A method and system for converting arbitrary bytes into execution logic

Abstract

The present invention relates to the technical field of object encoding reorganization and file format conversion, and discloses a method for converting any byte into execution logic, including: step S1. The client reads the input object in the form of a binary byte stream to obtain binary data; step S2. The client re-encodes the input object and stores it in an execution logic module; step S3. The client compiles and saves the execution logic and generates an execution file; step S4. After running the execution logic, the original object is restored; step S5. The original object is loaded into the memory to view or directly released and run. The present invention also discloses a system for converting any byte into execution logic. The present invention is used to encode and protect the original object, further prevent reverse cracking, and has better versatility.

Description

Technical Field

[0001] The present invention relates to the technical field of object encoding reorganization and file format conversion, and in particular to a method and system for converting any byte into execution logic, which is used for encoding and protecting the original object, further preventing reverse cracking, and has better versatility. Background Art

[0002] Data security has gradually become an integral part of information security. With vulnerability scanning, hash collision, binary reversal and other attacks, information data is inevitably subject to cracking and extortion. Attackers use vulnerability scanning tools and binary reversal tools to illegally obtain information and steal data to seek more benefits.

[0003] In order to solve the above problems, a method is urgently needed that can effectively prevent source hash collisions and encode and protect the original object to further prevent reverse cracking. The converted object is converted into another logic, and the original object is obtained by executing the logic, which has better versatility. Summary of the invention

[0004] The purpose of the present invention is to provide a method for converting any byte into execution logic, realizing the function of converting any object, and having the effect of making data management more flexible and secure.

[0005] The present invention is implemented by the following technical solution: a method for converting any byte into execution logic, comprising the following steps:

[0006] Step S1. The client reads the input object in the form of a binary byte stream to obtain binary data;

[0007] Step S2. The client re-encodes the input object and stores it in the execution logic module;

[0008] Step S3. The client compiles and saves the execution logic and generates the execution logic;

[0009] Step S4. After running the execution logic, restore the original object;

[0010] Step S5: Load the execution logic into the memory to view or directly release and run the original object.

[0011] This technical solution uses a method of converting any object into execution logic. The converted object is converted into execution logic, and the original object is encoded in the execution logic. This technical solution effectively prevents source hash collisions and encodes and protects the original object to further prevent reverse cracking. The converted object is converted into another logic, and the logic is executed to obtain the original object. At the same time, the execution logic has cross-platform characteristics and better versatility.

[0012] In order to better implement the present invention, further, step S1 includes:

[0013] Input objects include objects on disk, and binary data includes visible and invisible characters.

[0014] In this technical solution, ASCII encoding is generally used internationally as the universal character encoding. In the ASCII code table, including spaces, there are 95 visible characters from 32 to 126, and 94 if spaces are not counted. The rest are invisible characters, that is, they cannot be printed directly. The input object to be read must read visible characters and invisible characters to obtain a complete disk file.

[0015] In order to better implement the present invention, further, step S3 includes:

[0016] Read the binary data in the memory bit by bit, perform bitwise XOR encoding on the read binary data, rearrange the encoded binary data, and disrupt the original read binary data;

[0017] Using the first sixteen bits of the encoded binary data as a secret key, encrypting the encoded binary data to generate new binary secret memory data;

[0018] The new binary secret memory data is compressed to generate new memory slice data.

[0019] In this technical solution, the input object is read and read into the memory in the form of a binary byte stream, and the binary data read into the memory is stored in memory encoding, and the memory encoding storage reads and reorganizes the memory slice in binary form. At the same time, the new binary memory data is compressed and compressed to generate new memory slice data, which can reduce the data storage volume.

[0020] In order to better implement the present invention, further, step S3 also includes: generating data logic, reading memory data, and storing it in the internal variables of the execution logic;

[0021] Generate decompression logic, and store the generated corresponding decompression logic in the logic body of the execution logic;

[0022] Generate decryption logic, and store the generated corresponding decryption logic in the logic body of the execution logic;

[0023] Generate decoding logic, and store the generated corresponding decoding logic in the logic body of the execution logic;

[0024] Generate reorganization logic, and store the generated data reorganization logic in a logic body of the execution logic;

[0025] Generate execution logic, generate execution logic after data reorganization, and store it in the logic body of the execution logic;

[0026] Save the execution logic, compile the generated execution logic source code, compile it into executable logic and save it for implementation. After saving and implementing, run the compiled execution logic.

[0027] This technical solution can convert binary executable programs. After the conversion, the binary executable program is written into the execution logic and hidden in the logical body through encoding. The original program is directly re-encoded. Compared with the binary executable program, the virus cannot obtain the executable file header and cannot damage or even bundle the Trojan horse through implantation, which greatly reduces the risk of the executable file being attacked.

[0028] In order to better implement the present invention, further, step S4 includes:

[0029] Execution logic includes encoding data;

[0030] The encoded data is stored in the variable of the execution logic after encoding and reorganization, and the variable is read into the memory to obtain the encoded and stored memory binary data;

[0031] Decompress the binary memory slice read into the memory, and generate new binary memory data after decompression;

[0032] Decrypt the binary memory chip. The decryption key is the first sixteen bits of the binary. After decryption, new binary memory data is generated.

[0033] Perform XOR decoding on the decrypted binary memory data to generate new binary byte stream data;

[0034] Reassemble the decoded binary byte stream data to generate a reassembled original object;

[0035] Use the corresponding tool to perform operations on the restored original object, or directly run the original object in binary mode, and the original object is directly executed through the operating system;

[0036] Save the execution logic, compile the generated execution logic source code, compile it into executable logic and save it for implementation. After saving and implementing, run the compiled execution logic.

[0037] In this technical solution, encoding storage is to convert object information into storable information and write its current state into the execution logic storage area. The object can be recreated later by reading the decoded object from the execution logic storage area. For any object that may contain important security data, encoding storage can be performed to generate a specific byte stream to save the encoded data. Running the execution logic after encoding storage can resist all known attacks, execute cross-platform on multiple platforms, and has a simple design and fast execution speed.

[0038] In order to better implement the present invention, further, running the compiled execution logic includes:

[0039] Run the execution logic and specify the input parameters. The input parameters are the execution logic of the original object. When the original object has no specified running logic, the original object will be handed over to the operating system for execution.

[0040] After executing the logic to restore the original object, it is handed over to a third-party program for reading and running;

[0041] No parameters are passed to the execution logic, and the restored original object will be directly handed over to the operating system for execution;

[0042] The execution logic reads the internally encoded data variables and loads the variables into the memory in binary form;

[0043] Execute logical decompression of memory data, perform memory decompression operation on the read binary memory data, and obtain new binary memory data;

[0044] Execute the logic to decrypt the binary memory data. Use the first sixteen bits of the binary memory data as the secret key to decrypt the decompressed binary memory data. After decryption, obtain the new memory data.

[0045] The execution logic performs XOR rearrangement on the binary memory data to obtain the original binary byte stream after rearrangement;

[0046] Execute logic to reorganize the rearranged binary byte stream to obtain the source object;

[0047] The execution logic passes the original object to a pre-specified program to open. If there is no pre-specified program, the source object will be handed over to the operating system for execution;

[0048] The execution logic clears the memory and then exits, leaving the original object already loaded into memory and opened.

[0049] In this technical solution, the third-party program includes opening the original object through zip tools, pdf tools and word document tools. Pre-specified programs such as zip tools, office tools, etc. Therefore, this technical solution can also convert the zip compressed object, and after the conversion, the logic can be executed to view the original object before zip compression. Compared with directly using the zip tool to encrypt and compress, the zip tool itself is vulnerable to attacks. The zip plug-in can use zip to bundle files and even add viruses to the zip file. This technical solution can effectively prevent zip compression encryption from being attacked by viruses.

[0050] In order to better implement the present invention, the present invention also discloses a system for converting any byte into execution logic, including a client and an execution logic module, wherein:

[0051] The client is used to read the input object in the form of a binary byte stream to obtain binary data; to re-encode the input object and store it in the execution logic module; to compile and save the execution logic and generate the execution logic;

[0052] The execution logic module is used to restore the original object after running the execution logic; it is used to view the original object by loading it into the memory or directly release it.

[0053] This technical solution uses a method of converting any object into execution logic, providing a system that converts any byte into execution logic. This system can be used across multiple platforms such as Windows, Mac, Linux, x86 and ARM.

[0054] In order to better implement the present invention, further, the client module includes a conversion module:

[0055] The conversion module is used to read binary data into memory, encode, encrypt and compress files, and generate corresponding binary variables; to encode and reorganize binary data in memory; to generate execution logic, and to generate execution logic for decompression, decryption, decoding, reorganization and loading.

[0056] This technical solution can convert binary executable programs through a conversion module. After the conversion, the binary executable program is written into the execution logic and hidden in the logical body through encoding. The original program is directly re-encoded. Compared with the binary executable program, the virus cannot obtain the executable file header, and cannot destroy or even bundle the Trojan horse through implantation, which greatly reduces the risk of the executable file being attacked.

[0057] In order to better implement the present invention, further, the execution logic module runs on the operating system.

[0058] This technical solution can convert TXT text, PPT slides, PDF documents and WORD documents on the operating system. After conversion, the relevant files are encoded and written into the execution logic body, and the original document is converted into the execution logic (the format is changed). The original file can be obtained by running the execution logic. This method can not only hide the original document for storage, but also change the format of the original document, making it completely impossible for ransomware, macro virus and other document-damaging operations to start.

[0059] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0060] (1) The present invention is not a pure encryption and decryption technology, but rather converts any object into an executable execution logic;

[0061] (2) The present invention can also transform any object, including the execution logic itself, which can be further transformed. Iterating the execution logic helps to further hide the original object;

[0062] (3) The execution logic in the present invention can be executed simultaneously across operating systems and across different CPU architectures after being compiled;

[0063] (4) After the logical conversion, the source object format is changed, which effectively avoids file scanning attacks and provides protection against illegal use of data;

[0064] (5) The present invention reorganizes the data encoding of any object, which effectively avoids data hash collision, file content scanning and file reversal;

[0065] (6) In addition to converting data objects, the present invention can also convert binary executable objects. After conversion, the binary executable objects are reorganized and encoded as above and stored in the execution logic variable. The original objects are converted into execution logic, which shields the vulnerability mining of binary objects by related scanners, avoids the reverse analysis and utilization of binary scanning, ensures the security and reliability of binary objects, and provides effective protection for preventing Trojan horse bundling and shelling. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The present invention is further described in conjunction with the following drawings and embodiments, and all the concepts and innovations of the present invention should be regarded as the disclosed contents and the protection scope of the present invention.

[0067] Figure 1 The present invention provides a flowchart of a method for converting any byte into execution logic.

[0068] Figure 2 A schematic diagram of the structure of a system for converting arbitrary bytes into execution logic provided by the present invention.

[0069] Among them: 10, client; 11, conversion module; 20, execution logic module; 21, operating system. DETAILED DESCRIPTION

[0070] Embodiment 1:

[0071] A method of converting any byte into execution logic in this embodiment is as follows: Figure 1 As shown, this embodiment uses a method for converting any object into execution logic. The converted object is converted into execution logic, and the original object is encoded in the execution logic. The present invention effectively prevents source hash collisions and encodes and protects the original object to further prevent reverse cracking. The converted object is converted into executable logic, and the logic is executed to obtain the original object. At the same time, the execution logic has a cross-platform feature and better versatility.

[0072] In this embodiment, the execution logic is run and input parameters are specified, and the input parameters are the original object execution logic. When the original object has no specified running logic, the original object will be handed over to the operating system for execution; the input parameters in this embodiment refer to the parameters passed to the execution logic when the execution logic is running, and the parameters are the original object running environment; the original object running environment in this embodiment refers to the execution logic restoring the original object and handing it over to a third-party program for reading and running, such as: zip tool and pdf tool, word document tool to open the original object; no running logic in this embodiment means that no parameters are passed to the execution logic, and the restored original object will be directly handed over to the operating system for running; the execution logic in this embodiment passes the original object to a pre-specified program to open, such as a zip tool, office tool, etc. If there is no pre-specified program, the source object will be handed over to the operating system for execution, the execution logic clears the memory, and then exits, leaving the original object that has been loaded into the memory to open.

[0073] The invention can convert zip data files, and after conversion, the original files before zip compression can be viewed by running a program in Python. The invention can also convert binary executable programs, and after conversion, the binary executable programs are transformed into Python bytecode programs, and the original programs are directly encoded, encrypted and hidden.

[0074] In this embodiment, an arbitrary file is converted into PYTHON bytecode for example. First, the input file is received, and the program reads the input file into the memory in binary form; the read memory chip is converted into XOR 42 encoding; the incoming file name is used as the encryption KEY, and the memory data after XOR is encrypted by AES256; the generated AES256 encrypted data is stored in the internal CODE variable of the PYTHON program; the PYTHON logic code is generated as above, the code contains the AES256 encrypted data stored as the CODE variable, generates AES256 decryption logic, generates memory XOR 42 decoding logic, and generates the execution logic source code for opening the decoded data; the generated PYTHON source code is converted into bytecode using the PYTHON parser, compiled into PYTHON bytecode, and the name is kept unchanged. Secondly, the PYTHON bytecode program is used to decode the data, and finally the original file that has been opened is obtained. Based on this embodiment, it is mainly through converting the data into a PYTHON bytecode program: then reading the input file, encrypting and encoding the file, and generating PYTHON bytecode executable logic.

[0075] Embodiment 2:

[0076] This embodiment is further optimized on the basis of Embodiment 1. ASCII encoding is generally adopted as the universal character encoding internationally. In the ASCII code table, including spaces, there are 95 visible characters from 32 to 126, and 94 characters excluding spaces. The rest are invisible characters, that is, they cannot be printed directly. The input object to be read must read visible characters and invisible characters to obtain a complete disk file.

[0077] The other parts of this embodiment are the same as those of Embodiment 1, and thus will not be described in detail.

[0078] Embodiment 3:

[0079] This embodiment reads the input object, reads the input object into the memory in the form of a binary byte stream, performs memory encoding storage on the binary data read into the memory, and the memory encoding storage reads and reorganizes the memory slice in the form of binary. At the same time, the new binary memory data is compressed, and new memory slice data is generated after compression, which can reduce the data storage volume.

[0080] The encryption algorithm in this embodiment can be AES256, which is a commonly used encryption and decryption algorithm. AES is called an advanced encryption algorithm, and the key length can be 128, 192 or 256 bits. AES uses a block encryption standard, which is used to replace the original DES. The advanced encryption standard has become one of the most popular algorithms in symmetric key encryption. AES can encrypt and decrypt quickly in both software and hardware, is relatively easy to implement, and requires only a small amount of memory. As a new encryption standard, it is currently being deployed and applied to a wider range. AES encryption can resist all known attacks, is fast on multiple platforms, has compact coding, and is simple in design. Since AES is already a mature and public algorithm, it will not be repeated here.

[0081] In this embodiment, the specific operation steps of converting an arbitrary file into Python bytecode are as follows: first, Python is used to execute the generated Python bytecode program; second, the Python bytecode program receives input parameters, and the parameters are decoded data opened by the program; second, the Python bytecode program uses the AES256 built-in decryption function, and uses the program name as the KEY to decrypt the built-in CODE variable into the memory environment, and then the Python bytecode program passes the decoded memory data in binary form to a pre-specified program to open it, such as opening it with Windows and zip; finally, the Python bytecode program then exits to obtain the original file that has been opened.

[0082] The other parts of this embodiment are the same as those of Embodiment 1, and thus will not be described in detail.

[0083] Embodiment 4:

[0084] This embodiment is further optimized on the basis of embodiment 1. This embodiment can convert binary executable programs. After conversion, the binary executable program is written into the execution logic and hidden in the logical body through encoding. The original program is directly re-encoded. Compared with the binary executable program, the virus cannot obtain the executable file header and cannot destroy or even bundle the Trojan horse through the implantation method, which greatly reduces the risk of the executable file being attacked.

[0085] The other parts of this embodiment are the same as those of Embodiment 1, and thus will not be described in detail.

[0086] Embodiment 5:

[0087] This embodiment is further optimized on the basis of embodiment 1. Encoded storage is to convert object information into storable information and write its current state into the execution logic storage area. The object can be recreated later by reading the decoded object from the execution logic storage area. For any object that may contain important security data, it can be encoded and stored, and a specific byte stream can be generated to save the encoded data. Running the execution logic after encoding and storage can resist all known attacks, execute across multiple platforms, and has a simple design and fast execution speed.

[0088] The other parts of this embodiment are the same as those of Embodiment 1, and thus will not be described in detail.

[0089] Embodiment 6:

[0090] This embodiment is further optimized on the basis of embodiment 5, and the third-party program includes opening the original object through a zip tool, a pdf tool, and a word document tool. Pre-specified programs such as zip tools, office tools, etc. Therefore, the present invention can also convert the zip compressed object, and after the conversion, the original object before zip compression can be viewed by executing the logic. Compared with directly using the zip tool to encrypt and compress, the zip tool itself is vulnerable to attack. The zip plug-in can use zip to bundle files and even add viruses to the zip file. This technical solution can effectively prevent zip compression encryption from being attacked by viruses.

[0091] The other parts of this embodiment are the same as those of embodiment 5, so they will not be described in detail.

[0092] Embodiment 7:

[0093] A system of this embodiment converts any byte into execution logic, such as Figure 2 As shown, this system uses a method of converting any object into execution logic, providing a system for converting any byte into execution logic. This system can be used across multiple platforms in environments such as Windows, Mac, Linux, x86, and ARM. In addition to converting data objects, this system can also convert binary executable objects. After conversion, the binary executable objects are reorganized and encoded as above and stored in the execution logic variable. The original object is converted into execution logic, which shields the vulnerability mining of binary objects by related scanners, avoids the reverse analysis and utilization of binary scanning, ensures the security and reliability of binary objects, and provides effective protection for stopping Trojan bundling and shelling.

[0094] In this embodiment, an arbitrary file is converted into PYTHON bytecode as an example, which can be used to run in Windows, Mac and Linux environments.

[0095] Embodiment 8:

[0096] This embodiment is further optimized on the basis of embodiment 7. Figure 2 As shown, the binary executable program can be converted by the conversion module 11 on the client 10. After the conversion, the binary executable program is written into the execution logic and hidden in the logical body through encoding, that is, stored in the execution logic module 20. The original program is directly re-encoded. Compared with the binary executable program, the virus cannot obtain the executable file header, and cannot destroy or even bundle the Trojan horse by implantation, which greatly reduces the risk of the executable file being attacked.

[0097] The other parts of this embodiment are the same as those of Embodiment 7, and thus will not be described in detail.

[0098] Embodiment 9:

[0099] This embodiment is further optimized on the basis of embodiment 7. Figure 2 As shown, TXT text, PPT slides, PDF documents, WORD documents, etc. can be converted in the operating system 21 using the execution logic module 20. After the conversion, the relevant files are encoded and written into the execution logic body, and the original document is converted into the execution logic, that is, the format is changed. The original file can be obtained by running the execution logic. This method can not only hide and store the original document, but also change the format of the original document, making it completely impossible for ransomware, macro virus, etc. to destroy the document.

[0100] The other parts of this embodiment are the same as those of Embodiment 7, and thus will not be described in detail.

[0101] The present invention relates to object coding reorganization and file format conversion, and is a comprehensive application of coding and decoding encryption and decryption technology in the above-mentioned fields. In the process of implementing the present invention, the application of multiple coding and decoding modules will be involved. The applicant believes that after carefully reading the application documents and accurately understanding the implementation principle and purpose of the present invention, in combination with the existing known technology, those skilled in the art can fully use their software programming skills to implement the present invention. The aforementioned software function modules include but are not limited to object conversion to execution logic and generation of execution logic itself; all those mentioned in the application documents of the present invention belong to this category, and the applicant will not list them one by one.

[0102] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in any form. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention fall within the protection scope of the present invention.

Claims

1. A method for converting arbitrary bytes into execution logic, characterized in that: The following steps are involved: Step S1. The client (10) reads the input object in the form of a binary byte stream to obtain binary data; Step S2. The client (10) re-encodes the input object and stores it in the execution logic module (20); Step S3. The client (10) compiles and saves the execution logic, and generates the execution logic; Step S4. After running the execution logic, restore the original object; Step S5. Load the execution logic into the memory to view or directly release and run the original object; The step S4 comprises: The execution logic includes encoded data; The coded data is stored in a variable of the execution logic after being coded and reorganized, and the variable is read into the memory to obtain the coded and stored memory binary data; Decompress the binary memory slice read into the memory, and generate new binary memory data after decompression; Decrypt the binary memory chip. The decryption key is the first sixteen bits of the binary. After decryption, new binary memory data is generated. Perform XOR decoding on the decrypted binary memory data to generate new binary byte stream data; Reassemble the decoded binary byte stream data to generate a reassembled original object; Use corresponding tools to perform operations on the restored original object, or directly run the original object in binary mode, and the original object is directly executed through the operating system.

2. A method for converting arbitrary bytes into execution logic according to claim 1, characterized in that: The step S1 includes: the input object includes an object on a disk, and the binary data includes visible characters and invisible characters.

3. A method for converting arbitrary bytes into execution logic according to claim 1, characterized in that: The step S3 comprises: Read the binary data in the memory bit by bit, perform bitwise XOR encoding on the read binary data, rearrange the encoded binary data, and disrupt the original read binary data; Using the first sixteen bits of the encoded binary data as a secret key, encrypting the encoded binary data to generate new binary secret memory data; The new binary secret memory data is compressed to generate new memory slice data.

4. A method for converting arbitrary bytes into execution logic according to claim 1, characterized in that: The step S3 further comprises: Generate data logic, read memory data, and store it in internal variables of execution logic; Generate decompression logic, and store the generated corresponding decompression logic in the logic body of the execution logic; Generate decryption logic, and store the generated corresponding decryption logic in the logic body of the execution logic; Generate decoding logic, and store the generated corresponding decoding logic in the logic body of the execution logic; Generate reorganization logic, and store the generated data reorganization logic in a logic body of the execution logic; Generate execution logic, generate execution logic after data reorganization, and store it in the logic body of the execution logic; Save the execution logic, compile the generated execution logic source code, compile it into executable logic and save it for implementation. After saving and implementing, run the compiled execution logic.

5. A method for converting arbitrary bytes into execution logic according to claim 1, characterized in that: The execution logic after running the compilation includes: Run the execution logic and specify the input parameters. The input parameters are the execution logic of the original object. When the original object has no specified running logic, the original object will be handed over to the operating system for execution. After executing the logic to restore the original object, it is handed over to a third-party program for reading and running; No parameters are passed to the execution logic, and the restored original object will be directly handed over to the operating system for execution; The execution logic reads the internally encoded data variables and loads the variables into the memory in binary form; Execute logical decompression of memory data, perform memory decompression operation on the read binary memory data, and obtain new binary memory data; Execute the logic to decrypt the binary memory data. Use the first sixteen bits of the binary memory data as the secret key to decrypt the decompressed binary memory data. After decryption, obtain the new memory data. The execution logic performs XOR rearrangement on the binary memory data to obtain the original binary byte stream after rearrangement; Execute logic to reorganize the rearranged binary byte stream to obtain the source object; The execution logic passes the original object to a pre-specified program to open. If there is no pre-specified program, the source object will be handed over to the operating system for execution; The execution logic clears the memory and then exits, leaving the original object already loaded into memory and opened.

6. A system for converting arbitrary bytes into execution logic, based on the method according to any one of claims 1 to 5, characterized in that: The system comprises a client (10) and an execution logic module (20), wherein: The client (10) is used to read the input object in the form of a binary byte stream to obtain binary data; to re-encode the input object and store it in the execution logic module (20); to compile and save the execution logic, and to generate the execution logic; The execution logic module (20) is used to restore the original object after executing the execution logic; and is used to load the original object into the memory for viewing or directly release and run.

7. A system for converting arbitrary bytes into execution logic according to claim 6, characterized in that: The client (10) comprises a conversion module (11): A conversion module (11) is used to read binary data into a memory, encode, encrypt and compress the file, and generate a corresponding binary variable; Used to encode and reorganize binary data in memory; Used to generate execution logic, generate execution logic for decompression, decryption, decoding, reassembly and loading.

8. A system for converting arbitrary bytes into execution logic according to claim 6, characterized in that: The execution logic module (20) runs on an operating system (21).

Images