mixed code, the mixed code needs to be obfuscated by a preset secure compiler to obtain an executable file corresponding to the mixed code. Among them, the specific obfuscation method is as mentioned above, which can be implemented by methods such as name obfuscation, control flow obfuscation, code and data obfuscation, etc.

[0090] As can be seen from the above method, the python code is written as a constant in the C++ code, and the mixed code obtained is obfuscated by a secure compiler. In this way, the final executable file can effectively resist reverse attacks, thereby effectively improving the security of the mixed code as a whole.

[0091] It should be noted that the developer can declare the embedding position of the python code in the C++ code through the terminal device, so that the terminal device can embed the python code in the C++ code according to the embedding position.

[0092] The above method can be understood as a way for the developer to actively declare the embedding position, and in this specification, the terminal device can also determine the embedding position of the python code in the C++ code.

[0093] Specifically, the terminal device can acquire a function description text for the python code while acquiring the C++ code and the python code, the function description text being used to describe a specified function that can be provided by the python code in the target service. Then, the terminal device can perform semantic analysis on the function description text to determine a keyword used to describe a feature of the specified function from the function description text. The determined keyword can often reflect a core feature of the specified function.

[0094] The terminal device can further determine a target function used to call the python code to implement the specified function in the C++ code according to the keyword, and determine an embedding position corresponding to the python code based on the target function. The terminal device can determine the target function based on the keyword in various manners, for example, in a case where a correspondence between each keyword and each function has been established in advance, the target function can be determined through the correspondence; for another example, the terminal device can input the keyword and a prompt statement into a preset intelligent model, the intelligent model can determine probability values of functions corresponding to the function of the keyword through analysis on input data, and output a function with the highest probability as the target function. Other manners will not be exemplified one by one here.

[0095] In the process of determining the embedding position based on the target function, the terminal device can first determine a position of the target function in the C++ code, then extract context code at the position and perform semantic analysis on the context code, so as to determine the embedding position corresponding to the python code. Finally, the terminal device can embed the python code as a string constant into the C++ code according to the embedding position, to obtain the hybrid code.

[0096] In addition, the C++ code and the python code acquired by the terminal device can be written by the same developer, and of course can be written by different developers, for example, one developer is responsible for writing the C++ code, and another developer is responsible for writing the python code. In a case where multiple developers are responsible for writing the C++ code and the python code respectively, the C++ code and the python code written finally need to be summarized into the same terminal device.

[0097] Whether the developer actively declares the embedding position of the Python code in the C++ code or the terminal device automatically analyzes the embedding position of the Python code in the C++ code, the terminal device can generate a code mixing task for the C++ code and the Python code after receiving the summarized C++ code or the Python code, and then determine the embedding position of the Python code in the C++ code by the above method, to generate mixed code and further generate a final executable file.

[0098] After the above obfuscation processing is completed, the generated executable file can be further distributed to each user, so as to provide each user with the required target service through the executable file. A service execution method provided in the present specification will be described below.

[0099] Figure 2 The steps involved in the service execution method provided in the present specification specifically include the following steps:

[0100] S200: Obtain an executable file.

[0101] In the present specification, the execution subject of the service execution method can be a terminal device used by a user, such as a desktop computer, a notebook computer, or a device such as a server or a server cluster (when the execution subject is a server or a server cluster, it can be understood that the developer develops an executable file and provides it to a business party to which the server or the server cluster belongs, so that the business party executes the required target service based on the executable file). For ease of description, the service execution method provided in the present specification will be described below by taking a server as an example. The server can receive an executable file published by a developer or a developer belonging to a developer, to execute a target task through the executable file in the subsequent process. The executable file is generated by the above code obfuscation method.

[0102] S202: When executing the target service by running the executable file, load the executable file into a preset memory, and start an interpreter corresponding to the second language code.

[0103] In the process of executing the target service by running the executable file, the python interpreter is started using the pybind11 mentioned above. In the process of executing the C++ code, the python interpreter can be started through the preset resource acquisition is initialization (RAII) class (such as py::scoped_interpreter) provided in the pybind11 library. This RAII class is used to safely and conveniently initialize and manage the life cycle of the embedded python interpreter in the C++ code.

[0104] In practical applications, the python code as a string constant is stored in the read-only data segment (usually referred to as.rodata) of the generated executable file by the secure compiler. This data segment is specifically used to store constant data, which is read-only during code program execution to prevent accidental modification.

[0105] When the above executable file is executed, the loader of the operating system in the server loads the executable file into the preset memory. Since the python code is placed in the read-only data segment in the executable file, the python code is placed in the read-only area of the preset memory.

[0106] In traditional implementations, the python code is often stored as a separate file in the preset file system or disk. Therefore, when the python code needs to be called in the process of executing the C++ code, the required python code needs to be read from the preset file system or disk.

[0107] However, when the python code is stored in the default file system or disk, some attackers may use web application vulnerabilities, system vulnerabilities to obtain access to the server, and then directly read and download the bytecode from the file system or disk, causing the leakage of core information such as the core algorithm, business logic, and proprietary technology of the developer.

[0108] And through the above manner, the python code is stored in the preset memory, which can realize the effective protection of the python code. Among them, the python code exists in the preset memory does not mean that it cannot be obtained from the preset memory by any means, but because the difficulty of attackers stealing data from the memory is much higher than directly stealing from the default file system or disk. This mainly depends on: even if the attacker can monitor the memory, he must capture the memory snapshot at the correct time point (i.e. the python code has been compiled but has not been recycled by the python virtual machine), which is a very short time window, thereby significantly increasing the difficulty of capture. It is for this reason that in the present specification, the python code needs to be written into the C++ code as a string constant.

[0109] S204: When the first language code calls the second language code, the second language code is executed through the interpreter to obtain an execution result.

[0110] In actual application, the C++ code may need to call different functions of the python function in the execution process to realize different data processing requirements. For this purpose, after initializing the python interpreter through the above pybind11, various functional modules can be created through the python interpreter, wherein different functional modules are used to provide different python functions. Therefore, when executing the python code, the functional module to be called can be determined from these functional modules as a target module, and then the parameter transmitted by the C++ code is processed through the python function provided in the target module to obtain an execution result.

[0111] It should be noted that since C++ and python are two different programming languages, their data types are different, so in order to realize the interaction between C++ code and python code, the data type of the parameter transmitted by the C++ code needs to be converted to the data type specified by python, that is, the data type that can be processed by python code.

[0112] Therefore, in the present specification, during the execution of the above executable file, the parameter to be transmitted by the C++ code when calling the python code needs to be determined, and then the data type of the parameter is converted to the data type specified by python through the above pybind11 to obtain the converted parameter. Finally, by calling the above target module, the converted parameter is processed through the python function in the target module to obtain an execution result.

[0113] In addition, since the python code is embedded in the C++ code, the C++ code belongs to the main program, and therefore the python virtual machine needs to be implemented when the python code is executed.

[0114] Specifically, the above-mentioned python interpreter can create a compilation module required for compiling the python code, and through the compilation module, the python code can be compiled to obtain the bytecode corresponding to the python code. Then, through the preset python virtual machine, the bytecode is executed, so that the function module to be called can be determined from the above-mentioned function modules as a target module. And by calling the python function in the target module, the parameters (i.e. the converted parameters mentioned above) passed in by the C++ code are processed to obtain the execution result.

[0115] In this specification, the python interpreter allocates a storage location in the preset memory for the bytecode obtained by compiling the above-mentioned compilation module through the memory allocator, so that the python virtual machine can read the required bytecode from the storage location and execute it during the execution of the bytecode.

[0116] In this process, the python virtual machine does not execute the bytecode corresponding to the python code immediately after reading it, but actually copies a copy of the bytecode from the storage location, allocates a storage space (such as the method area / metaspaces) for the bytecode in the memory space managed by the python virtual machine, and then caches the bytecode in the storage space. Then, the bytecode needs to be verified for security to determine whether the bytecode is safe. When it is determined that the bytecode passes the security verification, the bytecode can be executed.

[0117] After obtaining the execution result through the python virtual machine, the execution result needs to be returned to the C++ code, so that the C++ code can continue to execute the subsequent code part by obtaining the execution result. In this process, since the python code and the C++ code belong to different programming languages, the server needs to convert the execution result obtained by the python virtual machine into the data format or data type required by C++ through pybind11, and then return it to the C++ code for execution. This process has been described in detail in the introduction of pybind11 above, and will not be repeated here.

[0118] When the execution of the python code is completed, the pybind11 can be used to release the python interpreter and release the resources occupied by the python interpreter. When the python code needs to be called again, the pybind11 can be used to initialize and start the python interpreter, and the python code can be executed based on the python interpreter.

[0119] For further description, the entire business execution process will be described in the following two stages, i.e., the preparation stage and the actual execution stage. Figure 3 and Figure 4 .

[0120] Figure 3 A schematic diagram of the preparation stage in the business execution is provided in the present specification.

[0121] In the preparation stage shown in Figure 3 , there are mainly four sub-stages. In the first stage, when the C++ code calls the python code, the initialization of the python interpreter can be triggered by the pybind11. In this stage, the pybind11 can be used to trigger the initialization of the python interpreter by using the RAII class py::scoped_interpreter, and the pybind11 can be used to complete the initialization of the python interpreter by calling the function Py_InitializeEx().

[0122] In the second stage, the initialization of the core of the python interpreter is performed, which mainly involves two aspects. One is the initialization of the memory allocator, which is used to allocate the storage location of the compiled bytecode in the memory in the subsequent process. The other is the creation of the global interpreter lock (GIL), which is used to prevent errors caused by multiple threads accessing or contending for the modification of the same object at the same time.

[0123] In the third stage, the python interpreter loads various built-in modules required for executing the python code. These built-in modules include the above-mentioned compilation module and various functional modules providing different functions of the python functions. At the same time, the identification information of the loaded built-in modules needs to be registered in the module table, which can be used to maintain these built-in modules and provide a query basis when these built-in modules are called subsequently. Thus, in the process of executing the python code, the built-in modules to be used can be queried based on the module table.

[0124] In stage four, after the python interpreter completes initialization, it returns information to pybind11 to indicate the initialization success state, and once the initialization is completed, the entire environment is ready and can start executing python code.

[0125] Figure 4 The actual execution stage of the service provided in the present specification is schematically shown in the figure.

[0126] In Figure 4 In the actual execution stage shown, the python code first needs to be compiled by the compiled module created based on the python interpreter. This compilation process is mainly divided into three steps, first, the python code needs to be parsed to extract word units such as keywords and variable names from the python code, and to check whether the combination of these word units conforms to the syntax rules of python. When it is determined that the python code passes the check, AST can be further generated, and based on the AST, the bytecode corresponding to the python code can be generated.

[0127] After obtaining the bytecode, the bytecode can be cached in the storage location allocated in the memory based on the above memory allocator, and the python virtual machine can read the bytecode from the storage location and execute it. In this process, the python virtual machine converts the bytecode into machine code, so that the CPU can execute the machine code to obtain the execution result.

[0128] It should be noted that, as mentioned at the beginning, the code obfuscation and service execution method provided in the present specification is mainly illustrated by embedding python code in C++ code, and in actual application, the first language code and the second language code can also be other forms, so the method provided in the present specification is also applicable to the mixing of codes written in other programming languages. For example, Lua code can be embedded in C++ code, and similarly, the Lua code is first written into the C++ code as a constant string to obtain the mixed code, and when executing the executable file corresponding to the mixed code, the executable file is first loaded into the memory, and the launched Lua code interpreter is used to compile and execute the Lua code. Other combinations will not be illustrated one by one here.

[0129] Figure 5 is a schematic structural diagram of a device provided in the present specification. Please refer to Figure 5At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, a memory 508, and a non-volatile memory 510, and can also include other hardware required by functions. One or more embodiments of the present specification can be implemented in a software manner, such as reading a corresponding computer program from the non-volatile memory 510 into the memory 508 by the processor 502 and then running. Of course, in addition to the software implementation, one or more embodiments of the present specification do not exclude other implementation manners, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0130] Please refer to Figure 6 The code obfuscation device provided in the present specification can be applied to a device as shown in Figure 5 The device includes:

[0131] The acquisition module 600 is configured to acquire a first language code and a second language code to be mixed, the first language code is used to provide a target service, and the second language code is called by the first language code when the target service is executed to implement a specified function required when the target service is executed, the first language code is compiled into machine code and executed by an operating system based on the first language code, and the second language code is compiled into bytecode by an interpreter corresponding to the second language code and executed.

[0132] The mixing module 602 is configured to write the second language code as a string constant in the first language code into the first language code to obtain mixed code.

[0133] The obfuscation module 604 is configured to perform obfuscation processing on the mixed code by a preset secure compiler to obtain an executable file corresponding to the mixed code.

[0134] Optionally, the mixing module 602 is specifically configured to determine a function description text of the second language code, perform semantic analysis on the function description text to determine a keyword used to describe a function feature, determine a target function used to call the second language code to implement a specified function in the first language code according to the keyword, determine an embedding position corresponding to the second language code according to the target function, and write the second language code as a string constant in the first language code into the first language code according to the embedding position to obtain mixed code.

[0135] Optionally, the first language code comprises C++ code or C code, and the second language code comprises python code; and when the second language code is python code, the interpreter is a python interpreter.

[0136] Please refer to Figure 7 The business execution apparatus provided in the specification can be applied to the device as shown in Figure 5 The apparatus comprises:

[0137] The obtaining module 700 is configured to obtain an executable file, the executable file being obtained by performing obfuscation processing on mixed code by using a preset secure compiler, the mixed code being obtained by writing second language code as a string constant into first language code, the first language code being used to provide a target business, the second language code being called by the first language code to implement a specified function required when the target business is executed, the first language code being compiled into machine code and executed by an operating system based on the first language code, and the second language code being compiled into bytecode by an interpreter corresponding to the second language code and executed.

[0138] The starting module 702 is configured to load the executable file into a preset memory when the target business is executed by running the executable file, and start the interpreter corresponding to the second language code.

[0139] The execution module 704 is configured to execute the second language code by using the interpreter to obtain an execution result when the first language code calls the second language code.

[0140] Optionally, the first language code comprises C++ code or C code, and the second language code comprises python code; and when the second language code is python code, the interpreter is a python interpreter.

[0141] The execution module 704 is specifically configured to initialize the python interpreter by using pybind11 when the first language code calls the second language code, create functional modules by using the python interpreter, different functional modules being used to provide different python functions, execute the python code to determine a functional module that needs to be called from the functional modules as a target module, and obtain an execution result by calling a python function provided in the target module.

[0142] Optionally, the execution module 704 is specifically configured to determine parameters required by the first language code to transmit when calling the second language code; convert data types of the parameters into data types defined by python through pybind11 to obtain converted parameters; and call the target module to process the converted parameters through a python function in the target module to obtain an execution result.

[0143] Optionally, the execution module 704 is specifically configured to compile the second language code through a compilation module created by the python interpreter to obtain bytecode corresponding to the second language code; and execute the bytecode through a preset python virtual machine to determine a function module required to be called from the function modules as the target module.

[0144] Based on the same idea as the above method, the specification also provides an electronic device, comprising: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method according to any one of the above embodiments by running the executable instructions.

[0145] Based on the same idea as the above method, the specification also provides a computer readable storage medium having computer instructions stored thereon, the instructions being executed by a processor to implement the steps of the method according to any one of the above embodiments.

[0146] Based on the same idea as the above method, the specification also provides a computer program product, comprising computer program / instructions, which are executed by a processor to implement the steps of the method according to any one of the above embodiments.

[0147] The specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, which perform particular tasks or implement particular abstract data types. The specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0148] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0149] The above merely provides examples of the present specification and is not intended to limit the present specification. Various changes and modifications can be made to the present specification by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A code obfuscation method, comprising: Obtain the first language code and the second language code to be mixed. The first language code is used to provide the target service. When the target service is executed, the second language code is called by the first language code to realize the specified function required when executing the target service. The first language code is compiled into machine code and executed by the operating system on which the first language code is based. The second language code is compiled into bytecode by the interpreter corresponding to the second language code and executed. The second language code is written into the first language code as a string constant, resulting in hybrid code; The mixed code is obfuscated using a preset security compiler to obtain the executable file corresponding to the mixed code.

2. The method as described in claim 1, wherein the second language code is written as a string constant in the first language code into the first language code to obtain hybrid code, specifically includes: Determine the functional description text of the second language code; Semantic analysis is performed on the functional description text to identify keywords used to describe the functional characteristics; Based on the keywords, a target function is determined in the first language code for calling the second language code to implement the specified function; Based on the target function, determine the embedding position corresponding to the second language code; Based on the embedding location, the second language code is written into the first language code as a string constant in the first language code to obtain the hybrid code.

3. The method according to any one of claims 1 to 2, wherein the first language code includes C++ code or C code, the second language code includes Python code, and when the second language code is Python code, the interpreter is a Python interpreter.

4. A business execution method, comprising: An executable file is obtained by obfuscating the hybrid code using a preset security compiler. The hybrid code is obtained by writing the second language code as a string constant into the first language code. The first language code is used to provide the target business. The second language code is called by the first language code to implement the specified function required when executing the target business. The first language code is compiled into machine code and executed by the operating system on which the first language code is based. The second language code is compiled into bytecode by the interpreter corresponding to the second language code and executed. When executing the target service by running the executable file, the executable file is loaded into a preset memory, and the interpreter corresponding to the second language code is started; When the first language code calls the second language code, the second language code is executed through the interpreter to obtain the execution result.

5. The method as described in claim 4, wherein the first language code includes C++ code or C code, the second language code includes Python code, and when the second language code is Python code, the interpreter is a Python interpreter; When the first language code calls the second language code, the second language code is executed by the interpreter to obtain an execution result, specifically including: When the first language code calls the second language code, the Python interpreter is initialized through pybind11, and various functional modules are created through the Python interpreter. Different functional modules are used to provide different Python functions. The Python code is executed to determine the functional module to be called from the various functional modules, which is then used as the target module. The execution result is obtained by calling the Python function provided in the target module.

6. The method as described in claim 5, wherein the execution result is obtained by calling the Python function provided in the target module, specifically includes: Determine the parameters that the first language code needs to transmit when calling the second language code; Using pybind11, the data type of the parameter is converted to the data type specified by Python to obtain the converted parameter; The target module is invoked to process the transformed parameters through Python functions within the target module, thereby obtaining the execution result.

7. The method of claim 6, wherein executing the second language code to determine the functional module to be called from the functional modules as the target module, specifically includes: The compilation module created by the Python interpreter compiles the second language code to obtain the bytecode corresponding to the second language code; The bytecode is executed using a pre-defined Python virtual machine to determine the functional module to be called from among the various functional modules, which is then used as the target module.

8. An electronic device, comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method as described in any one of claims 1 to 7 by executing the executable instructions.

9. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 7.

Images