Code obfuscation method, device, computing device and computer storage medium

Abstract

The present invention discloses a code obfuscation method, apparatus, computing device, and computer storage medium. The method includes: identifying multiple target functions in source code; generating a fusion function containing multiple target functions; creating a true execution path for each target function in the fusion function; for any target function, obtaining an execution result consistent with executing the target function in the source code based on the true execution path of the target function; inserting the fusion function into the source code, and for any target function, deleting the target function from the source code, and replacing the statement in the source code that calls the target function with a statement that calls the fusion function. This solution can hide the calling relationship of the target functions in the source code, improve the code obfuscation strength, increase the difficulty of reverse engineering the application, and improve the protection effect of the application.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a code obfuscation method, device, computing equipment and computer storage medium. Background Art

[0002] With the continuous development of science and technology and society, the number of various applications has increased rapidly. However, reverse cracking of applications has also continued to occur, threatening the security of applications.

[0003] Code obfuscation is used in application security because it increases the difficulty of reverse engineering applications. Commonly used code obfuscation methods include string obfuscation, which encrypts plaintext strings; control flow flattening, which flattens program flow; and instruction substitution, which replaces simple instructions with complex ones. However, existing code obfuscation methods have limited effectiveness in protecting applications, resulting in poor application protection. Summary of the Invention

[0004] In view of the above problems, the present invention is proposed to provide a code obfuscation method, apparatus, computing device and computer storage medium that overcome the above problems or at least partially solve the above problems.

[0005] According to one aspect of the present invention, a code obfuscation method is provided, comprising:

[0006] Identify multiple target functions in source code;

[0007] Generate a fusion function including the multiple target functions; create a real execution path for each target function in the fusion function; wherein, for any target function, based on the real execution path of the target function, an execution result consistent with executing the target function in the source code can be obtained;

[0008] The fusion function is inserted into the source code, and for any target function, the target function is deleted from the source code, and a statement in the source code that calls the target function is replaced with a statement that calls the fusion function.

[0009] In an optional embodiment, a false execution path is further created in the fusion function; wherein, based on the false execution path, an execution result consistent with executing any target function in the source code cannot be obtained.

[0010] In an optional embodiment, the method further comprises: generating at least one interference function;

[0011] Then the generating of the fusion function including the multiple objective functions further includes: generating a fusion function including the multiple objective functions and at least one interference function;

[0012] The actual execution path includes the interference function.

[0013] In an optional implementation, generating a fusion function including the multiple objective functions and at least one interference function further includes:

[0014] Pre-generating a graph structure template including at least one interference function, multiple empty nodes, and multiple execution paths; wherein each empty node corresponds to at least one preset execution path; and the preset execution path only includes one empty node and at least one interference function;

[0015] For any objective function, the code block of the objective function is randomly added to an empty node to generate the fusion function.

[0016] In an optional embodiment, after generating the fusion function including the multiple objective functions, the method further comprises: recording the path coding of the actual execution path of each objective function;

[0017] The statement for calling the fusion function carries the path encoding of the real execution path of the target function;

[0018] When executing the statement that calls the real function, it runs according to the execution path corresponding to the path parameter carried by the statement.

[0019] In an optional embodiment, the method further includes: for any target function, allocating characteristic parameters of the target function to each function in the real execution path of the target function; the statement calling the fused function carries the characteristic parameters of the target function;

[0020] When executing the statement that calls the fused function, the functions in the fused function are dynamically traversed to identify the function that matches the characteristic parameters carried in the statement, and run according to the execution path of the matching function.

[0021] In an optional embodiment, identifying multiple target functions in the source code further includes:

[0022] For any function in the source code, determine whether the function meets the following conditions: the function is a non-exported function, the function has a function body, and the function is a non-library function;

[0023] If so, the function is determined to be the objective function.

[0024] According to another aspect of the present invention, there is provided a code obfuscation device, comprising:

[0025] an identification module for identifying multiple target functions in the source code;

[0026] a generation module, configured to generate a fusion function including the plurality of objective functions; wherein the fusion function creates a true execution path for each objective function; wherein, for any objective function, based on the true execution path of the objective function, an execution result consistent with executing the objective function in the source code can be obtained;

[0027] A correction module is used to insert the fusion function into the source code, and for any target function, delete the target function from the source code, and replace the statement calling the target function in the source code with a statement calling the fusion function.

[0028] In an optional embodiment, a false execution path is further created in the fusion function; wherein, based on the false execution path, an execution result consistent with executing any target function in the source code cannot be obtained.

[0029] In an optional embodiment, the generating module is further configured to: generate at least one interference function; and generate a fusion function including the multiple objective functions and the at least one interference function;

[0030] The actual execution path includes the interference function.

[0031] In an optional embodiment, the generation module is further configured to: pre-generate a graph structure template comprising at least one interference function, a plurality of empty nodes, and a plurality of execution paths; wherein each empty node corresponds to at least one preset execution path; and the preset execution path comprises only one empty node and at least one interference function;

[0032] For any objective function, the code block of the objective function is randomly added to an empty node to generate the fusion function.

[0033] In an optional embodiment, the apparatus further comprises: a recording module configured to record the path coding of the actual execution path of each of the target functions after generating the fusion function including the multiple target functions;

[0034] The statement for calling the fusion function carries the path encoding of the real execution path of the target function;

[0035] When executing the statement that calls the real function, it runs according to the execution path corresponding to the path parameter carried by the statement.

[0036] In an optional embodiment, the device further includes an allocation module for allocating characteristic parameters of any target function to each function in the real execution path of the target function; the statement calling the fusion function carries the characteristic parameters of the target function;

[0037] When executing the statement that calls the fused function, the functions in the fused function are dynamically traversed to identify the function that matches the characteristic parameters carried in the statement, and run according to the execution path of the matching function.

[0038] In an optional embodiment, the identification module is further configured to: for any function in the source code, determine whether the function satisfies the following conditions: the function is a non-exported function, the function has a function body, and the function is a non-library function;

[0039] If so, the function is determined to be the objective function.

[0040] According to another aspect of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0041] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned code obfuscation method.

[0042] According to another aspect of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned code obfuscation method.

[0043] In the present invention, the target functions in the source code are merged into a fusion function. And all the logic that calls the target function is replaced with the logic that calls the fusion function, thereby hiding the calling relationship of the target function and increasing the difficulty of reverse engineering the application. In addition, the generated fusion function contains the real execution path of each target function. On the one hand, it can achieve the same function as the target function by calling the fusion function, ensuring the consistency of the program execution results. On the other hand, because the fusion function contains multiple target functions and multiple executable paths, it greatly increases the difficulty of reverse cracking the internal logic of the fusion function, thereby further improving the code obfuscation strength, increasing the difficulty of reverse engineering the application, and improving the protection effect of the application.

[0044] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0046] Figure 1 A schematic diagram of a code obfuscation method according to the first embodiment of the present invention is shown;

[0047] Figure 2 A schematic diagram of execution logic before and after code obfuscation provided by the first embodiment of the present invention is shown;

[0048] Figure 3 A schematic diagram of a code obfuscation method according to a second embodiment of the present invention is shown;

[0049] Figure 4 A schematic structural diagram of a fusion function provided in the second embodiment of the present invention is shown;

[0050] Figure 5 A schematic diagram of a code obfuscation method according to a third embodiment of the present invention is shown;

[0051] Figure 6 A schematic diagram of a graph structure template provided in the third embodiment of the present invention is shown;

[0052] Figure 7 A schematic diagram of a code obfuscation method according to a fourth embodiment of the present invention is shown;

[0053] Figure 8 A schematic diagram showing a flow chart of a code obfuscation method provided in a fifth embodiment of the present invention is shown;

[0054] Figure 9 A schematic diagram of the structure of a code obfuscation device provided in Example 6 of the present invention is shown;

[0055] Figure 10 A schematic structural diagram of a computing device provided in Embodiment 8 of the present invention is shown. DETAILED DESCRIPTION

[0056] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0057] By analyzing the protective effectiveness of existing code obfuscation methods, such as string obfuscation, control flow flattening, and instruction replacement, the inventors discovered that these methods are less effective against source code containing a large number of small functions. Further analysis of the causes of this phenomenon revealed that, in source code containing a large number of small functions, the calling relationships between functions largely reflect the overall execution logic of the program. However, existing code obfuscation methods are ineffective in hiding these calling relationships within the source code, resulting in poor protection for applications.

[0058] The code obfuscation solution provided by the implementation of the present invention can effectively hide the calling relationship between functions, increase the difficulty of reverse engineering, and improve the protection effect of the application program, especially having an excellent protection effect on the source code containing a large number of small function bodies.

[0059] Example 1

[0060] Figure 1 The flowchart of a code obfuscation method provided by the first embodiment of the present invention is shown. The code obfuscation method provided by the embodiment of the present invention can be applied to the security protection of any application. Figure 1 As shown, the method specifically includes the following steps:

[0061] Step S110 , identifying multiple target functions in the source code.

[0062] The source code is specifically the source code of the application to be protected. The source code contains many functions. This step identifies the target function from the functions contained in the source code by verifying the functions. The target function is specifically the function whose call path is subsequently hidden.

[0063] In an optional embodiment, for any function in the source code, it is determined whether the function meets the following conditions: the function is a non-exported function, the function has a function body, and the function is a non-library function. If the function meets the above conditions, the function is determined to be the target function. Among them, since export functions and library functions are usually called by other program modules, if the export function is used as the target function to hide the subsequent call path, it will cause errors in calls by other program modules. Based on this, the target function in the implementation of the present invention does not include export functions and library functions to ensure the accuracy of the calling process of other program modules. In addition, since functions without function bodies have less impact on the execution logic of the application, the target function in the embodiment of the present invention does not include functions without function bodies, so that computing resources can be saved on the basis of ensuring the reverse effect of the application.

[0064] Furthermore, in order to quickly identify the target function and simplify the execution logic of subsequent steps, embodiments of the present invention pre-parse the source code using a compiler to obtain intermediate code. This intermediate code is a simplification of the source code, removing information irrelevant to the execution logic of the main source code. During execution, this step specifically identifies multiple target functions in the source code based on the intermediate code.

[0065] Step S120, generating a fusion function including multiple target functions; the fusion function creates a real execution path of each target function; wherein, for any target function, based on the real execution path of the target function, an execution result consistent with executing the target function in the source code can be obtained.

[0066] The multiple objective functions identified in step S110 are combined into a fusion function. To increase the difficulty of reverse engineering, the fusion function can be a graph structure. In a graph-structured fusion function, each objective function is distributed as a graph node, and each objective function corresponds to a graph node in the fusion function.

[0067] Furthermore, the fused function creates the actual execution paths of each target function, resulting in a fused function containing multiple executable paths. For any target function, the actual paths of other target functions can serve as interference paths for that target function, making it more difficult for reverse engineers to crack the internal structure of the fused function. For any target function, the actual execution path of that target function can produce the same execution result as executing the target function in the source code.

[0068] Step S130 , inserting a fusion function into the source code, and for any target function, deleting the target function from the source code, and replacing the statement in the source code that calls the target function with a statement that calls the fusion function.

[0069] Deleting the target function from the source code can hide the target function's calling logic in the source code. Because the fused function already contains the actual execution paths of each target function, the functionality of each target function can be achieved by executing the fused function. Therefore, even after deleting the target function from the source code, the same functionality can still be achieved by calling the fused function, ensuring the consistency of program execution results.

[0070] In an optional embodiment, in order to accurately feed back the return value, a return value carrier is further created, which can store the output value generated after any path in the fused function is executed.

[0071] by Figure 2 For example, Figure 2 FIG1 shows a schematic diagram of execution logic before and after code obfuscation provided by the first embodiment of the present invention. Figure 2 As shown in the figure, before code obfuscation, the functions contained in the source code of the module are extern func1, func2, func3, func4 and func5. Among them, extern func1 is the export function, and func2, func3, func4 and func5 are the target functions. Through the implementation of steps S120-S130, the original func2, func3, func4 and func5 are deleted and replaced with the fusion function MAP func. Figure 2 As can be seen from the figure, after the code obfuscation process, the original calling relationships of func2, func3, func4 and func5 are hidden, thereby increasing the difficulty of reverse engineering the application.

[0072] It can be seen that the embodiment of the present invention merges multiple target functions in the source code into a fusion function, and replaces all logic that calls the target function with logic that calls the fusion function, thereby hiding the calling relationship of the target function. In addition, the generated fusion function contains the real execution path of each target function. On the one hand, it can achieve the same function as the target function by calling the fusion function, ensuring the consistency of the program execution results. On the other hand, because the fusion function contains multiple target functions and multiple executable paths, it greatly increases the difficulty of reverse cracking the internal logic of the fusion function, thereby further improving the code obfuscation strength, increasing the difficulty of reverse engineering the application, and improving the protection effect of the application.

[0073] Example 2

[0074] Figure 3 The flowchart of a code obfuscation method provided by the second embodiment of the present invention is shown. The code obfuscation method provided by the embodiment of the present invention can be applied to the security protection of any application. Figure 3 As shown, the method specifically includes the following steps:

[0075] Step S310: identifying multiple target functions in the source code.

[0076] Step S320: Generate at least one interference function.

[0077] To further increase the difficulty of reverse engineering an application, embodiments of the present invention further generate at least one interference function. This interference function can increase the complexity of the fusion function's internal structure, but it does not affect the execution results of the target function's actual execution path. For example, this interference function can be a jump or pointer function that points to the next execution node without generating a corresponding return result.

[0078] Step S330 , generating a fusion function including multiple target functions and at least one interference function; wherein the fusion function creates a real execution path of each target function and a false execution path.

[0079] The generated fusion function includes multiple target functions and at least one interference function. The fusion function also creates the actual execution path of each target function. As an optional implementation, the actual execution path of the target function can include interference functions. Therefore, even if a program reverser determines the actual execution path of the target function, they can still reverse-engineer the program using the interference functions in the actual execution path, preventing them from obtaining the actual execution logic of the target function.

[0080] In addition, a false execution path is created in the fused function. Based on this false execution path, it is impossible to obtain an execution result consistent with executing any target function in the source code, thereby further increasing the difficulty of reverse engineering the application.

[0081] by Figure 4 For example, Figure 4 FIG. 1 shows a schematic diagram of a fusion function structure provided by the second embodiment of the present invention. Figure 4 As shown, the fusion function includes the target functions f1, f2, f3, and f4, and also includes the interference function (corresponding to Figure 4 The objective function and the interference function are distributed in the fusion function in the form of graph nodes. Figure 4The arrows in the figure are directed edges between graph nodes, indicating execution paths. For each graph node, its descendant paths are numbered from left to right. The actual execution path for objective function f1 is 111; the actual execution path for objective function f2 is 311; the execution paths for objective function f3 are 211 and 212; and the execution paths for objective function f4 are 321 and 3311. This shows that each objective function corresponds to one or more actual execution paths, and each actual execution path contains the objective function. Figure 4 The false execution path in is 332, and it is impossible to obtain a consistent execution result of any objective function through the execution path 332.

[0082] Step S340: insert the fusion function into the source code, and for any target function, delete the target function from the source code, and replace the statement in the source code that calls the target function with a statement that calls the graph structure function.

[0083] It can be seen that the fusion function generated by the embodiment of the present invention also includes an interference function, thereby increasing the complexity of the internal structure of the fusion function and increasing the difficulty of reversing the application; and the embodiment of the present invention is also configured with a real execution path including the interference function and the target function. On the one hand, it can ensure that the function of the target function is realized by executing the fusion function. On the other hand, even if the program reverser determines the position of the target function in the fusion function, it can still perform reverse interference through the interference graph node function in the created real execution path; in addition, a false execution path is also created in the fusion function of the embodiment of the present invention. Based on the false execution path, it is impossible to obtain an execution result consistent with executing any target function in the source code, thereby further increasing the difficulty of reversing and ensuring the security of the application.

[0084] Example 3

[0085] Figure 5 The flowchart of a code obfuscation method provided by the third embodiment of the present invention is shown. The code obfuscation method provided by the embodiment of the present invention can be applied to the security protection of any application. Figure 5 As shown, the method specifically includes the following steps:

[0086] Step S510: pre-generate a graph structure template including at least one interference function, multiple empty nodes, and multiple execution paths.

[0087] In the embodiment of the present invention, in order to improve the efficiency of generating the fusion function, a graph structure template is generated in advance, so that the fusion function can be directly generated using the graph structure template later.

[0088] The graph structure template includes an interference function, which does not produce a substantial execution result, but is only used to increase the complexity of the fusion function. Furthermore, the graph structure template includes multiple empty nodes, which do not store code blocks. In addition, multiple execution paths are configured in the graph structure template. The multiple execution paths can be divided into two categories, one of which is a preset execution path, and each empty node corresponds to at least one preset execution path, and the preset execution path only contains one empty node and at least one interference function. The other category is an interference execution path, which only contains interference graph node functions.

[0089] by Figure 6 For example, Figure 6 FIG. 1 shows a schematic diagram of a graph structure template provided by the third embodiment of the present invention. Figure 6 As shown, the blank circle part represents the interference function, and the blank square part represents the empty node. Figure 6 The arrows in are directed edges between nodes, which are used to indicate the execution path. Figure 6 In the example, the preset execution path 111 includes three interference functions and one empty node, the preset execution path 211 includes three interference functions and one empty node, and so on. That is, each empty node corresponds to at least one preset execution path. In addition, the interference execution path 332 does not include any empty nodes.

[0090] Step S520: identifying multiple target functions in the source code.

[0091] Step S530: For any target function, randomly add the code block of the target function to an empty node to generate a fusion function.

[0092] Specifically, the code blocks of the target function are randomly added to the currently unoccupied empty nodes, and the fused function is obtained by adding the code blocks of each target function. For example, by copying the code blocks of the target functions f1, f2, f3, and f4 to Figure 6 After the empty node shown, generate Figure 4 The fusion function shown.

[0093] Step S540: inserting a fusion function into the source code, and for any target function, deleting the target function from the source code, and replacing the statement in the source code that calls the target function with a statement that calls the graph structure function.

[0094] It can be seen that in the embodiment of the present invention, a graph structure template containing interference functions, empty nodes and multiple execution paths is pre-generated. Therefore, when generating a fusion function, it is only necessary to copy the code block of the target function to the corresponding empty node to generate the fusion function, which greatly improves the generation speed of the fusion function and improves the code obfuscation efficiency.

[0095] Example 4

[0096] Figure 7 The flowchart of a code obfuscation method provided by the fourth embodiment of the present invention is shown. The code obfuscation method provided by the embodiment of the present invention can be applied to the security protection of any application. Figure 7 As shown, the method specifically includes the following steps:

[0097] Step S710: identifying multiple target functions in the source code.

[0098] Step S720: Generate a fusion function including multiple objective functions.

[0099] Step S730 , recording the path code of the actual execution path of each target function.

[0100] To ensure that the fused function accurately implements the functionality of the target function and that program execution results are consistent, the path encoding of each target function's actual execution path must be recorded. This generates a path planning table, which records the path encoding of each target function's actual execution path. Each execution path's path encoding is globally unique.

[0101] The path set in the path planning table is a subset of the path set in the fusion function. Take Formula 1 as an example. In Formula 1, I is the path set in the path planning table, U is the path set in the fusion function, and F1 is the target function information. For any target function, there must be at least one execution path in the fusion function's path set that has the same execution result as the target function. This execution path is the actual execution path for the target function.

[0102] I (FI) =U (x∈M) (Formula 1)

[0103] by Figure 4 Taking the graph structure function shown in the figure as an example, the subsequent paths of each graph node are numbered from left to right. The actual execution paths of the target function f3 are: 211 and 212, which are converted into binary codes as 100101 and 100110.

[0104] Step S740: insert a fusion function into the source code, and for any target function, delete the target function from the source code, and replace the statement in the source code that calls the target function with a statement that calls the fusion function; wherein the statement that calls the fusion function carries the path encoding of the actual execution path of the target function.

[0105] The statement calling the fusion function carries the path encoding of the actual execution path of the target function. When the replaced statement calling the fusion function is executed, it will run according to the execution path corresponding to the path parameters carried by the statement, thereby realizing the function of the target function.

[0106] For example, the statement that calls the target function f3 is f3(arg1, arg2…), where arg1 and arg2 are the parameters of the target function f3. If the path code of the actual execution path of the target function f3 is 100110, then the statement that calls the fused function is MAP(100110, arg1, arg2…). This means that the statement that calls the fused function carries the path code 100110 of the actual execution path of the target function f3. During the execution of the statement that calls the fused function, the execution is carried out according to the execution path corresponding to the path code 100110.

[0107] In an optional embodiment, there may be multiple real execution paths of the target function, and the path encoding of one real execution path can be dynamically and randomly selected and placed in the statement of calling the fusion function after replacement, thereby further increasing the difficulty of reverse engineering and improving the security protection effect of the application.

[0108] Thus, the embodiment of the present invention records the path encoding of the actual execution path of each target function, and carries the path encoding of the actual execution path of the corresponding target function in the statement replaced by the call to the fusion function. Therefore, during the execution of the fusion function, the execution path corresponding to the path encoding can be run according to this execution path, thereby ensuring that the fusion function can accurately implement the function of the target function and ensure the consistency of the program execution results. Moreover, the embodiment of the present invention can quickly determine the execution path that the fusion function currently needs to execute, thereby reducing performance loss during program execution.

[0109] Example 5

[0110] Figure 8 The flowchart of a code obfuscation method provided by the fifth embodiment of the present invention is shown. The code obfuscation method provided by the embodiment of the present invention can be applied to the security protection of any application. Figure 8 As shown, the method specifically includes the following steps:

[0111] Step S810: identifying multiple target functions in the source code.

[0112] Step S820: Generate a fusion function including multiple objective functions; wherein, for any objective function, assign characteristic parameters of the objective function to functions in the actual execution path of the objective function.

[0113] Step S830, inserting a fusion function into the source code, and for any target function, deleting the target function from the source code, and replacing the statement in the source code that calls the target function with a statement that calls the fusion function; wherein the statement that calls the fusion function carries the characteristic parameters of the target function.

[0114] The characteristic parameter may be the number, name, parameter name, etc. of the objective function. The corresponding objective function can be uniquely determined by the characteristic parameter.

[0115] When executing the statement that calls the fused function, the functions in the fused function are dynamically traversed. If the currently traversed function has characteristic parameters that match the characteristic parameters carried in the statement, the currently traversed function is determined to be a function in the real execution path of the target function, thereby identifying the function that matches the characteristic parameters carried in the statement, and then running according to the execution path of the identified matching function.

[0116] In an optional embodiment, the real execution path of each target function only contains one target function. Therefore, in the specific implementation process of the embodiment of the present invention, the position of each target function in the fusion function can be recorded. In the traversal process, specifically, a depth-first traversal is performed starting from the head node in the fusion function to determine whether the node corresponding to the target function has been reached. If the node corresponding to the target function has not been traversed to the end point, then it will fall back to the upper node to continue traversing other branch paths. If the currently traversed function matches the characteristic parameters carried by the statement, it is determined that the current node is the node corresponding to the target node, and then it is traversed to the end point according to the depth-first rule, and the final path is used as the real execution path of the target function. Among them, the obtained path can be recorded in a corresponding manner, for example, it can be recorded in the following manner.

[0117]

[0118]

[0119] The above recording method can be used to conveniently record the information of the graph nodes in the fusion function, which is conducive to improving the rapid identification of the real execution path.

[0120] It can be seen that the embodiment of the present invention adopts a dynamic traversal method to determine the current execution path of the fusion function, thereby further increasing the difficulty of reverse engineering the application program and increasing the reverse engineering cost.

[0121] Example 6

[0122] Figure 9 FIG. 1 shows a schematic diagram of the structure of a code obfuscation device provided by Example 6 of the present invention. Figure 9As shown, the device 900 includes: an identification module 910, a generation module 920, and a correction module 930.

[0123] Identification module 910, for identifying multiple target functions in the source code;

[0124] A generation module 920 is configured to generate a fusion function including the plurality of objective functions; wherein the fusion function creates a real execution path for each objective function; wherein, for any objective function, based on the real execution path of the objective function, an execution result consistent with executing the objective function in the source code can be obtained;

[0125] The correction module 930 is used to insert the fusion function into the source code, and for any target function, delete the target function from the source code, and replace the statement calling the target function in the source code with a statement calling the fusion function.

[0126] In an optional embodiment, a false execution path is further created in the fusion function; wherein, based on the false execution path, an execution result consistent with executing any target function in the source code cannot be obtained.

[0127] In an optional embodiment, the generating module is further configured to: generate at least one interference function; and generate a fusion function including the multiple objective functions and the at least one interference function;

[0128] The actual execution path includes the interference function.

[0129] In an optional embodiment, the generation module is further configured to: pre-generate a graph structure template comprising at least one interference function, a plurality of empty nodes, and a plurality of execution paths; wherein each empty node corresponds to at least one preset execution path; and the preset execution path comprises only one empty node and at least one interference function;

[0130] For any objective function, the code block of the objective function is randomly added to an empty node to generate the fusion function.

[0131] In an optional embodiment, the apparatus further comprises: a recording module configured to record the path coding of the actual execution path of each of the target functions after generating the fusion function including the multiple target functions;

[0132] The statement for calling the fusion function carries the path encoding of the real execution path of the target function;

[0133] When executing the statement that calls the real function, it runs according to the execution path corresponding to the path parameter carried by the statement.

[0134] In an optional embodiment, after generating the fusion function including the plurality of objective functions, the path coding of the actual execution path of each of the objective functions is recorded;

[0135] The statement for calling the fusion function carries the path encoding of the real execution path of the target function;

[0136] When executing the statement that calls the real function, it runs according to the execution path corresponding to the path parameter carried by the statement.

[0137] In an optional embodiment, the identification module is further configured to: for any function in the source code, determine whether the function satisfies the following conditions: the function is a non-exported function, the function has a function body, and the function is a non-library function;

[0138] If so, the function is determined to be the objective function.

[0139] The specific implementation process of each module in this embodiment can refer to the description in the corresponding method embodiment and will not be repeated here.

[0140] It can be seen that the embodiment of the present invention merges multiple target functions in the source code into a fusion function, and replaces all logic that calls the target function with logic that calls the fusion function, thereby hiding the calling relationship of the target function. In addition, the generated fusion function contains the real execution path of each target function. On the one hand, it can achieve the same function as the target function by calling the fusion function, ensuring the consistency of the program execution results. On the other hand, because the fusion function contains multiple target functions and multiple executable paths, it greatly increases the difficulty of reverse cracking the internal logic of the fusion function, thereby further improving the code obfuscation strength, increasing the difficulty of reverse engineering the application, and improving the protection effect of the application.

[0141] Example 7

[0142] A seventh embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the code obfuscation method in any of the above method embodiments.

[0143] Example 8

[0144] Figure 10 FIG1 shows a schematic diagram of the structure of a computing device provided by Embodiment 8 of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0145] like Figure 10As shown, the computing device may include: a processor (processor) 1002 , a communications interface (Communications Interface) 1004 , a memory (memory) 1006 , and a communication bus 1008 .

[0146] Processor 1002, communication interface 1004, and memory 1006 communicate with each other via communication bus 1008. Communication interface 1004 is used to communicate with other devices, such as clients or other server network elements. Processor 1002 is used to execute program 1010, which may specifically perform the steps described in the aforementioned embodiment of the code obfuscation method.

[0147] Specifically, the program 1010 may include program codes, which include computer operation instructions.

[0148] Processor 1002 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a computing device may be processors of the same type, such as one or more CPUs, or processors of different types, such as one or more CPUs and one or more ASICs.

[0149] The memory 1006 is used to store the program 1010. The memory 1006 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0150] Program 1010 can be specifically used to enable processor 1002 to perform code obfuscation in any of the above-mentioned method embodiments. The specific implementation of each step in program 1010 can refer to the corresponding description of the corresponding steps and units in the above-mentioned code obfuscation method embodiments, and will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the above-mentioned devices and modules can refer to the corresponding process description in the above-mentioned method embodiments, and will not be repeated here.

[0151] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0152] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0153] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0154] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0155] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0156] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components according to an embodiment of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing a part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0157] It should be noted that the above embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by a person skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A code obfuscation method, characterized in that: include: Identify multiple target functions in source code; generating a fusion function including the multiple objective functions; The fusion function creates a real execution path for each target function; wherein, for any target function, based on the real execution path of the target function, an execution result consistent with executing the target function in the source code can be obtained; wherein, a graph structure template including at least one interference function, multiple empty nodes, and multiple execution paths is pre-generated; each empty node corresponds to at least one preset execution path; the preset execution path only includes one empty node and at least one interference function; for any target function, a code block of the target function is randomly added to an empty node to generate the fusion function; The fusion function is inserted into the source code, and for any target function, the target function is deleted from the source code, and a statement in the source code that calls the target function is replaced with a statement that calls the fusion function.

2. The method according to claim 1, characterized in that A false execution path is also created in the fusion function; wherein, based on the false execution path, no execution result consistent with executing any target function in the source code can be obtained.

3. The method according to claim 1, characterized in that After generating the fusion function including the multiple objective functions, the method further comprises: recording the path coding of the actual execution path of each objective function; The statement for calling the fusion function carries the path encoding of the real execution path of the target function; When executing the statement that calls the fusion function, it runs according to the execution path corresponding to the path parameter carried by the statement.

4. The method according to claim 1, wherein The method further includes: for any target function, allocating characteristic parameters of the target function to each function in the real execution path of the target function; the statement calling the fusion function carries the characteristic parameters of the target function; When executing the statement that calls the fused function, the functions in the fused function are dynamically traversed to identify the function that matches the characteristic parameters carried in the statement, and run according to the execution path of the matching function.

5. The method according to any one of claims 1 to 4, characterized in that The identifying of multiple target functions in the source code further comprises: For any function in the source code, determine whether the function meets the following conditions: the function is a non-exported function, the function has a function body, and the function is a non-library function; If so, the function is determined to be the objective function.

6. A code obfuscation device, characterized in that: include: an identification module for identifying multiple target functions in the source code; A generating module, configured to generate a fusion function including the multiple objective functions; The fusion function creates a real execution path for each target function; wherein, for any target function, based on the real execution path of the target function, an execution result consistent with executing the target function in the source code can be obtained; wherein, a graph structure template including at least one interference function, multiple empty nodes, and multiple execution paths is pre-generated; each empty node corresponds to at least one preset execution path; the preset execution path only includes one empty node and at least one interference function; for any target function, a code block of the target function is randomly added to an empty node to generate the fusion function; A correction module is used to insert the fusion function into the source code, and for any target function, delete the target function from the source code, and replace the statement calling the target function in the source code with a statement calling the fusion function.

7. A computing device, characterized in that include: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the code obfuscation method according to any one of claims 1 to 5.

8. A computer storage medium, characterized in that The storage medium stores at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the code obfuscation method according to any one of claims 1 to 5.

Images