Source code obfuscation method and device

Abstract

The embodiments of this specification disclose a source code obfuscation method, device, electronic device and computer-readable storage medium. The method includes: obtaining the function name of the calling function contained in the function to be obfuscated in the source code; according to the function name of the calling function, replacing the calling statement of the calling function in the function to be obfuscated with a function pointer to obtain the replaced function to be obfuscated; according to the correspondence between the placeholder and the calling function, obfuscating the replaced function to be obfuscated to obtain the target function; wherein the function pointer includes the function name of the function to be obfuscated, a preset header byte calculation function and a preset placeholder corresponding to the calling function; the preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular, to a code obfuscation method, device, electronic device, and computer-readable storage medium. Background Art

[0002] C language is a process-oriented, abstract general-purpose programming language, widely used in low-level development. Code written in C language will be converted into an executable binary file after compilation to run on the operating system. Through some decompilation tools, such as Interactive Disassembler Professional (IDA Pro) software, the implementation logic of the original function in the binary file can be decompiled, so that these low-level codes that should be more secure can also be cracked.

[0003] To prevent the underlying code from being cracked, the mainstream code obfuscation method currently used is based on control flow flattening. This method changes the source code structure, that is, changes the overall logical execution order of the source code. Although this method can effectively increase the difficulty of reverse cracking, the code size of the obfuscated source code using this method will increase significantly, resulting in excessive memory usage and reduced operating efficiency during runtime. Summary of the invention

[0004] The embodiments of the present specification provide a source code obfuscation method, device, electronic device, and computer-readable storage medium to solve the problem that the code size of the obfuscated code in the prior art will be greatly increased.

[0005] The embodiments of this specification adopt the following technical solutions:

[0006] A source code obfuscation method, comprising:

[0007] Get the function name of the calling function contained in the function to be obfuscated in the source code;

[0008] According to the function name of the calling function, the calling statement of the calling function in the to-be-obfuscated function is replaced with a function pointer to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a preset placeholder corresponding to the calling function;

[0009] According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain the target function;

[0010] The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

[0011] A source code monitoring method based on a source code obfuscation method, the source code monitoring method comprising:

[0012] Executed when the target function is running: calculating a preset number of header bytes of the target function by a preset header byte calculation function to obtain a calculation result; determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function;

[0013] According to whether the decoded function pointer points to the calling function in the target function, it is determined whether the target function has been illegally tampered with.

[0014] A source code obfuscation device, comprising:

[0015] An acquisition module is used to obtain the function name of the calling function contained in the function to be obfuscated in the source code;

[0016] A replacement module, used to replace the calling statement of the calling function in the to-be-obfuscated function with a function pointer according to the function name of the calling function, so as to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function and a preset placeholder corresponding to the calling function;

[0017] The obfuscation module is used to perform obfuscation processing on the replaced function to be obfuscated according to the correspondence between the placeholder and the calling function to obtain the target function;

[0018] The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

[0019] A source code monitoring device based on a source code obfuscation device, the source code monitoring device comprising:

[0020] The decoding module is used to execute when the target function is running: calculating a preset number of header bytes of the target function by a preset header byte calculation function to obtain a calculation result; determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function;

[0021] The judging module is used to judge whether the target function has been illegally tampered with according to whether the decoded function pointer points to the calling function in the target function.

[0022] An electronic device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of any one of the source code obfuscation methods when executed by the processor.

[0023] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any one of the source code obfuscation methods are implemented.

[0024] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0025] By replacing the calling function in the to-be-obfuscated function with a function pointer, the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a placeholder corresponding to the calling function, it is equivalent to obfuscating the calling logic in the to-be-obfuscated function. Compared with the control flow flattening method in the prior art, it not only effectively protects the calling logic of the to-be-obfuscated function, but also does not increase the code size of the source code containing the target function by a lot. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the embodiments of this specification and constitute a part of the embodiments of this specification. The illustrative embodiments of the embodiments of this specification and their descriptions are used to explain the embodiments of this specification and do not constitute an improper limitation on the embodiments of this specification. In the drawings:

[0027] Figure 1 A schematic diagram of a flow chart of a source code obfuscation method provided in an embodiment of this specification;

[0028] Figure 2 A schematic diagram of a flow chart of a source code monitoring method provided in an embodiment of this specification;

[0029] Figure 3 A schematic diagram of the structure of a source code obfuscation device provided in an embodiment of this specification;

[0030] Figure 4 A schematic diagram of the structure of a source code monitoring device provided in an embodiment of this specification;

[0031] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the embodiments of this specification more clear, the technical solutions of the embodiments of this specification will be clearly and completely described below in combination with the specific embodiments of the embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of this specification.

[0033] The technical solutions provided by each embodiment of the present specification are described in detail below in conjunction with the accompanying drawings.

[0034] like Figure 1 As shown, the embodiment of this specification provides a flow chart of a source code obfuscation method. The execution subject of the method includes but is not limited to servers, personal computers, laptops, tablet computers, smart phones and other intelligent electronic devices that can execute predetermined processing processes such as numerical calculations and / or logical calculations by running predetermined programs and instructions. Among them, the server can be a single network server or a server group composed of multiple network servers or a cloud based on cloud computing (Cloud Computing) composed of a large number of computers and network servers. In the embodiments of this specification, the execution subject of the method is not limited. As Figure 1 As shown, the method comprises the following steps:

[0035] Step 11: Get the function name of the calling function contained in the function to be obfuscated in the source code.

[0036] In practical applications, source code may be code written in a programming language to implement business functions. It is known that the source code may include various pre-written functions, and the function to be obfuscated may be a function that the user wishes to protect from being cracked by illegal persons in the source code. In practical applications, the function to be obfuscated may be determined according to the function name of the function to be obfuscated pre-set by the user. In the embodiment of this specification, the source code may be code written in C language.

[0037] It is understandable that when designing source code, functions can call each other, so the called function can be the calling function. Correspondingly, the function to be obfuscated can include the calling function. The function name of the calling function can be the name of the calling function. According to the programming language writing specification, each function in the code can correspond to its own function name to facilitate function calling.

[0038] For example, source code A can be as follows:

[0039]

[0040]

[0041] It can be seen that the source code contains the "add" function, the "subtract" function, the "multiply" function, the "divide" function, the "do_things" function, and the "main" function.

[0042] The user wants to protect the "do_things" function from being cracked, that is, to protect the function call logic of the "do_things" function from being cracked. The user can pre-set the "do_things" function as the function to be obfuscated, and by obtaining the function name do_things of the "do_things" function pre-set by the user, it can be determined that the function to be obfuscated is the "do_things" function.

[0043] In actual applications, by parsing the source code, the function names of the calling functions contained in the function to be obfuscated in the source code can be obtained. Then by parsing the source code A, it can be parsed that the "add" function, "subtract" function, "multiply" function and "divide" function are called in the "do_things" function, so the "add" function, "subtract" function, "multiply" function and "divide" function can be the calling functions. Correspondingly, the obtained add, subtract, multiply and divide can be the function names of the "add" function, "subtract" function, "multiply" function and "divide" function respectively.

[0044] In the embodiments of the present specification, by obtaining the function name of the calling function contained in the function to be obfuscated in the source code, it is convenient to subsequently obfuscate the calling statement that calls the calling function according to the function name of the calling function, thereby achieving obfuscation of the calling logic in the function to be obfuscated, so as to protect the function to be obfuscated from being cracked.

[0045] Step 12: According to the function name of the calling function, replace the calling statement of the calling function in the to-be-obfuscated function with a function pointer to obtain the replaced to-be-obfuscated function.

[0046] In actual applications, the inventors found that in order to protect functions from being illegally cracked, obfuscating the calling logic inside the function can be an effective way, but using the existing control flow flattening method will greatly increase the size of the code. In order to avoid increasing the size of the code while realizing the calling logic inside the function to be obfuscated, a method of replacing the calling statement of the calling function in the function to be obfuscated with a function pointer is adopted. Since the function pointer is a common technology of programming language, on the one hand, it will not generate a large performance overhead for computer operation. On the other hand, replacing the calling statement with a function pointer will not significantly increase the code size compared to changing the execution logic of the entire code. At the same time, due to the replacement of the calling statement of the calling function in the function to be obfuscated, the calling logic inside the function to be obfuscated can be protected.

[0047] In the embodiment of the present specification, the function pointer may include the function name of the function to be obfuscated, a preset header byte calculation function, and a preset placeholder corresponding to the calling function.

[0048] In practical applications, considering that the source code may contain multiple functions to be obfuscated, the function name of the function to be obfuscated is included in the function pointer, which can facilitate decoding for each function to be obfuscated during decoding. As mentioned above, according to the programming language writing specifications, each function in the code can correspond to its own function name, and the function name of the function to be obfuscated can be the name of the function to be obfuscated. For example, the function name of the "do_things" function in the above example can be do_things.

[0049] It is known that the code written in C language is illegally tampered by the illegal person through the hook function, including dynamically modifying the assembly instructions of the function header to tamper with the calling logic of the function. Correspondingly, the assembly instructions of the tampered function header will change. In the embodiment of this specification, the preset header byte calculation function can be used to calculate the preset number of header bytes of the target function at runtime. Through the header byte calculation function, it can be determined whether the target function has been illegally tampered with by the hook function according to the calculation result when the code is running. Among them, the specific value of the preset number can be set according to actual needs, for example, it can be 16-20 header bytes, which is not limited to this embodiment of this specification.

[0050] In practical applications, considering that the function to be obfuscated may contain multiple calling functions, if the function pointer contains the function name of the function to be obfuscated and the preset header byte calculation function, the calling function cannot be decoded specifically. In the embodiment of this specification, in order to facilitate the decoding of the calling function after replacing the function pointer, a placeholder corresponding to the calling function can be pre-set. In practical applications, the placeholder can be a randomly generated hexadecimal string, and the placeholder corresponds to the calling function one by one. The embodiment of this specification does not limit the specific character form of the placeholder.

[0051] As described above, a function to be obfuscated may include multiple calling functions, and the number of calling functions included in different functions to be obfuscated is different. In order to facilitate the unified implementation of replacing the calling statements that call each calling function in the function to be obfuscated, the calling statements can be replaced based on the form of a function pointer array. In one or more embodiments of this specification, according to the function name of the calling function, the calling statement that calls the calling function in the function to be obfuscated is replaced with a function pointer to obtain the replaced function to be obfuscated, which may include:

[0052] Generate a function pointer according to a preset header byte calculation function, a preset placeholder corresponding to a calling function, and a function name of the function to be obfuscated; generate a function pointer array according to the function pointer and the index value corresponding to the calling function; replace a calling statement of the calling function in the function to be obfuscated with the function pointer according to the function pointer array and the function name of the calling function, so as to obtain the replaced function to be obfuscated.

[0053] The index value is used to indicate the function pointer in the function pointer array that corresponds to the calling function. For example, the index value 0 corresponds to the calling function 1, and the index value 0 indicates the first function pointer in the function pointer array, then the first function pointer in the function pointer array corresponds to the calling function 1.

[0054] For ease of understanding, the example of source code A in the above text is used for explanation. According to the function names of the "add" function, "subtract" function, "multiply" function and "divide" function of the calling function contained in the obtained "do_things" function, the preset header byte calculation function and the preset placeholder corresponding to the calling function, the function pointers are generated, and the function pointers shown below can be generated respectively:

[0055] do_things+get_fun_len(do_things)+0x1111;

[0056] do_things+get_fun_len(do_things)+0x2222;

[0057] do_things+get_fun_len(do_things)+0x3333;

[0058] do_things+get_fun_len(do_things)+0x4444.

[0059] Among them, do_things is the function name of the function to be obfuscated, get_fun_len(do_things) is the preset header byte calculation function, and 0x1111, 0x2222, 0x3333, and 0x4444 are placeholders corresponding to each calling function.

[0060] Then, according to the function pointer and the index value corresponding to the calling function, a function pointer array is generated, and the function pointer array shown below can be generated:

[0061] "do_things_callers[a1_index]=[do_things+get_fun_len(do_things)+0x1111,do_things+get_fun_len(do_things)+0x2222,do_things+get_fun_len(do_things)+0x3333,do_things+get_fun_len(do_things)+0x4444]"

[0062] Among them, do_things_callers is the array name of the function pointer array, a1_index is the index value, and corresponds to the calling function. It can be understood that a1_index here is a variable, which can be 0, 1, 2, 3, and corresponds to the four calling functions contained in the "do_things" function, that is, do_things_callers[0] = do_things + get_fun_len(do_things) + 0x1111, do_things_callers[1] = do_things + get_fun_len(do_things) + 0x2222, do_things_callers[2] = do_things + get_fun_len(do_things) + 0x3333, do_things_callers[3] = do_things + get_fun_len(do_things) + 0x4444.

[0063] Then, according to the function pointer array and the function name of the calling function, the calling statement of the calling function in the to-be-obfuscated function is replaced with the function pointer. The calling statement of the calling function in the to-be-obfuscated function is determined according to the function name of the calling function, and then the calling statement is replaced with the function pointer according to the function pointer array. For example, “out1=add(a,b);

[0064] out2 = subtract(a,b);

[0065] out3 = multiply(a,b);

[0066] out4 = divide(a,b)”

[0067] Replace with

[0068] “out1=do_things_callers[0](a,b);

[0069] out2=do_things_callers[1](a,b);

[0070] out3=do_things_callers[2](a,b);

[0071] out4=do_things_callers[3](a,b)”

[0072] It is understandable that according to the function pointer array "do_things_callers[a1_index]=[do_things+get_fun_len(do_things)+0x1111,do_things+get_fun_len(do_things)+0x2222,do_things+get_fun_len(do_things)+0x3333,do_things+get_fun_len(do_things)+0x4444]", we can know that do_things_callers[0]=do_things+get_fun_len(do_things)+0x1111. Then replace out1=add(a,b) with out1=do_things_callers[0](a,b), which means that according to the function pointer array and the function name of the calling function, the calling statement of the calling function in the function to be obfuscated is replaced with the function pointer.

[0073] Step 13: According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain the target function.

[0074] In practical applications, the written code is usually compiled into an executable file to run in an operating system. In order to enable the target function in the compiled source code to correctly decode the calling function and determine whether the target function has been illegally tampered with at runtime, in one or more embodiments of the present specification, according to the corresponding relationship between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain the target function, which may include:

[0075] Compile the source code containing the replaced functions to be obfuscated into an executable file;

[0076] Determine the address offset between the entry address of the calling function in the executable file and the entry address of the function to be obfuscated in the executable file;

[0077] According to the correspondence between the placeholder and the calling function, the placeholder is replaced by the difference between the address offset and the preset number of header bytes of the function to be obfuscated in the executable file to obtain the target function.

[0078] It should be noted that in the embodiments of the present specification, the preset number of header bytes of the function to be obfuscated in the executable file refers to the preset number of header bytes of the function to be obfuscated in static state, and the preset header byte calculation function calculates the preset number of header bytes of the target function when it is running dynamically. Then, when determining whether the target function has been illegally tampered with, it can be determined whether the calculated preset number of header bytes of the target function is the same as the preset number of header bytes of the function to be obfuscated, so as to determine whether the target function has been illegally tampered with.

[0079] It is known that when the source code is compiled into an executable file, the compilation system can allocate storage space for each function in the source code. The first address of the storage space can be the entry address of the function in the executable file, and the function name corresponds to the entry address. If the function in the source code is to be run, the function can be pointed to through the entry address.

[0080] For ease of understanding, let's take the example of the source code A above as an example. After the source code A with the call statement replaced with the function pointer is compiled into an executable file, the address offset of the "add" function and the "do_things" function is calculated according to the "add" function corresponding to the placeholder "0x1111", and then the difference between the address offset and the preset number of header bytes of the "do_things" function is calculated to be "-0xEFE", then the placeholder "0x1111" can be replaced with "-0xEFE". It can be understood that if the executable file is a binary file, the difference between the calculated address offset and the preset number of header bytes of the function to be obfuscated can be converted into binary before replacement.

[0081] In the embodiment of the present specification, the placeholder is replaced with the function to be obfuscated after the difference between the address offset and the preset number of header bytes of the function to be obfuscated in the executable file, which can be the target function after the obfuscated function is obfuscated.

[0082] In the embodiment of the present specification, the function pointer includes the function name of the function to be obfuscated, the preset header byte calculation function and the placeholder, which is equivalent to the function pointer = the function name of the function to be obfuscated + the preset header byte calculation function + the placeholder, and the address offset is equivalent to the difference between the entry address of the calling function and the entry address of the function to be obfuscated. Then, the placeholder is replaced with the difference between the address offset and the preset number of header bytes of the function to be obfuscated. It can be obtained that: function pointer = function name of the function to be obfuscated + preset header byte calculation function + (entry address of the calling function-entry address of the function to be obfuscated)-preset number of header bytes of the function to be obfuscated. It can be known that if the calling function has not been tampered with, since the function name of the function to be obfuscated corresponds to the entry address of the function to be obfuscated, the preset number of header bytes of the target function calculated by the preset header byte calculation function is equal to the preset number of header bytes of the function to be obfuscated, then the function pointer is equal to the entry address of the calling function, or in other words, points to the entry address of the calling function, and the calling function can be called through the entry address. This process also realizes the decoding of the calling function in the target function. If the calling logic of calling the calling function is tampered with, that is, the target function is tampered with, since the assembly instructions of the tampered target function header will change, correspondingly, the preset number of header bytes of the target function will also change. In this case, the preset number of header bytes of the target function calculated by the preset header byte calculation function is not equal to the preset number of header bytes of the function to be obfuscated, then the function pointer cannot point to the entry address of the calling function, and an error will be reported when the target function is run, thereby achieving protection of the target function.

[0083] In the embodiment of the present specification, by replacing the calling function in the function to be obfuscated with a function pointer, the function pointer includes the function name of the function to be obfuscated, a preset header byte calculation function, and a placeholder matching the calling function, which is equivalent to obfuscating the calling logic in the function to be obfuscated. Compared with the method based on control flow flattening in the prior art, it not only effectively protects the calling logic of the function to be obfuscated, but also the code volume including the obfuscated target function will not increase much.

[0084] The above is the source code obfuscation method provided in the embodiment of this specification. The embodiment of this specification also provides a source code monitoring method, through which the target function can be monitored to see if it has been illegally tampered with. Figure 2 As shown, the source code monitoring method may include the following steps:

[0085] Step 22: Execute when the target function is running: calculate a preset number of header bytes of the target function by using a preset header byte calculation function to obtain a calculation result; determine the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculate the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function;

[0086] Step 23: Determine whether the target function has been illegally tampered with based on whether the decoded function pointer points to the calling function in the target function.

[0087] It can be understood that determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated is equivalent to determining the entry address of the function to be obfuscated in the executable file according to the function name of the function to be obfuscated, and then calculating the sum of the determined entry address of the target function, the calculation result, and the difference is equivalent to calculating the entry address of the target function + a preset number of header bytes of the target function + (the entry address of the calling function - the entry address of the function to be obfuscated) - a preset number of header bytes of the function to be obfuscated, so as to obtain the function pointer in the decoded target function.

[0088] In the embodiment of the present specification, judging whether the obfuscated target function has been illegally tampered with according to whether the decoded function pointer points to the calling function may include:

[0089] Whether the function pointer points to the calling function is determined based on whether the decoded function pointer points to the entry address of the calling function; if the decoded function pointer does not point to the entry address of the calling function, it is determined that the function pointer does not point to the calling function, and the obfuscated target function has been illegally tampered with.

[0090] As described above, according to the decoded function pointer = entry address of target function + preset number of header bytes of target function + (entry address of calling function - entry address of function to be obfuscated) - preset number of header bytes of function to be obfuscated, it can be known that if the calling logic of calling the calling function has not been tampered with, since the entry address of the target function is equal to the entry address of the function to be obfuscated, the preset number of header bytes of the target function calculated by the preset header byte calculation function is equal to the preset number of header bytes of the function to be obfuscated, then the calculation result of the function pointer can be equal to the entry address of the calling function, that is, it points to the entry address of the calling function, thereby determining that the target function has not been tampered with.

[0091] If the calling logic of calling the calling function is tampered with, that is, the target function is tampered with, since the assembly instructions of the tampered target function header will change, the preset number of header bytes of the target function will also change. In this case, the preset number of header bytes of the target function calculated by the preset header byte calculation function is not equal to the preset number of header bytes of the function to be obfuscated, then the decoded function pointer cannot point to the entry address of the calling function, thereby determining that the function pointer does not point to the calling function and that the target function has been illegally tampered with.

[0092] In the embodiments of the present specification, whether the decoded function pointer points to the calling function can be used to determine whether the obfuscated target function has been illegally tampered with, so that the target function can be monitored, and an alarm can be issued after determining that the target function has been illegally tampered with, thereby further protecting the source code.

[0093] Based on the same inventive concept as the source code obfuscation method provided in the embodiment of this specification, the embodiment of this specification also provides a corresponding source code obfuscation device. Figure 3 As shown, the source code obfuscation device specifically includes:

[0094] The acquisition module 101 is used to obtain the function name of the calling function contained in the function to be obfuscated in the source code;

[0095] A replacement module 102 is used to replace the calling statement of the calling function in the to-be-obfuscated function with a function pointer according to the function name of the calling function, so as to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function and a preset placeholder corresponding to the calling function;

[0096] The obfuscation module 103 is used to perform obfuscation processing on the replaced function to be obfuscated according to the correspondence between the placeholder and the calling function to obtain a target function; wherein the preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running to decode the function pointer.

[0097] The specific workflow of the source code obfuscation device embodiment may include: an acquisition module 101, acquiring a function name of a calling function contained in a to-be-obfuscated function in a source code; a replacement module 102, replacing a calling statement that calls the calling function in the to-be-obfuscated function with a function pointer according to the function name of the calling function, so as to obtain a replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a preset placeholder corresponding to the calling function; an obfuscation module 103, performing obfuscation processing on the replaced to-be-obfuscated function according to the corresponding relationship between the placeholder and the calling function, so as to obtain a target function; wherein the preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

[0098] In one implementation, the replacement module 102 includes:

[0099] A function pointer generating unit, configured to generate a function pointer according to the preset header byte calculation function, the preset placeholder corresponding to the calling function, and the function name of the function to be obfuscated;

[0100] A function pointer array generating unit, used for generating a function pointer array according to the function pointer and the index value corresponding to the calling function; the index value is used for indicating the function pointer corresponding to the calling function in the function pointer array;

[0101] A replacement unit is used to replace a calling statement that calls the calling function in the to-be-obfuscated function with the function pointer according to the function pointer array and the function name of the calling function, so as to obtain a replaced to-be-obfuscated function.

[0102] In one implementation, the obfuscation module 103 includes:

[0103] A compiling unit, used for compiling the source code including the replaced function to be obfuscated into an executable file;

[0104] An address offset determination unit, used to determine an address offset between an entry address of the calling function in the executable file and an entry address of the to-be-obfuscated function in the executable file;

[0105] A placeholder replacement unit is used to replace the placeholder with a difference between the address offset and a preset number of header bytes of the to-be-obfuscated function in the executable file according to a correspondence between the placeholder and the calling function, so as to obtain the target function.

[0106] In the embodiment of the present specification, by replacing the calling function in the function to be obfuscated with a function pointer, the function pointer includes the function name of the function to be obfuscated, a preset header byte calculation function, and a placeholder matching the calling function, which is equivalent to obfuscating the calling logic in the function to be obfuscated. Compared with the method based on control flow flattening in the prior art, it not only effectively protects the calling logic of the function to be obfuscated, but also the code volume including the obfuscated target function will not increase much.

[0107] Based on the same technical concept as the source code monitoring method provided in the embodiment of this specification, the embodiment of this specification also provides a source code monitoring device, through which the source code monitoring device can monitor whether the target function has been illegally tampered with, such as Figure 4 As shown, the source code monitoring device specifically includes:

[0108] The decoding module 201 is used to execute, when the target function is running: calculating a preset number of header bytes of the target function by the preset header byte calculation function to obtain a calculation result; determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function;

[0109] The judgment module 202 is used to judge whether the target function has been illegally tampered with according to whether the decoded function pointer points to the calling function in the target function.

[0110] The specific workflow of the source code obfuscation device embodiment may include: a decoding module 201, which is executed when the target function is running: calculating a preset number of header bytes of the target function by using the preset header byte calculation function to obtain a calculation result; determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function; and a judgment module 202, judging whether the target function has been illegally tampered with according to whether the decoded function pointer points to the calling function in the target function.

[0111] In one implementation, the determination module 202 includes:

[0112] An entry address determination unit, used to determine whether the decoded function pointer points to the entry address of the calling function;

[0113] The tampering judgment unit is used to judge that the target function has been illegally tampered with if the decoded function pointer does not point to the entry address of the calling function.

[0114] In the embodiments of the present specification, whether the decoded function pointer points to the calling function can be used to determine whether the obfuscated target function has been illegally tampered with, so that the target function can be monitored, and an alarm can be issued after determining that the target function has been illegally tampered with, thereby further protecting the source code.

[0115] The present specification also provides an electronic device, for which please refer to the schematic diagram Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0116] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0117] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0118] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming an application source code obfuscation device at the logical level. The processor executes the program stored in the memory and is used to perform at least the following operations:

[0119] Get the function name of the calling function contained in the function to be obfuscated in the source code;

[0120] According to the function name of the calling function, replacing the calling statement of the calling function in the to-be-obfuscated function with a function pointer to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a preset placeholder corresponding to the calling function;

[0121] According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain a target function;

[0122] The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

[0123] The above is an embodiment of the present specification Figure 1 The method performed by the source code obfuscation device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of this specification can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of this specification can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0124] The electronic device may also perform Figure 1 A method for executing a source code obfuscation device in the Figure 1The functions of the illustrated embodiments will not be described in detail in the embodiments of this specification.

[0125] The embodiment of the present specification also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to execute Figure 1 The method performed by the source code obfuscation device in the embodiment shown is at least used to perform:

[0126] Get the function name of the calling function contained in the function to be obfuscated in the source code;

[0127] According to the function name of the calling function, replacing the calling statement of the calling function in the to-be-obfuscated function with a function pointer to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a preset placeholder corresponding to the calling function;

[0128] According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain a target function;

[0129] The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer.

[0130] Those skilled in the art will appreciate that the embodiments of the present specification embodiments may be provided as methods, systems, or computer program products. Therefore, the present specification embodiments may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present specification embodiments may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0131] The embodiments of this specification are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] Computer readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity or device including the element.

[0138] The above are only examples of the embodiments of the present specification and are not intended to limit the embodiments of the present specification. For those skilled in the art, the embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the present specification shall be included in the scope of the claims of the embodiments of the present specification.

Claims

1. A source code obfuscation method, characterized in that: include: Get the function name of the calling function contained in the function to be obfuscated in the source code; According to the function name of the calling function, replacing the calling statement of the calling function in the to-be-obfuscated function with a function pointer to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function, and a preset placeholder corresponding to the calling function; According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain a target function; The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer; According to the correspondence between the placeholder and the calling function, the replaced function to be obfuscated is obfuscated to obtain a target function, including: Compile the source code containing the replaced function to be obfuscated into an executable file; Determine an address offset between an entry address of the calling function in the executable file and an entry address of the function to be obfuscated in the executable file; According to the correspondence between the placeholder and the calling function, the placeholder is replaced by the difference between the address offset and a preset number of header bytes of the to-be-obfuscated function in the executable file to obtain the target function.

2. The method according to claim 1, characterized in that According to the function name of the calling function, replacing the calling statement of the calling function in the to-be-obfuscated function with a function pointer to obtain the replaced to-be-obfuscated function, including: Generate a function pointer according to the preset header byte calculation function, the preset placeholder corresponding to the calling function, and the function name of the function to be obfuscated; Generate a function pointer array according to the function pointer and the index value corresponding to the calling function; the index value is used to indicate the function pointer corresponding to the calling function in the function pointer array; According to the function pointer array and the function name of the calling function, a calling statement in the function to be obfuscated that calls the calling function is replaced with the function pointer to obtain a replaced function to be obfuscated.

3. A source code monitoring method based on the source code obfuscation method of claim 1, characterized in that: The source code monitoring method comprises: When the target function is running, the following steps are performed: calculating a preset number of header bytes of the target function by using the preset header byte calculation function to obtain a calculation result; determining the entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function; Whether the target function has been illegally tampered with is determined according to whether the decoded function pointer points to the calling function in the target function.

4. The method according to claim 3, characterized in that The step of judging whether the target function has been illegally tampered with according to whether the decoded function pointer points to the calling function includes: Determine whether the decoded function pointer points to the entry address of the calling function; If the decoded function pointer does not point to the entry address of the calling function, it is determined that the target function has been illegally tampered with.

5. A source code obfuscation device, characterized in that: include: An acquisition module is used to obtain the function name of the calling function contained in the function to be obfuscated in the source code; A replacement module, used to replace the calling statement of the calling function in the to-be-obfuscated function with a function pointer according to the function name of the calling function, so as to obtain the replaced to-be-obfuscated function; the function pointer includes the function name of the to-be-obfuscated function, a preset header byte calculation function and a preset placeholder corresponding to the calling function; An obfuscation module, configured to perform obfuscation processing on the replaced function to be obfuscated according to the correspondence between the placeholder and the calling function, so as to obtain a target function; The preset header byte calculation function is used to calculate a preset number of header bytes of the target function when the target function is running, so as to decode the function pointer; Wherein, the obfuscation module includes: A compiling unit, used for compiling the source code including the replaced function to be obfuscated into an executable file; An address offset determination unit, used to determine an address offset between an entry address of the calling function in the executable file and an entry address of the to-be-obfuscated function in the executable file; A placeholder replacement unit is used to replace the placeholder with a difference between the address offset and a preset number of header bytes of the to-be-obfuscated function in the executable file according to a correspondence between the placeholder and the calling function, so as to obtain the target function.

6. A source code monitoring device based on the source code obfuscation device according to claim 5, characterized in that: The source code monitoring device comprises: A decoding module, configured to execute, when the target function is running: calculating a preset number of header bytes of the target function by the preset header byte calculation function to obtain a calculation result; determining an entry address of the target function in the executable file according to the function name of the function to be obfuscated; calculating the sum of the determined entry address of the target function, the calculation result and the difference to obtain a function pointer in the decoded target function; The judging module is used to judge whether the target function has been illegally tampered with according to whether the decoded function pointer points to the calling function in the target function.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the source code obfuscation method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the source code obfuscation method according to any one of claims 1 to 4 are implemented.

Images