Code protection method, device, equipment and storage medium

Abstract

An embodiment of the present application discloses a code protection method, apparatus, device, and storage medium. The method includes: obtaining intermediate code of the code to be protected, and deteriorating the intermediate code to obtain target intermediate code; determining repeated instruction combinations from the target intermediate code; determining composite instructions corresponding to each repeated instruction combination, and generating composite intermediate code; generating dynamic instruction operation codes for each instruction in the composite intermediate code, and generating an instruction table according to each instruction, the dynamic instruction operation code corresponding to each instruction, and operands in the composite intermediate code, where the dynamic instruction operation codes corresponding to different instructions are different; generating bytecode corresponding to the composite intermediate code based on the instruction table and the composite intermediate code. By adopting the embodiment of the present invention, the code can be converted into bytecode, increasing code security.

Description

Technical Field

[0001] The present application relates to the field of computer software technology, and in particular to a code protection method, apparatus, device, and storage medium. Background Art

[0002] With the development of computer software technology, JavaScript, as a language that can be directly written in HTML files, has been widely used in web design. Since JavaScript code is usually saved in plain text, it can be easily misused by third parties in application scenarios that are not sufficiently secure, thereby stealing user data. Therefore, most websites and terminals will protect the original JavaScript code by encrypting the JavaScript code into ciphertext or performing code obfuscation. However, in the process of executing JavaScript code on a web page, there is still a process of restoring the ciphertext to the original JavaScript code, and the original JavaScript code can be directly obtained through snapshots or interception methods. And because the JavaScript code after code obfuscation still retains the format of JavaScript code, after formatting the obfuscated code, a certain degree of readability can be restored, and then the original JavaScript code can be cracked through static analysis. Existing technologies cannot effectively resist code cracking methods such as snapshot interception or static analysis. Summary of the Invention

[0003] The embodiments of the present application provide a code protection method, apparatus, device, and storage medium, which can convert code into bytecode to increase code security.

[0004] In a first aspect, an embodiment of the present application provides a code protection method, the method comprising:

[0005] Obtaining the intermediate code of the code to be protected, and degrading the intermediate code to obtain the target intermediate code;

[0006] Determine a repeated instruction combination from the target intermediate code, where the repeated instruction combination appears at least twice in the target intermediate code;

[0007] Determining the compound instructions corresponding to each repeated instruction combination in the target intermediate code, and generating a compound intermediate code based on the compound instructions corresponding to each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combination;

[0008] Generate a dynamic instruction operation code for each instruction in the composite intermediate code, and generate an instruction table based on each instruction in the composite intermediate code, the dynamic instruction operation code corresponding to each instruction, and the operand, wherein different instructions have different dynamic instruction operation codes corresponding to them;

[0009] The bytecode corresponding to the above-mentioned composite intermediate code is generated based on the above-mentioned instruction table and the above-mentioned composite intermediate code.

[0010] In combination with the first aspect, in a possible implementation manner, the above method further includes:

[0011] Obtaining virtual machine description information, and generating a virtual machine for running the bytecode according to the virtual machine description information and the instruction table;

[0012] The virtual machine description information includes the number of registers, register types, register usage, memory structure, runtime stack and exception stack, runtime environment interaction requirements, and instruction fetch-dispatch-execute loop table;

[0013] The delivery code is generated based on the bytecode and the virtual machine.

[0014] In conjunction with the first aspect, in one possible implementation, obtaining the intermediate code of the code to be protected includes:

[0015] Obtain the code to be protected and determine the abstract syntax tree corresponding to the code to be protected;

[0016] The intermediate code of the code to be protected is obtained based on the abstract syntax tree corresponding to the code to be protected.

[0017] In conjunction with the first aspect, in a possible implementation, determining the repeated instruction combination from the target intermediate code includes:

[0018] Determining, from the target intermediate code, an instruction combination and the number of occurrences of each instruction combination in the target intermediate code;

[0019] The above instruction combinations are sorted according to the number of times they appear, and the instruction combination with a number of times it appears greater than a threshold is determined as the repeated instruction combination.

[0020] In combination with the first aspect, in a possible implementation, a repeated instruction combination in the above-mentioned target intermediate code corresponds to multiple compound instructions, wherein the number of compound instructions corresponding to any repeated instruction combination does not exceed the number of occurrences of any repeated instruction combination in the above-mentioned target intermediate code.

[0021] In conjunction with the first aspect, in one possible implementation, generating the composite intermediate code based on the composite instructions corresponding to the repeated instruction combinations and other instructions in the target intermediate code except for the repeated instruction combinations includes:

[0022] Determine the combination order of each repeated instruction combination and other instructions in the above target intermediate code except the repeated instruction combination according to the order in which each instruction appears in the above target intermediate code;

[0023] Replace each repeated instruction combination in the above target intermediate code with the corresponding composite instruction of each repeated instruction combination, and combine the composite instructions corresponding to each repeated instruction combination and other instructions in the above target intermediate code except the repeated instruction combination according to the above combination order to generate a composite intermediate code.

[0024] Combined with the first aspect, in a possible implementation manner, the above replacing each repeated instruction combination in the above target intermediate code with the corresponding composite instruction of each repeated instruction combination includes:

[0025] Replace all repeated instruction combinations in the above target intermediate code with the corresponding composite instructions of each repeated instruction combination; or

[0026] Replace some repeated instruction combinations in the above target intermediate code with the corresponding composite instructions of each repeated instruction combination.

[0027] Combined with the first aspect, in a possible implementation manner, the above deteriorating the above intermediate code includes:

[0028] Insert instructions with no actual use in the above intermediate code; or

[0029] Convert integer or string constants in the above intermediate code into multiple arithmetic instructions; or

[0030] Insert incomplete instructions at unreachable target addresses in the above intermediate code; or

[0031] Perform a side-effect-free sequential exchange of instructions in the above intermediate code.

[0032] In a second aspect, an embodiment of the present application provides a code protection device, and the device includes:

[0033] A code acquisition module, configured to acquire the intermediate code of the code to be protected and deteriorate the above intermediate code to obtain a target intermediate code;

[0034] A repeated instruction determination module, configured to determine repeated instruction combinations from the above target intermediate code, and the repeated instruction combinations appear at least twice in the above target intermediate code;

[0035] A composite code generation module, configured to determine the composite instructions corresponding to each repeated instruction combination in the above target intermediate code, and generate a composite intermediate code according to the composite instructions corresponding to each repeated instruction combination and other instructions in the above target intermediate code except the repeated instruction combination;

[0036] An instruction list generation module, configured to generate dynamic instruction operation codes for each instruction in the above-mentioned composite intermediate code, and generate an instruction list based on each instruction, the corresponding dynamic instruction operation code and operands in the above-mentioned composite intermediate code, wherein the dynamic instruction operation codes corresponding to different instructions are different;

[0037] A bytecode generation module, configured to generate bytecodes corresponding to the above-mentioned composite intermediate code based on the above-mentioned instruction list and the above-mentioned composite intermediate code.

[0038] Combined with the second aspect, in a possible implementation manner, the above-mentioned apparatus further includes:

[0039] A virtual machine generation module, configured to obtain virtual machine description information, and generate a virtual machine for running the above-mentioned bytecodes according to the above-mentioned virtual machine description information and the above-mentioned instruction list;

[0040] Wherein, the above-mentioned virtual machine description information includes the number of registers, register types, register uses, memory structure, execution stack and exception stack, interaction requirements of the execution environment, and instruction fetch-dispatch-execution loop table;

[0041] A delivery code generation module, configured to generate delivery code based on the above-mentioned bytecodes and the above-mentioned virtual machine.

[0042] Combined with the second aspect, in a possible implementation manner, the above-mentioned code acquisition module further includes:

[0043] A code compilation unit, configured to obtain the code to be protected, determine the abstract syntax tree corresponding to the above-mentioned code to be protected, and compile the intermediate code of the above-mentioned code to be protected based on the abstract syntax tree corresponding to the above-mentioned code to be protected.

[0044] Combined with the second aspect, in a possible implementation manner, the above-mentioned repeated instruction determination module includes:

[0045] A repeated instruction screening unit, configured to determine instruction combinations and the occurrence times of each instruction combination in the above-mentioned target intermediate code from the above-mentioned target intermediate code, sort the above-mentioned instruction combinations according to the occurrence times of each instruction combination, and determine the instruction combinations with the occurrence times greater than the threshold as the above-mentioned repeated instruction combinations.

[0046] Combined with the second aspect, in a possible implementation manner, one repeated instruction combination in the above-mentioned target intermediate code corresponds to multiple composite instructions, wherein the number of composite instructions corresponding to any repeated instruction combination does not exceed the occurrence times of any repeated instruction combination in the above-mentioned target intermediate code.

[0047] Combined with the second aspect, in a possible implementation manner, the above-mentioned composite code generation module includes:

[0048] An instruction sequence determination unit, configured to determine the combination order of each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combination according to the order in which each instruction appears in the target intermediate code as described above.

[0049] An instruction combination unit, configured to replace each repeated instruction combination in the target intermediate code with a composite instruction corresponding to each repeated instruction combination, and combine the composite instructions corresponding to each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combination according to the above combination order to generate a composite intermediate code.

[0050] Combined with the second aspect, in a possible implementation manner, the above instruction combination unit includes:

[0051] A composite instruction replacement unit, configured to replace all repeated instruction combinations in the target intermediate code with composite instructions corresponding to each repeated instruction combination; or replace some repeated instruction combinations in the target intermediate code with composite instructions corresponding to each repeated instruction combination.

[0052] Combined with the second aspect, in a possible implementation manner, the above code acquisition module includes:

[0053] A code degradation unit, configured to insert instructions with no actual use in the intermediate code; or convert integer or string constants in the intermediate code into multiple arithmetic instructions; or insert incomplete instructions at unreachable target addresses in the intermediate code; or perform a side-effect-free order exchange on the instructions in the intermediate code.

[0054] In a third aspect, an embodiment of the present application provides a terminal device, which includes a processor and a memory, and the processor and the memory are connected to each other. The memory is used to store a computer program that supports the terminal to execute the method provided in the first aspect and / or any possible implementation manner of the first aspect. The computer program includes program instructions, and the processor is configured to call the above program instructions to execute the method provided in the first aspect and / or any possible implementation manner of the first aspect.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method provided in the first aspect and / or any possible implementation manner of the first aspect.

[0056] In the embodiments of the present application, by compiling the code to be protected into equivalent intermediate code and deteriorating it, target intermediate code is obtained, and duplicate instruction combinations in the target intermediate code are replaced with composite instructions to obtain composite intermediate code. Dynamic instruction operation codes are generated for the instructions in the composite intermediate code and stored in an instruction table, so that bytecode corresponding to the composite intermediate code can be generated. It can be understood that compiling the code to be protected into equivalent intermediate code and deteriorating it can obscure the correlation between the target intermediate code and the code to be protected, and improve the code protection strength. Further, replacing duplicate instruction combinations in the target intermediate code with composite instructions to obtain composite intermediate code can further obscure the correlation between the composite intermediate code and the code to be protected, and improve the code protection strength. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in an instruction table, so that bytecode corresponding to the composite intermediate code can be generated, can convert the code to be protected into bytecode, and further obscure the correlation between the bytecode and the code to be protected, and improve the code protection strength. By using a virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode together, the applicability of the bytecode can be improved. It can be seen from this that by adopting the embodiments of the present invention, the code can be converted into bytecode to increase code security; in addition, by using a virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode together, the applicability of the bytecode can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0058] Figure 1 is a schematic diagram of the network architecture provided by the embodiments of the present application;

[0059] Figure 2 is a flowchart of a code protection method provided by the embodiments of the present application;

[0060] Figure 3 is a schematic diagram of a scenario for triggering a code protection request provided by the embodiments of the present application;

[0061] Figure 4 is a schematic diagram of the structure of an abstract syntax tree provided by the embodiments of the present application;

[0062] Figure 5 is a flowchart of a process for generating delivery code provided by the embodiments of the present application;

[0063] Figure 6 is another flowchart of a code protection method provided by the embodiments of the present application;

[0064] Figure 7 It is a schematic flowchart of running bytecode on a virtual machine provided by an embodiment of the present application;

[0065] Figure 8 It is a schematic structural diagram of a code protection device provided by an embodiment of the present application;

[0066] Figure 9 It is a schematic diagram of a computer device provided by an embodiment of the present application. Detailed implementation manners

[0067] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0068] Please refer to Figure 1 , which is a schematic structural diagram of a network architecture provided by an embodiment of the present invention. As Figure 1 shown, the network architecture may include a cloud server 2000 and a user terminal cluster; the user terminal cluster may include multiple user terminals, such as Figure 1 shown, specifically including user terminals 3000a, user terminals 3000b,..., user terminals 3000n; as Figure 1 shown, user terminals 3000a, user terminals 3000b,..., user terminals 3000n can each establish a data connection relationship with the cloud server 2000 under certain data interaction conditions, so as to be able to perform data interaction with the cloud server 2000.

[0069] For ease of understanding, an embodiment of the present application may select one user terminal as the target user terminal among the Figure 1 shown multiple user terminals. The target user terminal may include: smart terminals such as smart phones, tablet computers, and desktop computers that require code protection functions (for example, electronic payment functions, investment management functions). For example, an embodiment of the present application may use Figure 1The user terminal 3000a shown above serves as the aforementioned target user terminal, and a target application with the code protection function can be integrated into this target user terminal. It should be understood that the target applications integrated in this target user terminal can be collectively referred to as application clients. Among them, the aforementioned target applications can include social applications (such as user authentication applications), life applications (such as electronic payment applications), financial applications (such as investment management applications), etc., which have code protection functions. The code to be protected applied in this target user terminal can include the code to be protected applied in this target user terminal and the intermediate code obtained by compiling the code to be protected.

[0070] It can be understood that the solution of converting the code to be protected into bytecode by the code protection method described in the embodiments of this application can be applied to all application scenarios where code is protected in a web page or an application client (i.e., the aforementioned target application). Among them, when the target application with the code protection function runs in this target user terminal, the code run by this target user terminal can include the code to be protected pre-built in this target application, and can also include the code to be protected currently downloaded from the server 2000 through the network.

[0071] It should be understood that the embodiments of this application can collectively refer to the code to be protected pre-built in this target application and the currently downloaded code to be protected as the code to be protected. Thus, it can be seen that the embodiments of this application can perform protection processing on the code to be protected during the running of a web page or a target application to obtain the aforementioned bytecode, so that when running the bytecode in a web page or an application client, the security of the code can be improved, and the memory occupation of the system by code protection operations can be reduced.

[0072] Optionally, the embodiments of this application can also, before the target user terminal runs the target application, pre-process in this target user terminal the code obtained from the above Figure 1Byteize the code to be protected obtained from the server 2000 shown above to obtain the foregoing bytecode. Thus, when the target application is running on the target user terminal, the bytecode can be directly run to reduce system performance loss during the running of the target application (for example, reduce the memory occupation of the code protection operation on the system memory in the target user terminal). Optionally, before the target application runs on the target user terminal in the embodiment of the present application, the code to be protected can also be byteized in the server 2000 in advance to obtain the bytecode. Thus, when the target application runs on the target user terminal, a data download instruction (i.e., a data loading instruction) can be sent to the server 2000 through the network, so that the server can determine whether the target user terminal meets the byteization condition based on the terminal identifier carried in the download instruction. If the server 2000 determines that the target user terminal meets the byteization condition, that is, the server 2000 determines that the type of the terminal identifier of the target user terminal belongs to the identifier type of a low-end machine, the bytecode stored after the pre-byteization process can be returned to the target user terminal for running in the server 2000. Thus, when the target application runs on the target user terminal, the system performance loss can be reduced, and the security of the code to be protected can be improved. It can be seen that in the embodiment of the present application, the code to be protected can also be byteized in the target user terminal or the server 2000 before running the target application to obtain the bytecode.

[0073] Optionally, before the target application runs on the target user terminal in the embodiment of the present application, the code to be protected obtained from the server 2000 shown above can also be processed in the target user terminal in advance Figure 1 to obtain the foregoing bytecode. In other words, the read code to be protected can also be directly processed into bytecode by the server 2000 and then obtained by the target user terminal for subsequent processing. For example, taking the above target application as a life application (electronic bus code) as an example, the target user terminal can load and run the bytecode through the life application to obtain an electronic bus code containing a user verification signature, and use the user verification signature for identity verification.

[0074] The code to be protected described in the embodiments of this application may include code applied to interfaces, code applied to protocols, and so on. In other words, the code to be protected may include code for generating verification signatures when pulling data, code for describing private protocols during data communication, or code for describing transaction logic during online transactions. For example, taking the above target application as a life application, before taking the subway, a boarding code for the user to take the subway needs to be generated through the target application. The target user terminal can capture the user's behavior information through this life application and generate a display request for the boarding code. Specifically, it includes running signature generation code according to the user's identity information to generate a user signature, and then the user signature can be written into the boarding code for subsequent user authentication. Among them, the process of running the signature generation code requires code protection.

[0075] Please refer to Figure 2 , Figure 2 which is a schematic flowchart of the code protection method provided by the embodiments of this application. As Figure 2 shown, the code protection method includes:

[0076] S101: Obtain the intermediate code of the code to be protected, and deteriorate the above intermediate code to obtain the target intermediate code.

[0077] In some feasible embodiments, the code to be protected may include Java code, JavaScript code, C / C++ code and other codes. Among them, due to the flexibility of Java and JavaScript languages, the code written in Java or JavaScript languages is more likely to be stolen than the code written in C or C++ languages. In this application, for the convenience of description, the process of code protection for JavaScript code will be taken as an example for illustration. In the early stage of the development of the front-end system, the responsibilities of JavaScript code in the front-end system were not many. It was just used to simply submit forms. The JavaScript code was very simple and did not require any protection. However, with the development of the front-end system, the functions of JavaScript code began to become complex, and the file size of JavaScript code became larger and larger. In order to reduce the file size of JavaScript code and accelerate the transmission speed of front-end data, many tools for compressing JavaScript code began to appear, such as uglify, compressor, clouser, etc. The main working methods of these compression tools are to merge multiple JavaScript code files, remove whitespace characters and line breaks in the JavaScript code, compress variable names in the JavaScript code, and delete comments in the JavaScript code. Although the original purpose of these compression tools was to reduce the file size of JavaScript code, it was found that the readability of the compressed and replaced JavaScript code was much worse than that of the original JavaScript code. That is to say, compressing JavaScript code indirectly played a role in code protection, so compressing the JavaScript code file became a means of early code protection. However, with the development of technology, mainstream browsers such as Chrome and Firefox began to provide the function of formatting JavaScript code, which can restore the readability of JavaScript code to a certain extent. In addition, with the improvement of browser performance and network speed, many back-end logics began to be transferred to the front-end for operation. For example, in many login, registration, payment, transaction and other pages, key data interaction tasks began to rely on JavaScript code. Such JavaScript code does not want to be easily cracked, so protecting JavaScript code has become increasingly important. Please refer to Figure 3 , Figure 3 which is a schematic diagram of a scenario for triggering a code protection request provided by an embodiment of this application. As Figure 3 shown, this scenario is based on Figure 1Taking the terminal 3000a in the corresponding embodiment as an example, based on the terminal, applications such as application A, application B, and application C can be displayed to the user. At this time, the user can access any of the applications A, B, and C by clicking on them. Thus, during the process of accessing any of the applications A, B, and C, an operation that requires code protection in any of the applications A, B, and C is triggered. Optionally, during the process where the user triggers an operation to execute any piece of code in any of the applications A, B, and C, the specified code in any of the applications A, B, and C that the user attempts to execute can be used as the code to be protected, thereby performing the code protection operation. Among them, when the user triggers an operation that requires code protection in application A by clicking, taking application A as the first application and a life application as an example, a boarding code for the user to take the subway needs to be generated through the target application before taking the subway. The target user terminal can capture the user's behavior information through this application A and generate a display request for the boarding code. Specifically, it includes generating a user signature by running a signature generation code according to the user's identity information, and then the user signature can be written into the boarding code for subsequent user authentication. Among them, the process of running the signature generation code requires code protection.

[0078] In some feasible embodiments, JavaScript code protection mainly includes encrypting or obfuscating the JavaScript code. The process of code encryption is to pre-encrypt the JavaScript code to be protected using an encryption algorithm, and at the same time deliver the ciphertext and the decryption program to the target user terminal. When the target application starts on the target user terminal, it first restores the ciphertext to the original code through the decryption program, and then passes the original code to the JavaScript interpreter for execution. However, since there is still a process of decrypting and restoring the ciphertext to the original JavaScript code when the target application starts on the target user terminal, third parties can still directly obtain the original JavaScript code by taking a memory snapshot of the target application or intercepting the entry of the JavaScript interpreter. Code obfuscation is to convert the JavaScript code into a form that is functionally equivalent but difficult to read and understand. Code obfuscation can be used for the source code of the program or the intermediate code compiled from the program. The program that performs code obfuscation is called a code obfuscator, and there are currently many code obfuscators with different functions. Code obfuscation includes: changing the names of various elements in the code, such as variables, functions, and class names, into meaningless names, such as changing them into single letters, or short combinations of meaningless letters, or changing them into symbols, so that readers cannot guess their uses based on the names. Rewriting part of the logic in the code into a form that is functionally equivalent but more difficult to understand, such as changing a for loop into a while loop, changing a loop into a recursion, streamlining intermediate variables, and so on. Disrupting the format of the code, such as deleting spaces, squeezing multiple lines of code into one line, or breaking one line of code into multiple lines, etc. However, since the obfuscated code is still JavaScript code, after formatting, a certain degree of readability can be restored, and it is easy to use strings and integer constants as breakthroughs for static analysis, and the strength is not high. Therefore, simply using code encryption or code obfuscation means cannot effectively protect JavaScript code.

[0079] In some feasible implementations, obtaining the intermediate code of the code to be protected includes: obtaining the code to be protected, and determining the abstract syntax tree corresponding to the above code to be protected. The intermediate code of the above code to be protected is compiled based on the abstract syntax tree corresponding to the above code to be protected. Abstract syntax tree, referred to as syntax tree, is an abstract representation of the syntax structure of the source code. It represents the syntax structure of the programming language in the form of a tree, and each node on the tree represents a structure in the source code. The reason why the syntax is "abstract" is that the syntax here does not represent every detail that appears in the real syntax. For example, nested brackets are implied in the structure of the tree and are not presented in the form of nodes; and conditional jump statements such as if-condition-then can be represented by nodes with two branches. Please refer to the details. Figure 4 , Figure 4 This is a schematic diagram of the structure of the abstract syntax tree provided by an embodiment of the present application. 10a is the original JavaScript code, and 10b is the representation of the original JavaScript code using the abstract syntax tree. For example, lexical analysis of the instruction "var a = 42;" in the original JavaScript code yields: Keyword (var), Identifier (a), Punctuator (=), Numeric (42), Punctuator (;). The "=" and ";" in the original code instruction are then removed, leaving only the var variable definition, and the variable name "a" and the variable value "42" are then connected.

[0080] In some feasible implementations, after obtaining the intermediate code of the code to be protected, the intermediate code can be further degraded, including: inserting instructions with no practical use into the intermediate code; converting integer or string constants in the intermediate code into multiple arithmetic instructions; inserting incomplete instructions at unreachable target addresses in the intermediate code; or swapping the order of instructions in the intermediate code without side effects. For example, after executing instruction 5, the code needs to jump to instruction 10 to continue execution, and the intermediate instructions 6-9 are not needed. In this case, an incomplete instruction can be inserted between the target addresses of instructions 6-9. Alternatively, for example, the integer 42 can be rewritten as an arithmetic instruction of the form "e=11+17+14." Alternatively, for example, the order of the instructions "var a=42;" and "var b=5;" can be swapped. After degrading the intermediate code, the target intermediate code can be obtained.

[0081] S102: Determine a repeated instruction combination from the target intermediate code.

[0082] In some feasible embodiments, after obtaining the above-mentioned target intermediate code, there are often some repeated instruction combinations in the target intermediate code. For example, after compiling JavaScript code in an abstract syntax tree, there will be some instructions that assign values to the same variable and perform the same calculation steps, and these instructions belong to repeated instruction combinations. In order to further increase the difficulty of code restoration, we can determine the repeated instruction combinations in the target intermediate code and the positions of each repeated instruction combination in the target intermediate code.

[0083] In some feasible embodiments, instruction combinations and the occurrence times of each instruction combination in the above-mentioned target intermediate code can be determined from the above-mentioned target intermediate code. Sort the above-mentioned instruction combinations according to the occurrence times of the above-mentioned instruction combinations, and determine the instruction combinations with the occurrence times greater than or equal to the threshold as the above-mentioned repeated instruction combinations. For example, for the target intermediate code with the instruction sequence "ABACDABCDEAB", the instruction combination "AB" appears 3 times, and the instruction combination "CD" appears 2 times. Among them, in order to further increase the difficulty of code restoration, the corresponding threshold is variable each time the repeated instructions in the target intermediate code are determined. For example, when the threshold is 2, the repeated instruction combinations are "AB" and "CD"; when the threshold is 3, the repeated instruction combination is "AB".

[0084] S103: Determine the composite instructions corresponding to each repeated instruction combination in the above-mentioned target intermediate code, and generate composite intermediate code according to the composite instructions corresponding to each repeated instruction combination and the other instructions in the above-mentioned target intermediate code except the repeated instruction combinations.

[0085] In some feasible embodiments, a repeated instruction combination in the above-mentioned target intermediate code corresponds to multiple composite instructions, where the number of composite instructions corresponding to any repeated instruction combination does not exceed the occurrence times of any repeated instruction combination in the above-mentioned target intermediate code. For example, for the target intermediate code with the instruction sequence "ABACDABCDEAB", the instruction combination "AB" appears 3 times, and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and it can be specified that the composite instruction corresponding to the repeated instruction combination "AB" is "X", and the composite instruction corresponding to the repeated instruction combination "CD" is "Y". In order to further increase the difficulty of code restoration, it can be specified that the composite instructions corresponding to the repeated instruction combination "AB" are "X1", "X2" and "X3", and the composite instructions corresponding to the repeated instruction combination "CD" are "Y1" and "Y2".

[0086] In some feasible embodiments, generating the composite intermediate code based on the composite instructions corresponding to the respective repeated instruction combinations and other instructions in the target intermediate code except the repeated instruction combinations includes: determining the combination order of each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combinations according to the order in which the instructions appear in the target intermediate code. Replace each repeated instruction combination in the target intermediate code with the composite instruction corresponding to the repeated instruction combination, and combine the composite instructions corresponding to the respective repeated instruction combinations and other instructions in the target intermediate code except the repeated instruction combinations according to the combination order to generate the composite intermediate code. For example, for the target intermediate code with the instruction order of "ABACDABCDEAB", where the instruction combination "AB" appears 3 times and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and the composite instruction corresponding to the repeated instruction combination "AB" can be specified as "X", and the composite instruction corresponding to the repeated instruction combination "CD" can be specified as "Y". The repeated instruction combination "AB" in the target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to the repeated instruction combination, and the repeated instruction combination "CD" can be replaced with the composite instruction "Y" corresponding to the repeated instruction combination, and the composite instructions corresponding to the respective repeated instruction combinations and other instructions in the target intermediate code except the repeated instruction combinations are combined according to the combination order to generate the composite intermediate code "XAYXYEX".

[0087] In some feasible embodiments, replacing each repeated instruction combination in the target intermediate code with the composite instruction corresponding to the repeated instruction combination includes: replacing all the repeated instruction combinations in the target intermediate code with the composite instructions corresponding to the repeated instruction combinations. Or replacing some of the repeated instruction combinations in the target intermediate code with the composite instructions corresponding to the repeated instruction combinations. For example, in order to further increase the difficulty of code restoration, all / some of the repeated instruction combinations "AB" in the target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to the repeated instruction combination, and all / some of the repeated instruction combinations "CD" can be replaced with the composite instruction "Y" corresponding to the repeated instruction combination, and according to the combination order, the composite instructions corresponding to the respective repeated instruction combinations and other instructions in the target intermediate code except the repeated instruction combinations are combined to generate the composite intermediate code "XAYABYEX".

[0088] Furthermore, in some feasible embodiments, all or part of the repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" can be replaced with the corresponding composite instructions "X1", "X2", or "X3" of this repeated instruction combination, and all or part of the repeated instruction combination "CD" can be replaced with the corresponding composite instructions "Y1" or "Y2" of this repeated instruction combination. Then, the composite instructions corresponding to each of the above repeated instruction combinations are combined with the other instructions in the above target intermediate code except the repeated instruction combinations according to the above combination order to generate the composite intermediate code "X2AY1ABY2EX1".

[0089] S104: Generate the dynamic instruction operation codes of each instruction in the above composite intermediate code, and generate an instruction table according to each instruction, the dynamic instruction operation code corresponding to each instruction, and the operands in the above composite intermediate code.

[0090] In some feasible embodiments, for example, all or part of the repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" is replaced with the corresponding composite instructions "X1", "X2", or "X3" of this repeated instruction combination, and all or part of the repeated instruction combination "CD" is replaced with the corresponding composite instructions "Y1" or "Y2" of this repeated instruction combination. Then, the composite instructions corresponding to each of the above repeated instruction combinations are combined with the other instructions in the above target intermediate code except the repeated instruction combinations according to the above combination order to generate the composite intermediate code "X2AY1ABY2EX1". The obtained composite intermediate code includes the instructions "X2", "A", "Y1", "B", "Y2", "E", and "X1". To further increase the difficulty of code restoration, when compiling the composite intermediate code each time, the dynamic instruction operation codes of "X2", "A", "Y1", "A", "B", "Y2", "E", and "X1" can be generated respectively. For example, the dynamic instruction operation code of "X2" is generated as "0010", the dynamic instruction operation code of "A" is generated as "0101", the dynamic instruction operation code of "Y1" is generated as "0100", the dynamic instruction operation code of "B" is generated as "1010", the dynamic instruction operation code of "Y2" is generated as "0110", the dynamic instruction operation code of "E" is generated as "0111", and the dynamic instruction operation code of "X1" is generated as "1100".

[0091] Furthermore, an instruction table is generated according to each instruction, the dynamic instruction operation code corresponding to each instruction, and the operands in the above composite intermediate code as shown in Table 1. Table 1 is the instruction table generated according to the composite intermediate code.

[0092] Table 1

[0093]

[0094]

[0095] S105: Generate bytecode corresponding to the composite intermediate code based on the above instruction table and the above composite intermediate code.

[0096] In some feasible embodiments, for example, generate composite intermediate code "X2AY1ABY2EX1" according to target intermediate code "ABACDABCDEAB". And the dynamic instruction opcode of "X2" in the instruction table generated according to the composite intermediate code is "0010", the operand is "00110101", the dynamic instruction opcode of "A" is "0101", the operand is "00100100", the dynamic instruction opcode of "Y1" is "0100", the operand is "10110011", the dynamic instruction opcode of "B" is "1010", the operand is "11001010", the dynamic instruction opcode of "Y2" is "0110", the operand is "01010101", the dynamic instruction opcode of "E" is "0111", the operand is "11001100", and the dynamic instruction opcode of "X1" is "1100", the operand is "01001101". Generate bytecode corresponding to the composite intermediate code based on the above instruction table and the above composite intermediate code: "0010 00110101 0101 00100100 0100 10110011 010100100100 1010 11001010 011001010101 0111 11001100 1100 01001101".

[0097] In some feasible embodiments, please refer to Figure 5 , Figure 5 which is a schematic flowchart of a process for generating delivery code provided by an embodiment of the present application. As Figure 5 shown, after generating the bytecode, virtual machine description information can be obtained, and a virtual machine for running the bytecode can be generated according to the above virtual machine description information and the above instruction table. And package the above bytecode and the above virtual machine to generate delivery code. Among them, the above virtual machine description information includes the number of registers, register types, register uses, memory structure, run stack and exception stack, interaction requirements of the running environment, and fetch-dispatch-execute loop table.

[0098] In the embodiments of the present application, by compiling the code to be protected into equivalent intermediate code and degrading it, target intermediate code is obtained, and duplicate instruction combinations in the target intermediate code are replaced with composite instructions to obtain composite intermediate code. Dynamic instruction operation codes are generated for the instructions in the composite intermediate code and stored in an instruction table, so that bytecode corresponding to the composite intermediate code can be generated. It can be understood that compiling the code to be protected into equivalent intermediate code and degrading it can obscure the correlation between the target intermediate code and the code to be protected, and improve the code protection strength. Further, replacing duplicate instruction combinations in the target intermediate code with composite instructions to obtain composite intermediate code can further obscure the correlation between the composite intermediate code and the code to be protected, and improve the code protection strength. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in an instruction table, so that bytecode corresponding to the composite intermediate code can be generated, can convert the code to be protected into bytecode, and further obscure the correlation between the bytecode and the code to be protected, and improve the code protection strength. Running the bytecode using a virtual machine and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode. It can be seen that by adopting the embodiments of the present invention, the code can be converted into bytecode to increase code security; in addition, running the bytecode using a virtual machine and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode.

[0099] Further, please refer to Figure 6 , Figure 6 which is another schematic flowchart of the code protection method provided by the embodiments of the present application. As Figure 6 shown, the execution subject is the target user terminal, and the above method may include the following steps:

[0100] S301: Obtain a message notification from the driver layer.

[0101] For ease of understanding, the target user terminal implementing this embodiment may include: smart phones, tablet computers, desktop computers, and other intelligent terminals that require code protection functions (for example, electronic payment functions, investment management functions). The target user terminal may be integrated with a target application having this code protection function. It should be understood that the target applications integrated in the target user terminal may be collectively referred to as application clients. Among them, the above target applications may include social applications (for example, user authentication applications), life applications (for example, electronic payment applications), financial applications (for example, investment management applications), and other applications having code protection functions. The code to be protected applied in the target user terminal may include the code to be protected applied in the target user terminal and the intermediate code obtained by compiling the code to be protected.

[0102] It can be understood that the solution of converting the code to be protected into bytecode by the code protection method described in the embodiments of the present application can be applied to all application scenarios for protecting code in a web page or an application client (i.e., the aforementioned target application). Among them, when the target application with the code protection function runs on the target user terminal, the code running on the target user terminal can include the code to be protected pre-built in the target application, and can also include the code to be protected currently downloaded from the server 2000 through the network.

[0103] It should be understood that the embodiments of the present application can collectively refer to the code to be protected pre-built in the target application and the currently downloaded code to be protected as the code to be protected. Thus, it can be seen that the embodiments of the present application can perform protection processing on the code to be protected during the running of the web page or the target application to obtain the aforementioned bytecode, so as to improve the security of the code and reduce the memory occupation of the system by the code protection operation when the bytecode is run in the web page or the application client.

[0104] Among them, the driver layer in the target user terminal is generally composed of a hardware abstraction layer (HAL), a board support package (BSP), and a driver program, and is an important and indispensable part of an embedded system. Its role is to provide an operation interface for external devices to the upper-layer program and implement the driver program of the device. The upper-layer program can ignore the internal implementation of the device being operated and only needs to call the interface of the driver.

[0105] After the code protection request verification program obtains the message notification sent by the driver layer, it needs to perform steps such as S302 - S303 to verify the validity of the message. If the verification is successful, step S304 is executed; otherwise, it returns to step S301 and is in a suspended state.

[0106] S302: Parse the application information of the target application from the message notification, and parse the code to be protected and the verification information corresponding to the code protection event of the target application from the command-line parameters in the application information of the target application.

[0107] S303: Parse the application information of the target application from the message notification, and parse the code to be protected and the verification information corresponding to the code protection event of the target application from the command-line parameters in the application information of the target application.

[0108] Optionally, before the target user terminal runs the target application, embodiments of the present application can also bytecode-process the code to be protected obtained from the server in advance in the target user terminal to obtain the foregoing bytecode. Thus, when the target application runs on the target user terminal, the bytecode can be directly run to reduce system performance loss during the running of the target application (for example, reduce the memory occupation of the code protection operation on the system memory in the target user terminal). Optionally, before the target user terminal runs the target application, embodiments of the present application can also bytecode-process the code to be protected in the server in advance to obtain bytecode. Thus, when the target application runs on the target user terminal, a data download instruction (i.e., a data loading instruction) can be sent to the server through the network, so that the server can determine whether the target user terminal meets the bytecode condition based on the terminal identifier carried in the download instruction. If the server determines that the target user terminal meets the bytecode condition, that is, the server determines that the type of the terminal identifier of the target user terminal belongs to the identifier type of a low-end machine, the bytecode stored after pre-bytecode processing can be returned to the target user terminal in the server for running. Thus, when the target application runs on the target user terminal, system performance loss can be reduced and the security of the code to be protected can be improved. It can be seen that embodiments of the present application can also bytecode-process the code to be protected in the target user terminal or the server before running the target application to obtain bytecode.

[0109] Optionally, before the target user terminal runs the target application, embodiments of the present application can also process the code to be protected obtained from the server in advance in the target user terminal to obtain the foregoing bytecode. In other words, the read code to be protected can also be directly processed into bytecode by the server and then obtained by the target user terminal for subsequent processing. For example, taking the above target application as a life application (electronic bus card) as an example, the target user terminal can load and run the bytecode through the life application to obtain an electronic bus card containing a user verification signature and use the user verification signature for identity verification.

[0110] The code to be protected described in the embodiments of this application may include code applied to interfaces, code applied to protocols, and so on. In other words, the code to be protected may include code for generating verification signatures when pulling data, code for describing private protocols during data communication, or code for describing transaction logics during online transactions. For example, taking the above target application as a life application, before taking the subway, a boarding code for the user to take the subway needs to be generated through the target application. The target user terminal can capture the user's behavior information through this life application and generate a display request for the boarding code. Specifically, it includes running signature generation code according to the user's identity information to generate a user signature, and then the user signature can be written into the boarding code for subsequent user authentication. Among them, the process of running the signature generation code requires code protection.

[0111] In some feasible implementation manners, the driver layer obtains the application information of the target application. Among them, the application information includes command line parameters, and the command line parameters carry the code to be protected and verification information corresponding to the code protection event of the target application. The application information of the target application is sent up to the code protection request verification program through the policy engine, and a message notification is sent to the code protection verification program.

[0112] S304: If the verification of the target application information is successful, the code to be protected is sent to the code protection handler.

[0113] In this application, for the sake of convenience in description, the process of code protection for JavaScript code will be taken as an example for illustration. In the early stage of the development of the front-end system, the responsibilities of JavaScript code in the front-end system were not many. It was just used to simply submit forms, and the JavaScript code was very simple and did not require any protection. However, with the development of the front-end system, the functions of JavaScript code began to become complex, and the file size of JavaScript code became larger and larger. In order to reduce the file size of JavaScript code and accelerate the transmission speed of front-end data, many tools for compressing JavaScript code began to appear, such as uglify, compressor, clouser, etc. The main working methods of these compression tools are to merge multiple JavaScript code files, remove whitespace characters and line breaks in the JavaScript code, compress variable names in the JavaScript code, and delete comments in the JavaScript code. Although the original purpose of these compression tools was to reduce the file size of JavaScript code, people found that the readability of the compressed and replaced JavaScript code was much worse than that of the original JavaScript code. That is to say, compressing JavaScript code indirectly played a role in code protection, so compressing the JavaScript code file became a means of early code protection. However, with the development of technology, mainstream browsers such as Chrome and Firefox began to provide the function of formatting JavaScript code, which could restore the readability of JavaScript code to a certain extent. In addition, with the improvement of browser performance and network speed, many back-end logics began to be transferred to the front-end for execution. For example, in many login, registration, payment, transaction, etc. pages, key data interaction tasks began to rely on JavaScript code to execute. Such JavaScript code did not want to be easily cracked, so protecting JavaScript code became increasingly important.

[0114] In some feasible embodiments, JavaScript code protection mainly includes encrypting or obfuscating the JavaScript code. The process of code encryption is to pre-encrypt the JavaScript code to be protected using an encryption algorithm, and at the same time deliver the ciphertext and the decryption program to the target user terminal. When the target application starts on the target user terminal, it first restores the ciphertext to the original code through the decryption program, and then passes the original code to the JavaScript interpreter for execution. However, since there is still a process of decrypting and restoring the ciphertext to the original JavaScript code when the target application starts on the target user terminal, third parties can still directly obtain the original JavaScript code by taking a memory snapshot of the target application or intercepting the entry of the JavaScript interpreter. Code obfuscation is to convert the JavaScript code into a form that is functionally equivalent but difficult to read and understand. Code obfuscation can be used for the source code of a program or the intermediate code compiled from the program. The program that performs code obfuscation is called a code obfuscator, and there are currently many types of code obfuscators with different functions. Code obfuscation includes: changing the names of various elements in the code, such as variables, functions, and class names, into meaningless names, such as single letters, short combinations of meaningless letters, or symbols, so that readers cannot guess their uses based on the names. Rewriting part of the logic in the code into a form that is functionally equivalent but more difficult to understand, such as changing a for loop into a while loop, changing a loop into a recursion, streamlining intermediate variables, etc. Disrupting the format of the code, such as deleting spaces, squeezing multiple lines of code into one line, or breaking one line of code into multiple lines, etc. However, since the obfuscated code is still JavaScript code, after formatting, it can restore a certain readability and is easy to perform static analysis with string and integer constants as breakthroughs, and the strength is not high. Therefore, simply using code encryption or code obfuscation means cannot well protect the JavaScript code.

[0115] S305: Obtain the intermediate code of the code to be protected and deteriorate the intermediate code to obtain the target intermediate code.

[0116] In some feasible implementations, obtaining the intermediate code of the code to be protected includes: obtaining the code to be protected and determining the abstract syntax tree corresponding to the code to be protected. The intermediate code of the code to be protected is obtained by compiling based on the abstract syntax tree corresponding to the code to be protected. The abstract syntax tree, referred to as syntax tree, is an abstract representation of the syntax structure of the source code. It represents the syntax structure of the programming language in a tree-like form, and each node on the tree represents a structure in the source code. The reason why the syntax is "abstract" is that the syntax here does not represent every detail that appears in the real syntax. For example, nested brackets are implicit in the tree structure and are not presented in the form of nodes; and conditional jump statements such as if-condition-then can be represented by a node with two branches. For example, lexical analysis of the instruction "var a=42;" in the original JavaScript code can obtain: Keyword(var), Identifier(a), Punctuator(=), Numeric(42), Punctuator(;), and then remove the "=" and ";" in the original code instruction, retaining only the var variable definition, and then connect the variable name "a" and the variable value "42".

[0117] In some feasible implementations, after obtaining the intermediate code of the code to be protected, the intermediate code can be further degraded, including: inserting instructions with no practical use into the intermediate code; converting integer or string constants in the intermediate code into multiple arithmetic instructions; inserting incomplete instructions at unreachable target addresses in the intermediate code; or swapping the order of instructions in the intermediate code without side effects. For example, after executing instruction 5, the code needs to jump to instruction 10 to continue execution, and the intermediate instructions 6-9 are not needed. In this case, an incomplete instruction can be inserted between the target addresses of instructions 6-9. Alternatively, for example, the integer 42 can be rewritten as an arithmetic instruction of the form "e=11+17+14." Alternatively, for example, the order of the instructions "var a=42;" and "var b=5;" can be swapped. After degrading the intermediate code, the target intermediate code can be obtained.

[0118] S306: Determine a repeated instruction combination from the target intermediate code.

[0119] In some feasible embodiments, after obtaining the above-mentioned target intermediate code, there are often some repeated instruction combinations in the target intermediate code. For example, after compiling JavaScript code in an abstract syntax tree, there will be some instructions that assign values to the same variable and perform the same calculation steps, and these instructions belong to repeated instruction combinations. In order to further increase the difficulty of code restoration, we can determine the repeated instruction combinations in the target intermediate code and the positions of each repeated instruction combination in the target intermediate code.

[0120] In some feasible embodiments, the instruction combinations and the occurrence times of each instruction combination in the above-mentioned target intermediate code can be determined from the above-mentioned target intermediate code. Sort the above-mentioned instruction combinations according to the occurrence times of the above-mentioned instruction combinations, and determine the instruction combinations with the occurrence times greater than or equal to the threshold as the above-mentioned repeated instruction combinations. For example, for the target intermediate code with the instruction sequence "ABACDABCDEAB", the instruction combination "AB" appears 3 times, and the instruction combination "CD" appears 2 times. Among them, in order to further increase the difficulty of code restoration, the corresponding threshold is variable each time the repeated instructions in the target intermediate code are determined. For example, when the threshold is 2, the repeated instruction combinations are "AB" and "CD"; when the threshold is 3, the repeated instruction combination is "AB".

[0121] S307: Determine the composite instructions corresponding to each repeated instruction combination in the above-mentioned target intermediate code, and generate composite intermediate code based on the composite instructions corresponding to each repeated instruction combination and the other instructions in the above-mentioned target intermediate code except the repeated instruction combinations.

[0122] In some feasible embodiments, a repeated instruction combination in the above-mentioned target intermediate code corresponds to multiple composite instructions, where the number of composite instructions corresponding to any repeated instruction combination does not exceed the occurrence times of the above-mentioned any repeated instruction combination in the target intermediate code. For example, for the target intermediate code with the instruction sequence "ABACDABCDEAB", the instruction combination "AB" appears 3 times, and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and the composite instruction corresponding to the repeated instruction combination "AB" can be specified as "X", and the composite instruction corresponding to the repeated instruction combination "CD" can be specified as "Y". In order to further increase the difficulty of code restoration, the composite instructions corresponding to the repeated instruction combination "AB" can be specified as "X1", "X2", and "X3", and the composite instructions corresponding to the repeated instruction combination "CD" can be specified as "Y1" and "Y2".

[0123] In some feasible embodiments, generating the composite intermediate code based on the composite instructions corresponding to the respective repeated instruction combinations and the other instructions in the target intermediate code except the repeated instruction combinations includes: determining the combination order of each repeated instruction combination and the other instructions in the target intermediate code except the repeated instruction combinations according to the order in which the instructions appear in the target intermediate code. Replace each repeated instruction combination in the target intermediate code with the composite instruction corresponding to the repeated instruction combination, and combine the composite instructions corresponding to the respective repeated instruction combinations with the other instructions in the target intermediate code except the repeated instruction combinations according to the combination order to generate the composite intermediate code. For example, for the target intermediate code with the instruction order of "ABACDABCDEAB", where the instruction combination "AB" appears 3 times and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and the composite instruction corresponding to the repeated instruction combination "AB" can be specified as "X", and the composite instruction corresponding to the repeated instruction combination "CD" can be specified as "Y". The repeated instruction combination "AB" in the target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to the repeated instruction combination, and the repeated instruction combination "CD" can be replaced with the composite instruction "Y" corresponding to the repeated instruction combination, and the composite instructions corresponding to the respective repeated instruction combinations are combined with the other instructions in the target intermediate code except the repeated instruction combinations according to the combination order to generate the composite intermediate code "XAYXYEX".

[0124] In some feasible embodiments, in order to further increase the difficulty of code restoration, all / part of the repeated instruction combination "AB" in the target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to the repeated instruction combination, all / part of the repeated instruction combination "CD" can be replaced with the composite instruction "Y" corresponding to the repeated instruction combination, and according to the combination order, the composite instructions corresponding to the respective repeated instruction combinations are combined with the other instructions in the target intermediate code except the repeated instruction combinations to generate the composite intermediate code "XAYABYEX".

[0125] Furthermore, in some feasible embodiments, all or part of the repeated instruction combination "AB" in the target intermediate code "ABACDABCDEAB" can be replaced with the composite instructions "X1", "X2", or "X3" corresponding to the repeated instruction combination, all or part of the repeated instruction combination "CD" can be replaced with the composite instructions "Y1" or "Y2" corresponding to the repeated instruction combination, and the composite instructions corresponding to the respective repeated instruction combinations are combined with the other instructions in the target intermediate code except the repeated instruction combinations according to the combination order to generate the composite intermediate code "X2AY1ABY2EX1".

[0126] S308: Generate dynamic instruction operation codes for each instruction in the above composite intermediate code, and generate an instruction table based on each instruction, the corresponding dynamic instruction operation code, and the operands in the above composite intermediate code.

[0127] In some feasible embodiments, for example, replace all or part of the repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" with the corresponding composite instructions "X1", "X2", or "X3" of the repeated instruction combination, replace all or part of the repeated instruction combination "CD" with the corresponding composite instructions "Y1" or "Y2" of the repeated instruction combination, and combine the composite instructions corresponding to each repeated instruction combination with the other instructions in the above target intermediate code except the repeated instruction combination according to the above combination order to generate the composite intermediate code "X2AY1ABY2EX1". The obtained composite intermediate code includes instructions "X2", "A", "Y1", "B", "Y2", "E", and "X1". To further increase the difficulty of code restoration, when compiling the composite intermediate code each time, generate dynamic instruction operation codes for "X2", "A", "Y1", "A", "B", "Y2", "E", and "X1" respectively. For example, generate the dynamic instruction operation code for "X2" as "0010", the dynamic instruction operation code for "A" as "0101", the dynamic instruction operation code for "Y1" as "0100", the dynamic instruction operation code for "B" as "1010", the dynamic instruction operation code for "Y2" as "0110", the dynamic instruction operation code for "E" as "0111", and the dynamic instruction operation code for "X1" as "1100". And generate an instruction table as shown in Table 2 based on each instruction, the corresponding dynamic instruction operation code, and the operands in the above composite intermediate code. Among them, Table 2 is the instruction table generated based on the composite intermediate code.

[0128] Table 2

[0129] Instruction Dynamic Instruction Opcode Operand X2 0010 00110101 A 0101 00100100 Y1 0100 10110011 B 1010 11001010 Y2 0110 01010101 E 0111 11001100 X1 1100 01001101

[0130] S309: Generate the bytecode corresponding to the above composite intermediate code based on the above instruction table and the above composite intermediate code.

[0131] In some feasible embodiments, for example, the composite intermediate code "X2AY1ABY2EX1" is generated according to the target intermediate code "ABACDABCDEAB". And the dynamic instruction opcode of the instruction table "X2" generated according to the composite intermediate code is "0010", the operand is "00110101", the dynamic instruction opcode of "A" is "0101", the operand is "00100100", the dynamic instruction opcode of "Y1" is "0100", the operand is "10110011", the dynamic instruction opcode of "B" is "1010", the operand is "11001010", the dynamic instruction opcode of "Y2" is "0110", the operand is "01010101", the dynamic instruction opcode of "E" is "0111", the operand is "11001100", and the dynamic instruction opcode of "X1" is "1100", the operand is "01001101". Based on the above instruction table and the above composite intermediate code, the bytecode corresponding to the above composite intermediate code is generated: "0010 00110101 0101 00100100 0100 10110011 010100100100 1010 11001010 011001010101 0111 11001100 1100 01001101".

[0132] S309: Send the delivery code to the target application.

[0133] In some feasible embodiments, after generating the bytecode, the virtual machine description information can be obtained, and a virtual machine for running the above bytecode can be generated according to the above virtual machine description information and the above instruction table. And the above bytecode and the above virtual machine are packaged to generate a delivery code. Among them, the above virtual machine description information includes the number of registers, register types, register uses, memory structure, run stack and exception stack, interaction requirements of the running environment, and the fetch-dispatch-execute loop table. In the specific synthesis process, the opcode of each instruction recorded in the instruction table is filled into the instruction dispatch table in the fetch-dispatch-execute loop table, and the specific function of the instruction is filled into the fetch-dispatch-execute loop table. Optionally, the bytecode can be expressed as a binary array in JavaScript and compressed. Add a virtual machine bootstrap program, initialize the running environment and specify the program entry address, and import and export global variables. For details, please refer to Figure 7 , Figure 7 is a schematic flowchart of a process for running bytecode on a virtual machine provided by an embodiment of the present application. As Figure 7As shown in the figure, the virtual machine interprets and executes the bytecode to complete the code function equivalent to the original code logic. After receiving the request to execute the bytecode, the virtual machine can judge whether the running environment is normal by interacting with the host environment. If the running environment is abnormal, the exception is handled by the exception handler. If the running environment is normal, the bytecode is executed according to the fetch-decode-execute loop table until it exits after the execution is completed.

[0134] In the embodiment of the present application, by compiling the code to be protected into equivalent intermediate code and deteriorating it, the target intermediate code is obtained, and the repeated instruction combinations in the target intermediate code are replaced with composite instructions to obtain the composite intermediate code. Dynamic instruction operation codes are generated for the instructions in the composite intermediate code and stored in the instruction table, so that the bytecode corresponding to the composite intermediate code can be generated. It can be understood that compiling the code to be protected into equivalent intermediate code and deteriorating it can blur the correlation between the target intermediate code and the code to be protected, and improve the code protection strength. Further, replacing the repeated instruction combinations in the target intermediate code with composite instructions to obtain the composite intermediate code can further blur the correlation between the composite intermediate code and the code to be protected, and improve the code protection strength. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in the instruction table, so that the bytecode corresponding to the composite intermediate code can be generated, can convert the code to be protected into bytecode, and further blur the correlation between the bytecode and the code to be protected, and improve the code protection strength. Using the virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode. It can be seen that by adopting the embodiment of the present invention, the code can be converted into bytecode to increase the code security; in addition, using the virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode.

[0135] Further, please refer to Figure 8 , Figure 8 which is a schematic structural diagram of the code protection device provided by the embodiment of the present application. As Figure 8 shown, the above device may include:

[0136] A code acquisition module 60, configured to acquire the intermediate code of the code to be protected and deteriorate the intermediate code to obtain the target intermediate code.

[0137] In some feasible embodiments, the code acquisition module 60 includes a code compilation unit 601, configured to acquire the code to be protected, determine the abstract syntax tree corresponding to the code to be protected, and compile the intermediate code of the code to be protected based on the abstract syntax tree corresponding to the code to be protected.

[0138] In some feasible implementations, the code acquisition module 60 includes a code degradation unit 602, which is used to insert instructions that have no practical use into the above-mentioned intermediate code; or convert integer or string constants in the above-mentioned intermediate code into multiple operation instructions; or insert incomplete instructions into unreachable target addresses in the above-mentioned intermediate code; or exchange the instructions in the above-mentioned intermediate code in order without side effects.

[0139] In some feasible implementations, obtaining the intermediate code of the code to be protected includes: obtaining the code to be protected, and determining the abstract syntax tree corresponding to the above code to be protected. The intermediate code of the above code to be protected is compiled based on the abstract syntax tree corresponding to the above code to be protected. The abstract syntax tree, referred to as syntax tree, is an abstract representation of the syntax structure of the source code. It represents the syntax structure of the programming language in the form of a tree, and each node on the tree represents a structure in the source code. The reason why the syntax is "abstract" is that the syntax here does not represent every detail that appears in the real syntax. For example, nested brackets are implied in the structure of the tree and are not presented in the form of nodes; and conditional jump statements such as if-condition-then can be represented using nodes with two branches. Among them, 10a is the original JavaScript code, and 10b is the representation of the original JavaScript code using the abstract syntax tree. For example, lexical analysis of the instruction "var a=42;" in the original JavaScript code can yield: Keyword(var), Identifier(a), Punctuator(=), Numeric(42), Punctuator(;), and then removing the "=" and ";" in the original code instruction, leaving only the var variable definition, and then connecting the variable name "a" and the variable value "42".

[0140] In some feasible implementations, after obtaining the intermediate code of the code to be protected, the intermediate code can be further degraded, including: inserting instructions with no practical use into the intermediate code; converting integer or string constants in the intermediate code into multiple arithmetic instructions; inserting incomplete instructions at unreachable target addresses in the intermediate code; or swapping the order of instructions in the intermediate code without side effects. For example, after executing instruction 5, the code needs to jump to instruction 10 to continue execution, and the intermediate instructions 6-9 are not needed. In this case, an incomplete instruction can be inserted between the target addresses of instructions 6-9. Alternatively, for example, the integer 42 can be rewritten as an arithmetic instruction of the form "e=11+17+14." Alternatively, for example, the order of the instructions "var a=42;" and "var b=5;" can be swapped. After degrading the intermediate code, the target intermediate code can be obtained.

[0141] A duplicate instruction determination module 61, configured to determine a duplicate instruction combination from the above-mentioned target intermediate code, where the duplicate instruction combination appears at least twice in the above-mentioned target intermediate code.

[0142] In some feasible implementation manners, after obtaining the above-mentioned target intermediate code, there are often some duplicate instruction combinations in the target intermediate code. For example, after compiling JavaScript code in an abstract syntax tree, some instructions for assigning values to the same variable and performing the same calculation steps will be obtained, and these instructions belong to duplicate instruction combinations. In order to further increase the difficulty of code restoration, we can determine the duplicate instruction combinations in the target intermediate code and the positions of each duplicate instruction combination in the target intermediate code.

[0143] In some feasible implementation manners, the duplicate instruction determination module 61 includes a duplicate instruction screening unit 611, configured to determine instruction combinations and the number of occurrences of each instruction combination in the above-mentioned target intermediate code from the above-mentioned target intermediate code, sort the above-mentioned instruction combinations according to the number of occurrences of each instruction combination, and determine the instruction combinations with the number of occurrences greater than or equal to a threshold as the above-mentioned duplicate instruction combinations.

[0144] Specifically, instruction combinations and the number of occurrences of each instruction combination in the above-mentioned target intermediate code can be determined from the above-mentioned target intermediate code. The above-mentioned instruction combinations are sorted according to the number of occurrences of each instruction combination, and the instruction combinations with the number of occurrences greater than or equal to a threshold are determined as the above-mentioned duplicate instruction combinations. For example, for a target intermediate code with an instruction sequence of "ABACDABCDEAB", the instruction combination "AB" appears 3 times, and the instruction combination "CD" appears 2 times. Among them, in order to further increase the difficulty of code restoration, the corresponding threshold is variable each time duplicate instructions in the target intermediate code are determined. For example, when the threshold is 2, the duplicate instruction combinations are "AB" and "CD"; when the threshold is 3, the duplicate instruction combination is "AB".

[0145] A composite code generation module 62, configured to determine composite instructions corresponding to each duplicate instruction combination in the above-mentioned target intermediate code, and generate composite intermediate code according to the composite instructions corresponding to each duplicate instruction combination and other instructions in the above-mentioned target intermediate code except the duplicate instruction combinations.

[0146] In some feasible implementation manners, the composite code generation module 62 includes an instruction sequence determination unit 621 and an instruction combination unit 622.

[0147] Among them, the instruction sequence determination unit 621 is configured to determine the combination order of each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combination according to the order in which each instruction appears in the target intermediate code as described above.

[0148] The instruction combination unit 622 is configured to replace each repeated instruction combination in the target intermediate code with a corresponding composite instruction of each repeated instruction combination, and combine the corresponding composite instructions of each repeated instruction combination and other instructions in the target intermediate code except the repeated instruction combination according to the above combination order to generate a composite intermediate code.

[0149] In some feasible embodiments, the instruction combination unit 622 includes a composite instruction replacement subunit 6221, configured to replace all repeated instruction combinations in the target intermediate code with corresponding composite instructions of each repeated instruction combination; or replace some repeated instruction combinations in the target intermediate code with corresponding composite instructions of each repeated instruction combination.

[0150] In some feasible embodiments, a repeated instruction combination in the target intermediate code corresponds to multiple composite instructions, where the number of composite instructions corresponding to any repeated instruction combination does not exceed the number of occurrences of any repeated instruction combination in the target intermediate code. For example, for a target intermediate code with an instruction sequence of "ABACDABCDEAB", where the instruction combination "AB" appears 3 times and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and the composite instruction corresponding to the repeated instruction combination "AB" can be specified as "X", and the composite instruction corresponding to the repeated instruction combination "CD" can be specified as "Y". To further increase the difficulty of code restoration, the composite instructions corresponding to the repeated instruction combination "AB" can be specified as "X1", "X2", and "X3", and the composite instructions corresponding to the repeated instruction combination "CD" can be specified as "Y1" and "Y2".

[0151] In some feasible embodiments, generating the composite intermediate code based on the composite instructions corresponding to each of the above repeated instruction combinations and the other instructions in the above target intermediate code except the repeated instruction combinations includes: determining the combination order of each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations according to the order in which each instruction appears in the above target intermediate code. Replace each repeated instruction combination in the above target intermediate code with the composite instruction corresponding to each repeated instruction combination, and combine the composite instructions corresponding to each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations according to the above combination order to generate the composite intermediate code. For example, for the target intermediate code with the instruction order of "ABACDABCDEAB", where the instruction combination "AB" appears 3 times and the instruction combination "CD" appears 2 times. When the threshold is 2, the repeated instruction combinations are "AB" and "CD", and the composite instruction corresponding to the repeated instruction combination "AB" can be specified as "X", and the composite instruction corresponding to the repeated instruction combination "CD" can be specified as "Y". The repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to this repeated instruction combination, the repeated instruction combination "CD" can be replaced with the composite instruction "Y" corresponding to this repeated instruction combination, and the composite instructions corresponding to each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations are combined according to the above combination order to generate the composite intermediate code "XAYXYEX".

[0152] In some feasible embodiments, in order to further increase the difficulty of code restoration, all / part of the repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" can be replaced with the composite instruction "X" corresponding to this repeated instruction combination, all / part of the repeated instruction combination "CD" can be replaced with the composite instruction "Y" corresponding to this repeated instruction combination, and according to the above combination order, the composite instructions corresponding to each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations are combined to generate the composite intermediate code "XAYABYEX".

[0153] Furthermore, in some feasible embodiments, all or part of the repeated instruction combination "AB" in the above target intermediate code "ABACDABCDEAB" can be replaced with the composite instructions "X1", "X2", or "X3" corresponding to this repeated instruction combination, all or part of the repeated instruction combination "CD" can be replaced with the composite instructions "Y1" or "Y2" corresponding to this repeated instruction combination, and the composite instructions corresponding to each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations are combined according to the above combination order to generate the composite intermediate code "X2AY1ABY2EX1".

[0154] An instruction list generation module 63 is configured to generate dynamic instruction operation codes for each instruction in the above-mentioned composite intermediate code, and generate an instruction list according to each instruction, the corresponding dynamic instruction operation code and operands in the above-mentioned composite intermediate code, wherein the dynamic instruction operation codes corresponding to different instructions are different.

[0155] In some feasible embodiments, for example, all or part of the repeated instruction combination "AB" in the above-mentioned target intermediate code "ABACDABCDEAB" is replaced with the corresponding composite instruction "X1", "X2" or "X3" of the repeated instruction combination, and all or part of the repeated instruction combination "CD" is replaced with the corresponding composite instruction "Y1" or "Y2" of the repeated instruction combination, and the composite instructions corresponding to the above-mentioned repeated instruction combinations are combined with other instructions in the above-mentioned target intermediate code except the repeated instruction combination according to the above combination order to generate a composite intermediate code "X2AY1ABY2EX1". The obtained composite intermediate code includes instructions "X2", "A", "Y1", "B", "Y2", "E" and "X1". In order to further increase the difficulty of code restoration, when compiling the composite intermediate code each time, dynamic instruction operation codes can be generated for "X2", "A", "Y1", "A", "B", "Y2", "E" and "X1" respectively. For example, the dynamic instruction operation code generated for "X2" is "0010", the dynamic instruction operation code for "A" is "0101", the dynamic instruction operation code for "Y1" is "0100", the dynamic instruction operation code for "B" is "1010", the dynamic instruction operation code for "Y2" is "0110", the dynamic instruction operation code for "E" is "0111", and the dynamic instruction operation code for "X1" is "1100". And an instruction list as shown in Table 3 is generated according to each instruction, the corresponding dynamic instruction operation code and operands in the above-mentioned composite intermediate code. Among them, Table 3 is the instruction list generated according to the composite intermediate code.

[0156] Table 3

[0157] Instruction Dynamic Instruction Opcode Operand X2 0010 00110101 A 0101 00100100 Y1 0100 10110011 B 1010 11001010 Y2 0110 01010101 E 0111 11001100 X1 1100 01001101

[0158] A bytecode generation module 64 is configured to generate bytecodes corresponding to the above-mentioned composite intermediate code based on the above-mentioned instruction list and the above-mentioned composite intermediate code.

[0159] In some feasible embodiments, for example, a composite intermediate code "X2AY1ABY2EX1" is generated according to the target intermediate code "ABACDABCDEAB". And the dynamic instruction opcode of the instruction table "X2" generated according to the composite intermediate code is "0010", the operand is "00110101", the dynamic instruction opcode of "A" is "0101", the operand is "00100100", the dynamic instruction opcode of "Y1" is "0100", the operand is "10110011", the dynamic instruction opcode of "B" is "1010", the operand is "11001010", the dynamic instruction opcode of "Y2" is "0110", the operand is "01010101", the dynamic instruction opcode of "E" is "0111", the operand is "11001100", and the dynamic instruction opcode of "X1" is "1100", the operand is "01001101". Based on the above instruction table and the above composite intermediate code, the bytecode corresponding to the above composite intermediate code is generated: "0010 00110101 0101 00100100 0100 10110011 010100100100 1010 11001010 011001010101 0111 11001100 1100 01001101".

[0160] In some feasible embodiments, the code protection device further includes: a virtual machine generation module 65 and a delivery code generation module 66. Among them, the virtual machine generation module 65 is used to obtain virtual machine description information, and generate a virtual machine for running the above bytecode according to the above virtual machine description information and the above instruction table. The delivery code generation module 66 is used to generate delivery code based on the above bytecode and the above virtual machine.

[0161] Among them, the above virtual machine description information includes the number of registers, register types, register uses, memory structure, execution stack and exception stack, interaction requirements of the execution environment, and the fetch-dispatch-execute loop table. During the specific synthesis process, the operation code of each instruction recorded in the instruction table is filled into the instruction dispatch table in the fetch-dispatch-execute loop table, and the specific function of the instruction is filled into the fetch-dispatch-execute loop table. Optionally, the bytecode can be expressed as a binary array in JavaScript and compressed. Add a virtual machine boot program to initialize the execution environment and specify the program entry address, and import and export global variables. Specifically, the virtual machine interprets and executes the bytecode to complete the code function equivalent to the original code logic. After the virtual machine receives a request to execute the bytecode, it can determine whether the execution environment is normal by interacting with the host environment. If the execution environment is abnormal, the exception is handled by an exception handler. If the execution environment is normal, the bytecode is executed according to the fetch-dispatch-execute loop table until it exits after completion.

[0162] In the embodiments of this application, by compiling the code to be protected into an equivalent intermediate code and deteriorating it, a target intermediate code is obtained, and the repeated instruction combinations in the target intermediate code are replaced with composite instructions to obtain a composite intermediate code. Dynamic instruction operation codes are generated for the instructions in the composite intermediate code and stored in the instruction table, so that the bytecode corresponding to the composite intermediate code can be generated. It can be understood that compiling the code to be protected into an equivalent intermediate code and deteriorating it can obscure the correlation between the target intermediate code and the code to be protected, and improve the code protection strength. Further, replacing the repeated instruction combinations in the target intermediate code with composite instructions to obtain a composite intermediate code can further obscure the correlation between the composite intermediate code and the code to be protected, and improve the code protection strength. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in the instruction table, so that the bytecode corresponding to the composite intermediate code can be generated, can convert the code to be protected into bytecode, and further obscure the correlation between the bytecode and the code to be protected, and improve the code protection strength. Using a virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode. It can be seen that by adopting the embodiments of this invention, the code can be converted into bytecode to increase code security; in addition, using a virtual machine to run the bytecode and packaging and delivering the virtual machine and the bytecode can improve the applicability of the bytecode.

[0163] See Figure 9 , Figure 9 is a schematic structural diagram of the device provided by the embodiments of this application. As Figure 9As shown in the figure, the device 1000 in this embodiment may include: a processor 1001, a network interface 1004, and a memory 1005. In addition, the above device 1000 may further include: a user interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to implement connection communication between these components. Among them, the user interface 1003 may include a display screen (Display) and a keyboard (Keyboard). Optionally, the user interface 1003 may further include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1004 may be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 1005 may optionally also be at least one storage device located far from the aforementioned processor 1001. As Figure 9 shown, the memory 1005, as a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program.

[0164] In Figure 9 the device 1000 shown in the figure, the network interface 1004 can provide network communication functions; the user interface 1003 is mainly used to provide an input interface for users; and the processor 1001 can be used to call the device control application program stored in the memory 1005 to implement:

[0165] Obtain the intermediate code of the code to be protected, and deteriorate the above intermediate code to obtain the target intermediate code;

[0166] Determine the repeated instruction combinations from the above target intermediate code, and the above repeated instruction combinations appear at least twice in the above target intermediate code;

[0167] Determine the composite instructions corresponding to each repeated instruction combination in the above target intermediate code, and generate composite intermediate code according to the composite instructions corresponding to each repeated instruction combination and other instructions in the above target intermediate code except the repeated instruction combinations;

[0168] Generate dynamic instruction operation codes for each instruction in the above composite intermediate code, and generate an instruction table according to each instruction, the dynamic instruction operation codes corresponding to each instruction, and the operands in the above composite intermediate code, where the dynamic instruction operation codes corresponding to different instructions are different;

[0169] Generate bytecodes corresponding to the above composite intermediate code based on the above instruction table and the above composite intermediate code.

[0170] In some feasible implementation manners, the above method further includes:

[0171] Obtain the virtual machine description information, and generate a virtual machine for running the above bytecode according to the above virtual machine description information and the above instruction table;

[0172] Among them, the above virtual machine description information includes the number of registers, register types, register uses, memory structure, execution stack and exception stack, interaction requirements of the execution environment, and the fetch-dispatch-execute loop table;

[0173] Generate delivery code based on the above bytecode and the above virtual machine.

[0174] In some feasible embodiments, the above obtaining the intermediate code of the code to be protected includes:

[0175] Obtain the code to be protected and determine the abstract syntax tree corresponding to the above code to be protected;

[0176] Compile the intermediate code of the above code to be protected based on the abstract syntax tree corresponding to the above code to be protected.

[0177] In some feasible embodiments, the above determining the repeated instruction combinations from the above target intermediate code includes:

[0178] Determine the instruction combinations from the above target intermediate code and the number of occurrences of each instruction combination in the above target intermediate code;

[0179] Sort the above instruction combinations according to the number of occurrences of each instruction combination, and determine the instruction combinations with the number of occurrences greater than or equal to the threshold as the above repeated instruction combinations.

[0180] In some feasible embodiments, one repeated instruction combination in the above target intermediate code corresponds to multiple composite instructions, and the number of composite instructions corresponding to any repeated instruction combination does not exceed the number of occurrences of any repeated instruction combination in the above target intermediate code.

[0181] In some feasible embodiments, the above generating the composite intermediate code according to the composite instructions corresponding to the above repeated instruction combinations and the other instructions in the above target intermediate code except the repeated instruction combinations includes:

[0182] Determine the combination order of each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations according to the order in which each instruction appears in the above target intermediate code;

[0183] Replace each repeated instruction combination in the above target intermediate code with the composite instruction corresponding to each repeated instruction combination, and combine the composite instructions corresponding to the above repeated instruction combinations and the other instructions in the above target intermediate code except the repeated instruction combinations according to the above combination order to generate the composite intermediate code.

[0184] In some feasible embodiments, the replacement of each repeated instruction combination in the above target intermediate code with the corresponding composite instruction of each repeated instruction combination includes:

[0185] Replacing all the repeated instruction combinations in the above target intermediate code with the corresponding composite instructions of each repeated instruction combination; or

[0186] Replacing some of the repeated instruction combinations in the above target intermediate code with the corresponding composite instructions of each repeated instruction combination.

[0187] In some feasible embodiments, the degradation of the above intermediate code includes:

[0188] Inserting instructions with no practical use into the above intermediate code; or

[0189] Converting integer or string constants in the above intermediate code into multiple arithmetic instructions; or

[0190] Inserting incomplete instructions into the unreachable target addresses in the above intermediate code; or

[0191] Performing a side-effect-free sequential exchange of the instructions in the above intermediate code.

[0192] It should be understood that in some feasible embodiments, the above processor 1001 may be a central processing unit (CPU), and this processor may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or this processor may also be any conventional processor, etc. The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A part of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0193] For ease of understanding, in an embodiment of the present application, a user terminal can be selected as the target user terminal among multiple user terminals. The target user terminal can include intelligent terminals with picture data processing functions (such as picture taking functions), such as smart phones, tablet computers, desktop computers, etc. The target user terminal can include intelligent terminals that require code protection functions (such as electronic payment functions, investment management functions), such as smart phones, tablet computers, desktop computers, etc. For example, in an embodiment of the present application, Figure 1 the user terminal 3000a shown in the figure can be used as the above-mentioned target user terminal, and a target application with the code protection function can be integrated in the target user terminal. It should be understood that the target applications integrated in the target user terminal can be collectively referred to as application clients. Among them, the above-mentioned target applications can include applications with code protection functions, such as social applications (such as user authentication applications), life applications (such as electronic payment applications), financial applications (such as investment management applications), etc. The code to be protected applied in the target user terminal can include the code to be protected applied in the target user terminal and the intermediate code obtained by compiling the code to be protected.

[0194] It can be understood that the solution of converting the code to be protected into bytecode by the code protection method described in an embodiment of the present application can be applied to all application scenarios where code is protected in a web page or an application client (i.e., the aforementioned target application). When the target application with the code protection function runs on the target user terminal, the code run by the target user terminal can include the code to be protected pre-built in the target application, and can also include the code to be protected currently downloaded from the server 2000 through the network.

[0195] It should be understood that in an embodiment of the present application, the code to be protected pre-built in the target application and the currently downloaded code to be protected can be collectively referred to as the code to be protected. Thus, it can be seen that in an embodiment of the present application, during the running of a web page or a target application, the code to be protected can be protected to obtain the aforementioned bytecode, so that when the bytecode runs in a web page or an application client, the security of the code can be improved, and the memory occupation of the system by code protection operations can be reduced.

[0196] Optionally, before the target user terminal runs the target application, embodiments of the present application can also bytecode-process the code to be protected obtained from the server in advance in the target user terminal to obtain the foregoing bytecode. Thus, when the target user terminal runs the target application, the bytecode can be directly run to reduce system performance loss during the running of the target application (for example, reduce the memory occupation of the code protection operation in the target user terminal). Optionally, before the target user terminal runs the target application, embodiments of the present application can also bytecode-process the code to be protected in the server in advance to obtain bytecode. Thus, when the target user terminal runs the target application, a data download instruction (i.e., a data loading instruction) can be sent to the server through the network, so that the server can determine whether the target user terminal meets the bytecode condition based on the terminal identifier carried in the download instruction. If the server determines that the target user terminal meets the bytecode condition, that is, the server determines that the type of the terminal identifier of the target user terminal belongs to the identifier type of a low-end machine, the bytecode stored after pre-bytecode processing can be returned to the target user terminal in the server for running. Thus, when the target application runs on the target user terminal, system performance loss can be reduced and the security of the code to be protected can be improved. It can be seen that embodiments of the present application can also bytecode-process the code to be protected in the target user terminal or the server before running the target application to obtain bytecode.

[0197] Optionally, before the target user terminal runs the target application, embodiments of the present application can also process the code to be protected obtained from the server in advance in the target user terminal to obtain the foregoing bytecode. In other words, the read code to be protected can also be directly processed by the server into bytecode and then obtained by the target user terminal for subsequent processing. For example, taking the above target application as a life application (electronic bus code), the target user terminal can load and run the bytecode through the life application to obtain an electronic bus code containing a user verification signature and use the user verification signature for identity verification.

[0198] The code to be protected described in the embodiments of this application may include code applied to interfaces, code applied to protocols, and so on. In other words, the code to be protected may include code for generating verification signatures when pulling data, code for describing private protocols during data communication, or code for describing transaction logics during online transactions. For example, taking the above target application as a life application, before taking the subway, a ride code for the user to take the subway needs to be generated through the target application. The target user terminal can capture the user's behavior information through this life application and generate a display request for the ride code. Specifically, it includes running signature generation code according to the user's identity information to generate a user signature, and then the user signature can be written into the ride code for subsequent user authentication. Among them, the process of running the signature generation code requires code protection.

[0199] It should be understood that the device control application program stored in the above memory 1005 may include the following functional modules:

[0200] The code acquisition module is used to acquire the intermediate code of the code to be protected and deteriorate the above intermediate code to obtain the target intermediate code;

[0201] The repeated instruction determination module is used to determine the repeated instruction combinations from the above target intermediate code, and the above repeated instruction combinations appear at least twice in the above target intermediate code;

[0202] The composite code generation module is used to determine the composite instructions corresponding to each repeated instruction combination in the above target intermediate code, and generate composite intermediate code according to the composite instructions corresponding to each repeated instruction combination and the other instructions in the above target intermediate code except the repeated instruction combinations;

[0203] The instruction table generation module is used to generate the dynamic instruction operation codes of each instruction in the above composite intermediate code, and generate an instruction table according to each instruction, the dynamic instruction operation codes corresponding to each instruction, and the operands in the above composite intermediate code. Among them, the dynamic instruction operation codes corresponding to different instructions are different;

[0204] The bytecode generation module is used to generate the bytecode corresponding to the above composite intermediate code based on the above instruction table and the above composite intermediate code.

[0205] In some feasible implementation manners, the above device further includes:

[0206] The virtual machine generation module is used to acquire virtual machine description information and generate a virtual machine for running the above bytecode according to the above virtual machine description information and the above instruction table;

[0207] Among them, the virtual machine description information includes the number of registers, register types, register uses, memory structure, run stack and exception stack, interaction requirements of the running environment, and the fetch-dispatch-execute loop table;

[0208] The delivery code generation module is used to generate delivery code based on the above bytecode and the above virtual machine.

[0209] In some feasible embodiments, the above code acquisition module further includes:

[0210] The code compilation unit is used to obtain the code to be protected, determine the abstract syntax tree corresponding to the code to be protected, and compile the intermediate code of the code to be protected based on the abstract syntax tree corresponding to the code to be protected.

[0211] In some feasible embodiments, the above duplicate instruction determination module includes:

[0212] The duplicate instruction screening unit is used to determine instruction combinations and the occurrence times of each instruction combination in the target intermediate code from the above target intermediate code, sort the above instruction combinations according to the occurrence times of each instruction combination, and determine the instruction combinations with the occurrence times greater than or equal to the threshold as the above duplicate instruction combinations.

[0213] In some feasible embodiments, a duplicate instruction combination in the above target intermediate code corresponds to multiple composite instructions, where the number of composite instructions corresponding to any duplicate instruction combination does not exceed the occurrence times of any duplicate instruction combination in the above target intermediate code.

[0214] In some feasible embodiments, the above composite code generation module includes:

[0215] The instruction order determination unit is used to determine the combination order of each duplicate instruction combination and other instructions in the target intermediate code except the duplicate instruction combination according to the order in which each instruction appears in the target intermediate code.

[0216] The instruction combination unit is used to replace each duplicate instruction combination in the above target intermediate code with the composite instruction corresponding to each duplicate instruction combination, and combine the composite instructions corresponding to each duplicate instruction combination and other instructions in the above target intermediate code except the duplicate instruction combination according to the above combination order to generate composite intermediate code.

[0217] In some feasible embodiments, the above instruction combination unit includes:

[0218] A composite instruction replacement unit, configured to replace all the repeated instruction combinations in the above-mentioned target intermediate code with the composite instructions corresponding to the repeated instruction combinations; or replace some of the repeated instruction combinations in the above-mentioned target intermediate code with the composite instructions corresponding to the repeated instruction combinations.

[0219] In some feasible implementation manners, the above-mentioned code acquisition module includes:

[0220] A code deterioration unit, configured to insert instructions with no actual use in the above-mentioned intermediate code; or convert integer or string constants in the above-mentioned intermediate code into multiple arithmetic instructions; or insert incomplete instructions at unreachable target addresses in the above-mentioned intermediate code; or perform a side-effect-free sequential exchange of instructions in the above-mentioned intermediate code.

[0221] In a specific implementation, the above-mentioned device 1000 can execute the implementation manners provided in each of the above steps through its built-in various functional modules. Figure 2 and / or Figure 6 The implementation manners provided in each of the above steps, specifically, reference can be made to the implementation manners provided in each of the above steps, which will not be elaborated herein.

[0222] In the embodiment of the present application, by compiling the code to be protected into an equivalent intermediate code and deteriorating it, a target intermediate code is obtained, and the repeated instruction combinations in the target intermediate code are replaced with composite instructions to obtain a composite intermediate code. Dynamic instruction operation codes are generated for the instructions in the composite intermediate code and stored in an instruction table, so as to generate bytecodes corresponding to the composite intermediate code. It can be understood that compiling the code to be protected into an equivalent intermediate code and deteriorating it can obscure the correlation between the target intermediate code and the code to be protected, and improve the code protection intensity. Further, replacing the repeated instruction combinations in the target intermediate code with composite instructions to obtain a composite intermediate code can further obscure the correlation between the composite intermediate code and the code to be protected, and improve the code protection intensity. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in the instruction table, so as to generate bytecodes corresponding to the composite intermediate code, can convert the code to be protected into bytecodes, and further obscure the correlation between the bytecodes and the code to be protected, and improve the code protection intensity. Using a virtual machine to run the bytecodes and packaging the virtual machine and the bytecodes for delivery can improve the applicability of the bytecodes. It can be seen that by adopting the embodiment of the present invention, the code can be converted into bytecodes to increase the code security; in addition, using a virtual machine to run the bytecodes and packaging the virtual machine and the bytecodes for delivery can improve the applicability of the bytecodes.

[0223] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program that is executed by a processor to implement Figure 2 and / or Figure 6For the methods provided in each step, specifically, please refer to the implementation manners provided in each of the above steps, which will not be elaborated herein.

[0224] The above computer-readable storage medium may be an internal storage unit of the task processing device provided in any of the foregoing embodiments, such as the hard disk or memory of an electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. The above computer-readable storage medium may further include magnetic disks, optical disks, read-only memory (ROM), or random access memory (RAM), etc. Further, the computer-readable storage medium may include both the internal storage unit and the external storage device of the electronic device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store the data that has been output or will be output.

[0225] In the embodiments of the present application, by compiling the code to be protected into an equivalent intermediate code and deteriorating it to obtain a target intermediate code, and replacing the repeated instruction combinations in the target intermediate code with composite instructions to obtain a composite intermediate code, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in an instruction table, bytecodes corresponding to the composite intermediate code can be generated. It can be understood that compiling the code to be protected into an equivalent intermediate code and deteriorating it can obscure the correlation between the target intermediate code and the code to be protected, and improve the code protection strength. Further, replacing the repeated instruction combinations in the target intermediate code with composite instructions to obtain a composite intermediate code can further obscure the correlation between the composite intermediate code and the code to be protected, and improve the code protection strength. Furthermore, generating dynamic instruction operation codes for the instructions in the composite intermediate code and storing them in an instruction table, so that bytecodes corresponding to the composite intermediate code can be generated, can convert the code to be protected into bytecodes, and further obscure the correlation between the bytecodes and the code to be protected, and improve the code protection strength. Running the bytecodes using a virtual machine and packaging and delivering the virtual machine and the bytecodes can improve the applicability of the bytecodes. It can be seen that by adopting the embodiments of the present invention, the code can be converted into bytecodes to increase code security; in addition, running the bytecodes using a virtual machine and packaging and delivering the virtual machine and the bytecodes can improve the applicability of the bytecodes.

[0226] The terms "first", "second", etc. in the claims, the description and the drawings of this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "comprising", "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally further includes steps or units not listed, or optionally further includes other steps or units inherent to these processes, methods, products or devices. Referring to "an embodiment" herein means that a specific feature, structure or characteristic described in connection with the embodiment can be included in at least one embodiment of this application. The phrase shown at various positions in the description does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments. The term "and / or" used in the description and the appended claims of this application refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0227] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described according to their functions in the above description. Professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0228] The foregoing disclosure is only for the preferred embodiments of this application, and of course cannot be used to limit the scope of rights of this application. Therefore, equivalent changes made according to the claims of this application still fall within the scope covered by this application.

Claims

1. A code protection method, characterized in that: The method comprises: Obtaining an intermediate code of the code to be protected, and inserting instructions of no practical use into the intermediate code, or converting integer or string constants in the intermediate code into multiple operation instructions, or inserting incomplete instructions into unreachable target addresses in the intermediate code, or performing a side-effect-free sequence swapping of instructions in the intermediate code to degrade the intermediate code to obtain a target intermediate code; Determining a repeated instruction combination from the target intermediate code, where the repeated instruction combination appears at least twice in the target intermediate code; Determining the compound instructions corresponding to each repeated instruction combination in the target intermediate code, and determining the order of combining each repeated instruction combination with other instructions in the target intermediate code except the repeated instruction combination according to the order in which each instruction in the target intermediate code appears in the target intermediate code; Replacing each repeated instruction combination in the target intermediate code with a compound instruction corresponding to each repeated instruction combination, wherein one repeated instruction combination in the target intermediate code corresponds to multiple compound instructions, and a repeated instruction combination corresponds to different compound instructions in different orders of appearance in the target intermediate code, wherein the number of compound instructions corresponding to any repeated instruction combination does not exceed the number of times any repeated instruction combination appears in the target intermediate code, and combining the compound instructions corresponding to each repeated instruction combination with other instructions in the target intermediate code except the repeated instruction combination in accordance with the combination order to generate a compound intermediate code; generating a dynamic instruction operation code for each instruction in the composite intermediate code, and generating an instruction table according to each instruction in the composite intermediate code, the dynamic instruction operation code corresponding to each instruction, and the operand, wherein different instructions have different dynamic instruction operation codes corresponding to them; A bytecode corresponding to the composite intermediate code is generated based on the instruction table and the composite intermediate code.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining virtual machine description information, and generating a virtual machine for running the bytecode according to the virtual machine description information and the instruction table; The virtual machine description information includes the number of registers, register types, register usage, memory structure, runtime stack and exception stack, runtime environment interaction requirements, and instruction fetch-dispatch-execute loop table; A delivery code is generated based on the bytecode and the virtual machine.

3. The method according to claim 1 or 2, characterized in that The step of obtaining the intermediate code of the code to be protected includes: Obtaining the code to be protected and determining the abstract syntax tree corresponding to the code to be protected; The intermediate code of the code to be protected is obtained based on the abstract syntax tree corresponding to the code to be protected.

4. The method according to claim 3, characterized in that Determining the repeated instruction combination from the target intermediate code includes: Determining, from the target intermediate code, an instruction combination and the number of occurrences of each instruction combination in the target intermediate code; The instruction combinations are sorted according to the number of occurrences of the instruction combinations, and the instruction combinations whose number of occurrences is greater than a threshold are determined as the repeated instruction combinations.

5. A code protection device, characterized in that: include: a code acquisition module, configured to acquire the intermediate code of the code to be protected, and insert instructions of no practical use into the intermediate code, or convert integer or string constants in the intermediate code into multiple operation instructions, or insert incomplete instructions into unreachable target addresses in the intermediate code, or perform a side-effect-free sequence swap of instructions in the intermediate code to degrade the intermediate code to obtain a target intermediate code; a repeated instruction determination module, configured to determine a repeated instruction combination from the target intermediate code, wherein the repeated instruction combination appears at least twice in the target intermediate code; a compound code generation module, for determining the compound instructions corresponding to each repeated instruction combination in the target intermediate code, and determining the combination order of each repeated instruction combination with other instructions in the target intermediate code except the repeated instruction combination according to the order in which each instruction in the target intermediate code appears in the target intermediate code; replacing each repeated instruction combination in the target intermediate code with the compound instructions corresponding to each repeated instruction combination, wherein one repeated instruction combination in the target intermediate code corresponds to multiple compound instructions and a repeated instruction combination corresponds to different compound instructions in different orders of appearance in the target intermediate code, wherein the number of compound instructions corresponding to any repeated instruction combination does not exceed the number of appearances of any repeated instruction combination in the target intermediate code, and combining the compound instructions corresponding to each repeated instruction combination with other instructions in the target intermediate code except the repeated instruction combination according to the combination order to generate a compound intermediate code; an instruction table generating module, configured to generate a dynamic instruction operation code for each instruction in the composite intermediate code, and to generate an instruction table based on each instruction in the composite intermediate code, the dynamic instruction operation code corresponding to each instruction, and the operand, wherein different instructions have different dynamic instruction operation codes; A bytecode generation module is used to generate bytecode corresponding to the composite intermediate code based on the instruction table and the composite intermediate code.

6. A terminal device, characterized in that: comprising a processor and a memory, wherein the processor and the memory are connected to each other; The memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1 to 4.

Images