A method for concealing a secret key in a module relocation table
By splitting and hiding key data in the module relocation table, and leveraging the relocation characteristics of the relocation table, the key security problem is solved, achieving highly secure and efficient key storage and retrieval.
Patent Information
- Application Number
- CN202011299353.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-11-19
- Publication Date
- 2026-01-23
- Estimated Expiration
- 2040-11-19
AI Technical Summary
In existing technologies, the security of keys is difficult to guarantee, especially when the module's storage and file system are compromised, there is a risk of exposure.
The method of hiding the key in the module relocation table is to split the key data into strings, take advantage of the relocation characteristics of the relocation table, store the key strings between instruction codes as data intervals, and hide and look up the key through the relocation table.
It achieves highly secure key storage, avoiding the risk of exposure when the module file system is compromised, while saving data storage space, and increasing the security of searching through data transformation formulas.
Smart Images
Figure CN114519192B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of secret key encryption, in particular to a method for hiding a small amount of secret keys in a module relocation table. BACKGROUND
[0002] For many core modules, secret keys are needed to decrypt data, and the security of the secret keys is the core of the security of the secret keys. The existing scheme may be stored in the code, stored in the string table, or encrypted and stored in the file or resource file. These methods are currently well known, and the security of the secret keys has become a difficult problem. Once the database or file system where the secret keys are stored is broken, all files are at risk of exposure. Therefore, some unconventional means are needed for storage. SUMMARY
[0003] The present application provides a method for hiding secret keys in a module relocation table, which is based on the relocation feature, constructs a relocation table, and hides and stores secret key data in the relocation table, with high security.
[0004] The technical scheme provided by the present application is as follows:
[0005] A method for hiding secret keys in a module relocation table, comprising:
[0006] selecting a memory address as a starting address in the module;
[0007] generating secret key data and splitting the secret key data into secret key strings;
[0008] constructing and generating a relocation table using the starting address as a base address;
[0009] storing the secret key strings in the relocation table.
[0010] Preferably, the splitting process of the secret key data comprises the following steps:
[0011] splitting the strings contained in the secret key data into first secret key strings and second secret key strings, and splitting the first secret key strings and the second secret key strings into single characters;
[0012] wherein the number of characters contained in the secret key data is even, and the first secret key strings and the second secret key strings contain equal numbers of characters.
[0013] Preferably, the construction process of the relocation table comprises the following steps:
[0014] generating instruction codes of the relocation data, setting the secret key string as data interval between the instruction codes, and recording byte length of the instruction codes and the data interval;
[0015] setting the start offset address of the relocation data;
[0016] setting the number of the relocation data in the relocation table;
[0017] increasing code space, and storing the secret key string in the relocation table;
[0018] wherein the instruction codes are assembly codes or function calls, and the start offset address is obtained by adding the base address and module offset.
[0019] Preferably, the process of storing the secret key string in the relocation table comprises the following steps:
[0020] constructing a pointer function, and defining a string variable in the pointer function;
[0021] calculating the address of the secret key string variable in the relocation table by the virtual address of the string variable in the relocation table and the offset of the string variable in the relocation table;
[0022] modifying the offset of the string variable in the relocation table, so that the offset value corresponds to the value of the first character of the secret key string;
[0023] constructing a reference function, and referencing the string variable to generate the secret key string in the relocation table.
[0024] Preferably, the process further comprises the following steps:
[0025] reading data in the module by memory mapping, and parsing the data to obtain the start address of the relocation table;
[0026] obtaining the relocation table by the start address;
[0027] traversing the relocation table to obtain each item of stored data in the relocation table;
[0028] locating the use position of the stored data according to the stored data to determine the category of the stored data, and then finding the relocation of the secret key string in the relocation table;
[0029] increasing a reference function to introduce the relocation of the secret key character;
[0030] Continuously accessing the relocation of the secret key string for N times, and generating an access log to record the secret key string, forming a log function containing the secret key string;
[0031] The storage data category includes function address, pointer data, and secret key string address, and N is an integer greater than 1.
[0032] Preferably, the secret key string is further subjected to data conversion, and the calculation formula of the data conversion is:
[0033] offset[i+1] = i·gap+N[i]+offset[i];
[0034] Wherein, i is the i-th character in the secret key string, offset[i+1] is the offset address of the i+1-th character, gap is the minimum byte length of the instruction code, N[i] is the i-th character value, and offset[i] is the offset address of the i-th character.
[0035] Preferably, a thread execution function is further created so that the related code of the data conversion calculation formula is not called.
[0036] Preferably, the method further comprises the following steps:
[0037] Reading the data in the module and parsing the data and the relocation table;
[0038] Parsing the relocation data in the relocation table, finding the relocation data of the secret key string, and excluding the duplicate data of the secret key string;
[0039] Further parsing, calculating the corresponding single character value according to the data conversion calculation formula;
[0040] Sorting the single character value to obtain the original secret key data.
[0041] An electronic device comprising an application processor and a memory, the processor being configured to implement the steps of the method for hiding a secret key in a module relocation table.
[0042] A computer readable storage medium having stored thereon a computer management program, wherein the computer management program, when executed by a processor, implements the steps of the method for hiding a secret key in a module relocation table.
[0043] Advantages
[0044] The application provides a method for hiding a secret key in a module relocation table, splits key data into strings for storage, and constructs a relocation table based on a preset offset address and relocation characteristics, so that the strings are hidden in the storage data of the relocation table as secret key data, the storage of the secret key data can be realized by using unconventional means, the secret key data can be searched by using the offset address, and the security is high.
[0045] The application provides a construction start address of the relocation table, stores one data in each relocation cell, and realizes the hiding of the strings by putting the relocations within a certain distance range into one relocation table, so that only one relocation table is constructed, the data storage space is saved, and the relocation program does not occupy too much memory space during running.
[0046] The application further increases the security of the secret key hiding by converting the characters of the secret key data by using a data conversion formula and storing the characters of the secret key data in a disorderly manner in the relocation table. BRIEF DESCRIPTION OF DRAWINGS
[0047] Figure 1 A flowchart of the method for hiding a secret key in a module relocation table.
[0048] Figure 2 A flowchart of the construction process of the relocation table.
[0049] Figure 3 A flowchart of another embodiment of the method for hiding a secret key in a module relocation table.
[0050] Figure 4 A flowchart of distinguishing the relocation data of the module itself from the newly added secret key data.
[0051] Figure 5 A flowchart of obtaining the original secret key data from the relocated module.
[0052] Figure 6 An embodiment schematic diagram of a possible electronic device provided by the application.
[0053] Figure 7 An embodiment schematic diagram of a possible computer readable storage medium provided by the application. DETAILED DESCRIPTION
[0054] The following embodiments of the present application are described in detail by specific examples, and other advantages and effects of the present application can be easily understood by those skilled in the art from the disclosure of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.
[0055] As Figure 1 shown, based on the technical problems in the background art, the present application provides a method for hiding a secret key in a module relocation table, comprising the following steps:
[0056] Step S110, selecting a memory address as a starting address in the module;
[0057] Specifically, when a module is compiled in a compiler, a preferred loading memory starting address needs to be set. For example, the address 0x800000 is set as the starting address. When the module is loaded, the system will select a memory address according to the running environment of the module at that time, and at this time, the memory address 0x800000 may be occupied by other modules, so the system will select a new memory address to load the module. Therefore, the specific starting address of the module on each computer each time is not fixed. The starting address is set in this embodiment to facilitate subsequent secret key data storage. The specific setting method is to set the preferred base address through the compilation options of the compiler. The variable baseaddr is used as the preferred base address. In this embodiment, the preferred base address is set to fix the address of each loading, which is convenient for secret key storage and searching.
[0058] Step S120, generating secret key data and splitting the secret key data into secret key strings; the splitting process of the secret key data comprises the following steps:
[0059] The string contained in the secret key data is split into a first secret key string and a second secret key string, and the first secret key string and the second secret key string are split into single characters; wherein the number of characters contained in the secret key data is even, and the first secret key string and the second secret key string contain equal number of characters.
[0060] The specific splitting process is that the length of the secret key data is N-bit string, wherein N is even, and 32-bit secret key or 64-bit secret key is generally used. This embodiment provides a 32-bit secret key.
[0061] The secret key is a string of characters, and it is assumed that the string is "!@zBc$%d12__=... ", which is a 32-bit length string. The secret key data is split into two parts, and even numbers can be split in half.
[0062] The secret key is split into single characters, and the secret key is obtained after splitting into two strings containing single characters:
[0063] ! z c.....
[0064] @ B $....
[0065] In this embodiment, the secret key data is split into two strings, and each string is split into single characters, facilitating subsequent string storage and facilitating writing the string as a character in the instruction code, and facilitating searching for the string.
[0066] Step S130, taking the starting address as the base address, constructing and generating the relocation table;
[0067] As shown in Figure 2 , the construction of the relocation table includes the following steps:
[0068] Step S131, generating the instruction code of the relocation data, setting the secret key string between the instruction codes as the data interval, and recording the byte length of the instruction code and the data interval;
[0069] Specifically, first, the relocation table is constructed, and the relocation table stores each data that needs to be relocated. Each relocation is set according to its code in the code. The code must introduce an address access, that is, introduce a string or call a function.
[0070] For example, the call function instruction with relocation is as follows: call 0x803000, which calls a function, and the instruction length itself is 5 bytes long. And it calls a function, so the minimum function interval is 5 bytes.
[0071] Or the assembly code instruction: Push offset 0x815000, the length of the instruction itself is also 5 bytes. Push a string address into the stack. The minimum interval of the instruction is 5 bytes. If you want to push another string address, the length of the string acts as the interval of the two pushed addresses. The minimum length of a string is 2 bytes, one is the character of the string, and the other is the end symbol. In this embodiment, the secret key string is written into the instruction code as the interval of the relocation instruction, which is based on the relocation feature to hide the secret key code.
[0072] Step S132, setting the starting offset address of the relocation data, and setting the number of relocation data in the relocation table; the specific implementation code is as follows:
[0073] typedef struct IMAGE_BASE_RELOCATION {
[0074] DWORD VirtualAddress;
[0075] DWORD SizeOfBlock;
[0076] }IMAGE_BASE_RELOCATION;
[0077] VirtualAddress is the starting offset address of all relocations in a relocation table. Relocations belonging to the same VirtualAddress are close to each other. The VirtualAddress module has a relationship with the priority loading base address. The VirtualAddress is the sum of the module base address and the offset of the relocation in the module. The SizeOfBlock indicates the number of word type arrays, that is, the number of relocations. Based on the limitations of the relocation itself, the application needs to use the compiler to construct the relocation table during compilation, construct and design the relocation string and function call according to the position, so that the compiler will help generate the relocation table to store the secret key.
[0078] Step S133, increase the code space, and store the secret key string in the relocation table. The specific implementation code is as follows:
[0079] Void Function(){
[0080] Static char*data[]=“a”;
[0081] Address=VirtualAddress+offset;
[0082] Asm{
[0083] pushoffset data
[0084] call printf。}
[0085] Wherein, Function is the function name; Static char*data[]=“a” is to define the string variable in the function, if the global variable is defined in the function, only through the definition of static string variable, the effect of global variable can be realized. If the global variable is directly defined, the position of the variable cannot be determined and the position of the variable cannot be modified, therefore, the position of the static variable in the Function function can be adjusted. Address is the position of the string variable in the relocation table, VirtualAddress is the virtual address of the relocation table, and offset is the character data, offset corresponds to or is consistent with the first split character value of the key string.
[0086] If inconsistent, offset needs to be adjusted. The specific adjustment method is to write an assembly code to change the offset position.
[0087] Wherein, the instruction code is assembly code or a call function, and the starting offset address is obtained by adding the base address and the module offset.
[0088] The purpose of the embodiment is to reconstruct the relocation data and set the relocation data in the same relocation table, therefore, all the relocation data that needs to be added needs to be set in the newly added code. Even if the relocation data is consistent with the value of each key data, the key data hiding is realized, in order to match the value of the key, the relocation needs to constantly match the code, and the relocation data is consistent with the value of each key data.
[0089] The embodiment uses assembly code to write new code space. The purpose is that the assembly code is convenient to match each byte of code, and any code other than the assembly code needs to be compiled by the compiler, so that the specific position and offset after compilation cannot be controlled, therefore, using the assembly code can more conveniently and accurately control the position of the relocation.
[0090] Step S140, the key string is stored in the relocation table. In the embodiment, each relocation stores a character key.
[0091] The data in the relocation table and the entire module size of the program module have a certain relationship, therefore, the data stored in the relocation should not be too large, and the too large will cause the additional code in the module to be large. In the embodiment, only one data is stored in each relocation. The relocation table will put the relocations within a certain distance range into one relocation table.
[0092] As Figure 3As shown in another embodiment, the distinguishing module itself further includes relocation data and newly added key data, and the implementation step is: step S150, marking a data interval to distinguish the relocation data and the newly added key data. The specific implementation step is:
[0093] As shown in another embodiment, the distinguishing module itself further includes relocation data and newly added key data, and the implementation step is: step S150, marking a data interval to distinguish the relocation data and the newly added key data. The specific implementation step is: Figure 4 As shown in another embodiment, the distinguishing module itself further includes relocation data and newly added key data, and the implementation step is: step S150, marking a data interval to distinguish the relocation data and the newly added key data. The specific implementation step is:
[0094] Step S152, obtaining the storage data of the relocation table through the starting address. The starting address of the relocation table is set as a selected memory address in step S110, and the storage data of the relocation table stored at the corresponding address can be obtained according to the starting address;
[0095] Step S153, traversing the relocation table to obtain each item of storage data in the relocation table, and positioning the use position of the storage data according to the storage data to determine the category of the storage data, wherein the category of the storage data includes a function address, pointer data and a key string address, and then the relocation of the key string in the relocation table is found;
[0096] The specific process is: obtaining the data of each item of the relocation table, and based on each item of the data of the relocation table, the position used in the code can be back-positioned, so that it can be known according to the assembly code whether the current relocation is a function address, a global pointer data or a global string address. The first string in the relocation table is found through traversal.
[0097] Step S154, adding a reference type function to introduce the relocation of the key string; the key string is introduced by creating a function, which improves the copying efficiency.
[0098] The specific implementation process is: the relocation of the first string is found, and a reference type function is added at the end of the module function, which needs to introduce the string found in step S153.
[0099] Step S155, continuously access the relocation of the secret key string for N times, and generate an access log to record the secret key string, to form a log function containing the secret key string; N is an integer greater than 1.
[0100] Specifically, the secret key string needs to be accessed for multiple times, and the multiple times are continuous. The multiple times of accessing the secret key string are added to mark the end position of the original relocation of the module as a relocation mark, because the tail of the module is at the end of the relocation table.
[0101] As a preferred, the access times are 3 times, and the purpose of repeatedly introducing the same secret key string for 3 times is to facilitate distinguishing the end position from the relocation table. Using 2 times is easy to conflict with other normal codes.
[0102] Specifically, the process of introducing the secret key string for 3 times is to create a log print function, and the secret key string needs to be printed for 3 times, so that the log(“%s%s%s\n”,s,s,s) is generated for 3 times. The log is a print log function, s is the secret key string, and the secret key string is printed for 3 times, so that the secret key string is applied for 3 times continuously. The secret key string is selected in the embodiment, and the secret key string is more easily found than other addresses or function calls, and it is easy to construct repeated calls as the end of the original relocation of the module.
[0103] In another embodiment, each secret key needs to be converted, and each character is stored by using the relocation of the secret key string or the relocation of the function. The calculation formula of the data conversion is:
[0104] offset[i+1]=i·gap+N[i]+offset[i];
[0105] Wherein, i is the i-th character in the secret key string, offset[i+1] is the offset address of the i+1-th character, gap is the minimum byte length of the instruction code, N[i] is the value of the i-th character, and offset[i] is the offset address of the i-th character. Specifically, for the application of the function, the following assembly code is written to implement:
[0106] Asm{
[0107] Call func;
[0108] Func=baseaddr+VirtualAddress+offset
[0109] }
[0110] Wherein, func is the function to be called, the offset to be filled in directly is the offset to be calculated according to the secret key, and the function call does not need to be repeatedly adjusted, and the value calculated according to the secret key can be directly filled in after the call. The offset can be directly equal to the secret key value.
[0111] The secret key data is further hidden through data conversion, and the security of the secret key data is increased.
[0112] In another embodiment, a thread execution function is further created so that the code related to the data conversion calculation formula is not called.
[0113] Specifically, since the above code itself is for splicing the relocation, it cannot be executed, and therefore a function that can reference the code without executing the code needs to be designed, and the following code is written in the module function:
[0114] A variable is constructed to obtain the current process id = GetCurrentProcessId(), and if the process id is 0, a thread is created and the system function CreateThread(Function) is used to create, wherein the core parameter is the thread execution function, and the thread function is the func function. Since the process id cannot be 0, the code will not be executed. Therefore, the func function is applied and the func function will never be called. A thread execution function is created so that the code related to the data conversion calculation formula is not called, which can further ensure the security of the secret key and avoid incorrect execution of the secret key data when other programs are executed, so as to prevent the secret key from being leaked.
[0115] As shown in FIG. 8, in another embodiment, a module resolution based on relocation is further included, that is, the original secret key data is resolved, and specifically includes the following steps: Figure 5
[0116] Step S210, reading the data in the module and resolving the data and the relocation table;
[0117] Firstly, the module file needs to be read into the memory and parsed according to the steps S151 described above, and the relocation table is parsed, that is, the data in the module is read through the memory mapping, and the data is parsed to obtain the starting address of the relocation table; specifically, the module file is read according to the PE file format of the module and uses the memory, as a preferred, the file is read through the memory mapping, without modifying the memory offset and file offset data. That is, the module file is read into the memory through the system functions CreateFileMapping and MapViewOfFile. The header file format of the PE file is parsed, including the data format of PIMAGE_DOS_HEADER header and PIMAGE_NT_HEADERS header. The starting address of the relocation table can be obtained from the data of PIMAGE_NT_HEADERS header.
[0118] The storage data of the relocation table is obtained through the starting address; the storage data in the relocation table is traversed; and according to the storage data, the use position of the storage data is located to determine the category of the storage data, wherein the storage data category includes: function address, pointer data and secret key string address, and then the relocation of the secret key string in the relocation table is found.
[0119] Step S220, parse the relocation data in the relocation table, find the relocation data of the secret key string, and exclude the duplicate data of the secret key string;
[0120] Specifically, based on the original relocation data of the module set in advance, the relocation of the first string in the relocation table is found, and then the existence of the relocation of the same three consecutive strings in the relocation table is found, which is the end position of the original relocation of the module. The relocations after the end in the module are parsed, and these relocations are all secret key data filled, and these secret key data are references of a large number of relocation codes, so that the relocation data is generated by the compiler when the module is compiled.
[0121] Step S230, further parsing, calculating the corresponding single character value according to the data conversion formula; offset[i+1]=i·gap+N[i]+offset[i];
[0122] Wherein, i is the i-th character in the secret key string, offset[i+1] is the offset address of the i+1-th character, gap is the minimum byte length of the instruction code, N[i] is the i-th character value, offset[i] is the offset address of the i-th character, and finally the values of N[0] to N[i] are obtained through calculation, which are the original secret key data.
[0123] Step S240, sorting the single character value to obtain the original secret key data. In the beginning, the secret key can be scattered or rearranged according to various algorithms, so that the order of the secret key is disordered. After the data is taken out from the relocation, the original secret key data is sorted back.
[0124] By reading the data in the module and analyzing the data and the relocation table, the original secret key can be parsed. When the secret key needs to be used or interpreted, the original secret key can be found in the table according to the relocation feature.
[0125] In another embodiment, an electronic device is also provided, which includes an application processor and a memory, and the processor is configured to implement the steps of the method for hiding a secret key in a module relocation table implemented by a computer program stored in the memory.
[0126] As shown in Figure 6 , it is an embodiment schematic diagram of the electronic device provided by the present application.
[0127] In another embodiment, the present application also provides an electronic device, which includes a memory 410, a processor 420, and a computer program 411 stored in the memory 420 and executable on the processor 420, and the processor 420 implements the following steps when executing the computer program 411.
[0128] Selecting a memory address in the module as a starting address;
[0129] Generating secret key data and splitting the secret key data into secret key strings;
[0130] Taking the starting address as a base address, constructing and generating a relocation table;
[0131] Storing the secret key strings in the relocation table.
[0132] In the specific implementation process, the processor 420 executing the computer program 411 can implement Figure 1 any of the embodiments of the corresponding embodiments.
[0133] Since the electronic device introduced in the present embodiment is the device used to implement the method for hiding a secret key in a module relocation table in the present application, based on the method introduced in the present application, those skilled in the art can understand the specific implementation of the electronic device of the present embodiment and its various forms, so the method of how the electronic device implements the method in the present application will not be introduced in detail, as long as the device used by those skilled in the art to implement the method in the present application belongs to the scope of the present application.
[0134] As shown in Figure 7 ,Figure 7 An embodiment of a computer readable storage medium provided in the present application is shown in the figure.
[0135] The embodiment provides a computer readable storage medium 500, and the computer readable storage medium 500 stores a computer program 511. The computer program 511 is executed by a processor to implement the following steps.
[0136] An address in the module is selected as a start address;
[0137] Key data is generated, and the key data is split into a key string;
[0138] The start address is used as a base address, and a relocation table is constructed and generated;
[0139] The key string is stored in the relocation table. In a specific implementation process, the computer program 511 is executed by the processor to implement Figures 1-2 Any implementation in the corresponding embodiment.
[0140] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in an embodiment can be referred to the related description of other embodiments.
[0141] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.
[0142] The present application is described with reference to flowcharts and / or block diagrams according to the method, device (system), and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices produce a machine that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The device that implements the functions specified in one block or multiple blocks.
[0143] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or multiple blocks.
[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions executed on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or multiple blocks.
[0145] The embodiments of the present application also provide a computer program product, which includes computer software instructions, when the computer software instructions are run on a processing device, cause the processing device to execute the flow Figures 1-2 in the method for designing a wind farm digitalization platform in the corresponding embodiments.
[0146] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function described in the embodiments of the present application is produced. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be stored by the computer or the data storage device such as server, data center, etc. integrated with one or more available media sets. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk (SSD)) and the like.
[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.
[0148] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.
[0149] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units. That is, they can be located in one place, or can also be distributed on a plurality of network units. In actual implementation, some or all of the units can be selected according to the actual needs to achieve the purposes of the embodiments.
[0150] In addition, each functional unit in the embodiments of the present application can be integrated in a processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of software functional units.
[0151] When the integrated unit is implemented in the form of software functional units and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially, or the part that contributes to the prior art, or all or a part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various other media that can store program codes.
[0152] The technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will all fall within the protection scope of the present application.
Claims
1. A method for hiding a key in a module relocation table, characterized in that, include: Select a memory address as the starting address within the module; Generate key data and split the key data into key strings; Using the starting address as the base address, construct and generate a relocation table; The key string is stored in the relocation table. The process of splitting the key data includes the following steps: The string contained in the key data is split into a first key string and a second key string, and the first key string and the second key string are split into individual characters; Wherein, the key data contains an even number of characters, and the first key string and the second key string contain an equal number of characters; The process of constructing the relocation table includes the following steps: Generate instruction code for relocation data, set the key string between the instruction code as a data interval, and record the byte length of the instruction code and the data interval; Set the starting offset address of the relocation data; Set the number of relocation data items in the relocation table; Increase code space and store the key string in the relocation table; The instruction code is assembly code or a function call, and the starting offset address is obtained by adding the base address to the module offset.
2. The method for hiding a key in a module relocation table according to claim 1, characterized in that, The process of storing the key string in the relocation table includes the following steps: Construct a pointer function, and define a string variable within the pointer function; The address of the string variable in the relocation table is calculated using the virtual address of the string variable in the relocation table and the offset of the string variable in the relocation table; Modify the offset of the string variable in the relocation table so that the offset value corresponds to the value of the first character of the key string; Construct a reference function that references the string variable to generate the key string in the relocation table.
3. The method for hiding the key in the module relocation table according to claim 2, characterized in that, It also includes the following steps: Data within the module is read through memory mapping and parsed to obtain the starting address of the relocation table; The relocation table is obtained using the starting address; Traverse the relocation table to obtain each stored data item in the relocation table; Based on the stored data, locate the usage location of the stored data to determine the category of the stored data, and then find the relocation of the key string in the relocation table; Add a reference function to introduce the relocation of the key characters; continuous The function relocates the key string and generates an access log, recording the key string to form a log function containing the key string. The stored data categories include: function addresses, pointer data, and key string addresses; It belongs to an integer greater than 1.
4. The method for hiding the key in the module relocation table according to claim 3, characterized in that, It also includes data conversion of the key string, and the calculation formula for the data conversion is: ； in, For the first part of the key string One character, For the first The offset address of each character. The minimum byte length of the instruction code. For the first Character value, For the first The offset address of each character.
5. The method for hiding a key in a module relocation table according to claim 4, characterized in that, It also includes creating a thread execution function so that the code related to the data conversion calculation formula is not called.
6. The method for hiding a key in a module relocation table according to claim 5, characterized in that, It also includes the following steps: Read the data within the module and parse the data and the relocation table; Parse the relocation data in the relocation table, find the relocation data of the key string, and exclude duplicate data of the key string; Further analysis reveals that the corresponding single character value is calculated based on the data conversion calculation formula. The original key data is obtained by sorting the individual character values.
7. An electronic device comprising an application processor and a memory, characterized in that, The processor is used to implement the steps of the method for hiding the key in the module relocation table as described in any one of claims 1-6 when implementing the computer management program stored in the memory.
8. A computer-readable storage medium storing computer management programs thereon, characterized in that, When the computer management program is executed by the processor, it implements the steps of the method for hiding the key in the module relocation table as described in any one of claims 1-6.