Code obfuscation method, apparatus, device, medium, and program product

Abstract

This disclosure provides a code obfuscation method applicable to the field of information security technology. The method includes: obtaining a first function to be obfuscated and a second function to be obfuscated; performing a first obfuscation process on the first function to be obfuscated to obtain a first code fragment, wherein the first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated; performing a second obfuscation process on the second function to be obfuscated to obtain a second code fragment, wherein the second obfuscation process includes rewriting the call relationships of the second function to be obfuscated; and obtaining obfuscated code after the first and second functions to be obfuscated have completed their respective obfuscation processes. This disclosure also provides a code obfuscation apparatus, device, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, specifically the field of information security technology, and more specifically to a code obfuscation method, apparatus, device, medium, and program product. Background Technology

[0002] With the rapid development of application software reverse engineering and decompilation technologies, malicious actors can use these techniques to debug and analyze released application code, steal core software algorithms, discover software vulnerabilities, and even repackage and resell them. Using code obfuscation techniques to prevent software from being maliciously cracked by unauthorized users is a very effective method. However, current technologies often increase the difficulty of decompilation while also causing errors. Furthermore, existing code obfuscation methods have poor compatibility with operating systems.

[0003] Therefore, how to increase the difficulty of deobfuscation and ensure the security of application code while ensuring the normal operation of the program and compatibility with the operating system is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of the above problems, this disclosure provides code obfuscation methods, apparatus, devices, media and program products that improve scenario compatibility and deobfuscation difficulty.

[0005] According to a first aspect of this disclosure, a code obfuscation method is provided, comprising: obtaining a first function to be obfuscated and a second function to be obfuscated; performing a first obfuscation process on the first function to be obfuscated to obtain a first code fragment, the first obfuscation process including rewriting the function content and call relationships of the first function to be obfuscated; performing a second obfuscation process on the second function to be obfuscated to obtain a second code fragment, the second obfuscation process including rewriting the call relationships of the second function to be obfuscated; and obtaining obfuscated code after the first function to be obfuscated and the second function to be obfuscated have completed their respective obfuscation processes.

[0006] According to embodiments of this disclosure, obtaining the first function to be obfuscated and the second function to be obfuscated includes: filtering out the first function to be obfuscated and the second function to be obfuscated by character regular expression matching based on a preset list of key functions.

[0007] According to embodiments of this disclosure, performing a first obfuscation process on the first function to be obfuscated to obtain a first code fragment includes: extracting function content from the first function to be obfuscated, the function content including function logic body information; performing a rewriting operation on the function logic body information using the syntax of a scripting language to obtain a first script fragment; traversing the first call points in the code to be obfuscated that call the first function to be obfuscated; replacing the first function to be obfuscated at the first call point with the first script fragment; and transforming the call relationship of the first call point into a reflection call to obtain the first code fragment.

[0008] According to an embodiment of this disclosure, after rewriting the function logic body information using the syntax of a scripting language to obtain a first script fragment, the method further includes: encrypting the first script fragment based on a preset first encryption algorithm to obtain an encrypted first script fragment.

[0009] According to an embodiment of this disclosure, performing a second obfuscation process on the second function to be obfuscated to obtain a second code fragment includes: identifying the function call relationship of the second function to be obfuscated; and modifying it using corresponding reflection call modification methods based on different function call relationships to obtain the second code fragment.

[0010] According to an embodiment of this disclosure, after the second code segment is obtained by modifying it using corresponding reflection call modification methods based on different function call relationships, the method further includes: extracting a first keyword involved in the reflection call; encrypting the first keyword based on a preset second encryption algorithm to obtain a second keyword; and adding a decryption function call based on the decryption algorithm corresponding to the preset second encryption algorithm, wherein the decryption function call is used to decrypt the second keyword when the second code segment is run.

[0011] A second aspect of this disclosure provides a code obfuscation apparatus, comprising: a function to be obfuscated acquisition module, a first obfuscation processing module, a second obfuscation processing module, and an obfuscated code acquisition module, wherein the function to be obfuscated acquisition module is used to acquire the first function to be obfuscated and the second function to be obfuscated;

[0012] The first obfuscation module is used to perform a first obfuscation process on the first function to be obfuscated to obtain a first code fragment, wherein the first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated; the second obfuscation module is used to perform a second obfuscation process on the second function to be obfuscated to obtain a second code fragment, wherein the second obfuscation process includes rewriting the call relationships of the second function to be obfuscated; and the obfuscated code acquisition module is used to obtain obfuscated code after the first function to be obfuscated and the second function to be obfuscated have completed the corresponding obfuscation processes.

[0013] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the code obfuscation method described above.

[0014] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the code obfuscation method described above.

[0015] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described code obfuscation method. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of code obfuscation methods, apparatus, devices, media, and program products according to embodiments of the present disclosure.

[0018] Figure 2 A flowchart illustrating a code obfuscation method according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 3A A flowchart illustrating a first obfuscation processing method according to an embodiment of the present disclosure is shown schematically.

[0020] Figure 3B A flowchart illustrating another first obfuscation processing method according to an embodiment of the present disclosure is shown schematically.

[0021] Figure 4A A flowchart illustrating a second obfuscation processing method according to an embodiment of the present disclosure is shown.

[0022] Figure 4B A flowchart illustrating another second obfuscation processing method according to an embodiment of this disclosure is shown schematically.

[0023] Figure 5 A schematic block diagram of a code obfuscation apparatus according to an embodiment of the present disclosure is shown.

[0024] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a code obfuscation method according to an embodiment of the present disclosure. Detailed Implementation

[0025] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B, and C", the expression should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0029] The following provides a detailed explanation of the technologies involved in the embodiments of this disclosure:

[0030] C++: An object-oriented programming language.

[0031] Java: An object-oriented programming language.

[0032] JavaScript: A widely popular scripting language.

[0033] Ruby: A scripting language created for simple and fast object-oriented programming.

[0034] Hypertext preprocessor (Personal Home Page, abbreviated as PHP): a server-side scripting language with object-oriented concepts.

[0035] Regular expressions: also known as rule expressions, are commonly used to search for and replace text that matches a certain rule.

[0036] Regular expression matching: A matching rule that uses regular expressions for matching.

[0037] Reflection: A mechanism for dynamically acquiring information and dynamically invoking object methods.

[0038] Code obfuscation: Any method that increases the difficulty of decompiling and allows manipulation of code can be called code obfuscation.

[0039] In existing technologies, traditional code obfuscation methods based on character replacement may cause anomalies in functions such as reflection and class loading; while content-based obfuscation does not directly hide function call relationships, but only increases the complexity of function calls. Consequently, white-box analysis tools can still reconstruct the program call flow and thus achieve vulnerability analysis. In addition, obfuscation methods based on Java Native Interface (JNI) lack good operating system compatibility.

[0040] To address the technical problems existing in the prior art, embodiments of this disclosure provide a code obfuscation method, comprising: obtaining a first function to be obfuscated and a second function to be obfuscated; performing a first obfuscation process on the first function to be obfuscated to obtain a first code fragment, wherein the first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated; performing a second obfuscation process on the second function to be obfuscated to obtain a second code fragment, wherein the second obfuscation process includes rewriting the call relationships of the second function to be obfuscated; and obtaining obfuscated code after the first function to be obfuscated and the second function to be obfuscated have completed their respective obfuscation processes.

[0041] In the embodiments of this disclosure, critical first functions to be obfuscated and non-critical functions to be obfuscated are selected. The function content and call relationships of the first functions to be obfuscated are obfuscated, so that important functions are obfuscated in both content and call relationships, while non-critical second functions to be obfuscated only have their call relationships modified, reducing the workload. At the same time, appropriately rewriting the call relationships can reduce the occurrence of abnormal situations during program execution, enabling the program to run normally.

[0042] Figure 1 The diagram illustrates an application scenario of the code obfuscation method according to an embodiment of the present disclosure.

[0043] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, network 104, and server 105. Network 104 is used as a medium to provide a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0044] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0045] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0046] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0047] It should be noted that the code obfuscation method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the code obfuscation device provided in this disclosure embodiment can generally be located in server 105. The code obfuscation method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the code obfuscation device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0048] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0049] The following will be based on Figure 1 The described scene, through Figures 2 to 4B The code obfuscation method of the disclosed embodiments is described in detail.

[0050] Figure 2 A flowchart illustrating a code obfuscation method according to an embodiment of the present disclosure is shown schematically.

[0051] like Figure 2 As shown, the code obfuscation method of this embodiment includes operations S210 to S240, and the code obfuscation method can be executed by server 105.

[0052] In operation S210, the first function to be obfuscated and the second function to be obfuscated are obtained.

[0053] Specifically, the first function to be obfuscated is a function with high security requirements. This first function can be considered a core function, which is highly related to the business strategy. Different business strategies have different core functions. For example, the first function to be obfuscated includes at least: encryption / decryption functions, configuration functions, and access control functions. The second function to be obfuscated can be considered a non-core function. Similarly, this non-core function is highly related to the business strategy. Different business strategies have different non-core functions. For example, the second function to be obfuscated includes at least: request receiving functions, page rendering functions, and attribute assignment functions.

[0054] According to embodiments of this disclosure, obtaining the first function to be obfuscated and the second function to be obfuscated includes: filtering the first function to be obfuscated and the second function to be obfuscated by character regular expression matching based on a preset list of key functions.

[0055] Specifically, the system uses regular expression matching to identify a user-configured list of functions to be obfuscated. A function can be identified by its basic information, including the class name, function name, and parameter types. In other words, the corresponding function can be found by determining the class name, function name, and parameter types. Therefore, based on the pre-defined list of key functions, the system quickly and comprehensively filters out the first and second functions to be obfuscated using regular expression matching.

[0056] In operation S220, a first obfuscation process is performed on the first function to be obfuscated to obtain a first code fragment. The first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated.

[0057] In operation S230, a second obfuscation process is performed on the second function to be obfuscated to obtain a second code fragment. The second obfuscation process includes rewriting the call relationship of the second function to be obfuscated.

[0058] It should be noted that, in the embodiments of this disclosure, the first function to be obfuscated can be considered the core function of the code segment to be obfuscated, while the second function to be obfuscated is a non-core function. Therefore, different obfuscation processes are used for the core function and the non-core function. For the first function to be obfuscated, not only is its call relationship modified, but its function content is also modified. The function content of the first function to be obfuscated is rewritten into a scripting language, and then the call relationship of the call points of the first function to be obfuscated is rewritten as a reflection call. For the second function to be obfuscated, its call relationship is directly rewritten as a reflection call.

[0059] In operation S240, after the first and second functions to be obfuscated have completed their respective obfuscation processes, the obfuscated code is obtained.

[0060] Specifically, the first and second functions to be obfuscated include multiple functions. The number of functions to be obfuscated can be set based on the specific scenario. For example, a portion of the first and second functions to be obfuscated can be selected for obfuscation. Alternatively, all of the first and all of the second functions to be obfuscated can be selected for obfuscation. Further details are omitted here.

[0061] It should be noted that, in the embodiments of this disclosure, the code to be obfuscated can be written in a programming language, especially an object-oriented programming language. For example, the object-oriented programming language can be a commonly used object-oriented programming language such as Java or C++. The content rewritten in the first obfuscation process can be rewritten in a scripting language, and the scripting language can be any scripting language. For example, it can be a commonly used scripting language such as JavaScript, Ruby, and PHP.

[0062] In the embodiments of this disclosure, critical first functions to be obfuscated and non-critical functions to be obfuscated are selected. The function content and call relationships of the first functions to be obfuscated are obfuscated, so that important functions are obfuscated in both content and call relationships, while non-critical second functions to be obfuscated only have their call relationships modified, reducing the workload. At the same time, appropriately rewriting the call relationships can reduce the occurrence of abnormal situations during program execution, enabling the program to run normally.

[0063] Figure 3A A flowchart illustrating a first obfuscation processing method according to an embodiment of the present disclosure is shown.

[0064] like Figure 3A As shown, the first obfuscation processing method in this embodiment corresponds to operation S220, which includes operations S310 to S350.

[0065] In operation S310, the function content of the first function to be obfuscated is extracted, and the function content includes function logic body information.

[0066] In operation S320, the function logic body information is rewritten using the syntax of a scripting language to obtain the first script fragment.

[0067] Specifically, based on the extracted logical body information from the first function to be obfuscated, this logical body information can be understood as the code used to implement the function's functionality. This code is written in the syntax of the original programming language and then rewritten in the syntax of a scripting language. For example, based on the syntax of the JavaScript scripting language, the function in the Java language is rewritten to obtain the first JavaScript script fragment.

[0068] It should be noted that because the function content of the first function to be obfuscated has undergone script syntax conversion, the resulting first script fragment exists in text form. Text data can exist on different operating systems, which improves the generality of the code obfuscation method disclosed herein and gives it a wide range of applications. Meanwhile, existing analysis tools are mostly designed for common programming languages ​​such as Java. After the key function is converted into JavaScript, there is a lack of analysis tools for such scripting languages, which to some extent increases the difficulty of decompilation.

[0069] In operation S330, the first call point of the first function to be obfuscated is called in the code to be obfuscated.

[0070] In operation S340, the first function to be obfuscated at the first call point is replaced with the first script fragment.

[0071] In operation S350, the call relationship of the first call point is transformed into a reflection call to obtain the first code fragment.

[0072] According to embodiments of this disclosure, a preset parameter passing function is used to perform parameter passing between the first script fragment and the code to be obfuscated.

[0073] Specifically, in a Java implementation, the parameter passing function between the first source function and the first code snippet can be, for example, `engine.put("name", "value")` to input the value information, and `engine.get("output")` to retrieve the script execution result. Here, `engine` is a Java class that includes the `put` and `get` functions. The `put` function is used to pass input parameters from the Java language to the JavaScript script, and after the JavaScript script executes its corresponding logic, the execution result is returned to the Java language via the `get` function.

[0074] For a simple example, in a real-time Java scenario, the first function to be obfuscated is the `add(Integer a, Integer b)` method of the `Add` class:

[0075]

[0076] The method body (i.e., function logic information) of the above add(Integer a, Integer b) is rewritten as the following first script snippet (taking JavaScript as an example):

[0077] var org; function add(a, b){return a+b+org}

[0078] Furthermore, all instances in the code to be obfuscated that call the `add(Integer a, Integer b)` method of the `Add` class are rewritten as reflection calls in the following form:

[0079] In the embodiments of this disclosure, the content of the critical first function to be obfuscated is rewritten in a scripting language, enabling the rewritten function to run on multiple systems and greatly improving code compatibility. Furthermore, the call point that invokes this function is identified and transformed into a reflection call, increasing the difficulty of code reading and significantly enhancing the difficulty of code decompilation. Simultaneously, the reflection call itself can reduce the error rate of program execution.

[0080] Figure 3B A flowchart illustrating another first obfuscation processing method according to an embodiment of the present disclosure is shown schematically.

[0081] like Figure 3B As shown, another first obfuscation processing method in this embodiment, in addition to operations S310 to S350, also includes operation S360. Operation S360 is executed after operation S320.

[0082] During operation S360, the first script fragment is encrypted based on a preset first encryption algorithm to obtain the encrypted first script fragment.

[0083] Specifically, the preset first encryption algorithm can be any existing encryption algorithm, and the first script fragment is encrypted using this first encryption algorithm. It is understood that the first script fragment is treated as a piece of text and symbols, and the encryption process is applied to it. During normal code execution, the key is obtained to decrypt the encrypted first script fragment.

[0084] In the embodiments of this disclosure, script fragments are encrypted to ensure data security, making them difficult to decompile without obtaining the key.

[0085] Figure 4A A flowchart illustrating a second obfuscation processing method according to an embodiment of the present disclosure is shown.

[0086] like Figure 4A As shown, the corresponding operation S230 of the second obfuscation processing method in this embodiment includes: operation S410 to operation S420.

[0087] In operation S410, the function call relationship of the second function to be obfuscated is identified.

[0088] In operating S420, the second code snippet is obtained by modifying it using corresponding reflection call modification techniques based on different function call relationships.

[0089] According to embodiments of this disclosure, the function call relationships include parameterless constructor calls, parameterized constructor calls, static function calls, non-static function calls, and reflection calls.

[0090] Specifically, the corresponding reflection call modification methods differ for different call relationships and have different syntax in different programming languages.

[0091] Taking the Java implementation environment as an example, the parameterless constructor call is transformed into `Class.forName("ClassName").newInstance()`, and the parameterized constructor call is transformed into `Class.forName("ClassName").getConstructor(parameter type).newInstance(parameter value)`. Static function calls are transformed into `Class.forName("ClassName").getDeclaredMethod("function name", parameter type).invoke(null, parameter value)`. Non-static function calls are transformed into `Class.forName("ClassName").getDeclaredMethod("function name", parameter type).invoke(class object, parameter value)`. For calls that are inherently reflection-based, no modification to the function call structure is performed.

[0092] For example, taking the `eatFood` function as an example, the process of obfuscating this function includes: First, extracting the function call history of the `eatFood` function; two call relationships can be extracted: 1. `new Food()`, which calls the parameterless constructor of the `Food` class; 2. `food.eated("mearat")`, which calls the non-static function `eated(String)` of the `Food` class. Then, appropriate rules are applied to modify the reflection call.

[0093]

[0094] It should be noted that when operating S340, it is not necessary to identify the function call relationship when modifying the call relationship. The reason is that when the call relationship of the called point is a script, it does not belong to any of the call methods of parameterless constructor call, parameterized constructor call, static function call, non-static function call, and reflection call. It can be directly converted into reflection call.

[0095] In the embodiments of this disclosure, only the calling relationship of the non-critical second function to be obfuscated is modified. Without being converted into a script, the calling relationship needs to be identified. Different modification methods are used for different calling relationships. Modifying it into a reflection call increases the difficulty of reading the code and greatly increases the difficulty of decompiling the code. At the same time, the reflection call itself can also reduce the error rate of the program.

[0096] Figure 4B A flowchart illustrating another second obfuscation processing method according to an embodiment of this disclosure is shown schematically.

[0097] like Figure 4B As shown, another second obfuscation processing method in this embodiment processes operations S410 to S420, and further includes operations S430 to S450. Operations S430 to S450 are executed after operation S420.

[0098] When operating S430, extract the first keyword involved in the reflection call.

[0099] According to embodiments of this disclosure, the first keyword includes class name, function name, and character parameter.

[0100] In operation S440, the first keyword is encrypted based on a preset second encryption algorithm to obtain the second keyword.

[0101] Specifically, the preset second encryption algorithm can be any existing encryption algorithm. The first keyword is encrypted using the second encryption algorithm, that is, the class name, function name and character parameter are encrypted respectively to obtain the encrypted class name, encrypted function name and encrypted character parameter.

[0102] In operation S450, a decryption function call is added based on the decryption algorithm corresponding to the preset second encryption algorithm. The decryption function call is used to decrypt the second keyword when running the second code segment.

[0103] Specifically, decryption can be completed once the relevant key is obtained.

[0104] For example, taking the `eatFood` function mentioned above as an example, the encrypted code is as follows:

[0105] In the embodiments disclosed herein, in addition to modifying the function call structure, ciphertext substitution is performed on class names, function names, and character parameters involved in reflection. The first key is encrypted and hidden, preventing users without the key from running the program normally. For legitimate users who possess the correct key, it significantly increases the difficulty of their deobfuscation analysis, effectively ensuring the security of the application code when it is output externally. A decryption function call is added after substitution to ensure the normal operation of the functions.

[0106] Based on the above code obfuscation method, this disclosure also provides a code obfuscation device. The following will be combined with... Figure 5 The device is described in detail.

[0107] Figure 5 A schematic block diagram of a code obfuscation apparatus according to an embodiment of the present disclosure is shown.

[0108] like Figure 5 As shown, the code obfuscation device 500 of this embodiment includes a function acquisition module 510 to be obfuscated, a first obfuscation processing module 520, a second obfuscation processing module 530, and an obfuscated code acquisition module 540, wherein,

[0109] The function acquisition module 510 is used to acquire a first function to be obfuscated and a second function to be obfuscated. In one embodiment, the function acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0110] The first obfuscation module 520 is used to perform a first obfuscation process on the first function to be obfuscated to obtain a first code fragment. The first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated. In one embodiment, the first obfuscation module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0111] The second obfuscation module 530 is used to perform a second obfuscation process on the second function to be obfuscated to obtain a second code fragment. The second obfuscation process includes rewriting the call relationship of the second function to be obfuscated. In one embodiment, the second obfuscation module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0112] The obfuscated code acquisition module 540 is used to obtain obfuscated code after the first function to be obfuscated and the second function to be obfuscated have completed the corresponding obfuscation processing. In one embodiment, the obfuscated code acquisition module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0113] In the embodiments of this disclosure, critical first functions to be obfuscated and non-critical functions to be obfuscated are selected. The function content and call relationships of the first functions to be obfuscated are obfuscated, so that important functions are obfuscated in both content and call relationships, while non-critical second functions to be obfuscated only have their call relationships modified, reducing the workload. At the same time, appropriately rewriting the call relationships can reduce the occurrence of abnormal situations during program execution, enabling the program to run normally.

[0114] According to embodiments of this disclosure, any plurality of modules among the function acquisition module 510, the first obfuscation processing module 520, the second obfuscation processing module 530, and the obfuscated code acquisition module 540 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the function acquisition module 510, the first obfuscation processing module 520, the second obfuscation processing module 530, and the obfuscated code acquisition module 540 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the obfuscated function acquisition module 510, the first obfuscation processing module 520, the second obfuscation processing module 530, and the obfuscated code acquisition module 540 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0115] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a code obfuscation method according to an embodiment of the present disclosure.

[0116] like Figure 6As shown, an electronic device 600 according to an embodiment of this disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0117] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0118] According to embodiments of this disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0119] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0120] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0121] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0122] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0123] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0124] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0125] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0128] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A code obfuscation method, characterized in that, include: Obtain the first and second functions to be obfuscated; Perform a first obfuscation process on the first function to be obfuscated to obtain a first code fragment. The first obfuscation process includes rewriting the function content and call relationships of the first function to be obfuscated. Specifically, performing the first obfuscation process on the first function to be obfuscated to obtain the first code fragment includes: extracting the function content from the first function to be obfuscated, the function content including function logic body information; performing a rewriting operation on the function logic body information using the syntax of a scripting language to obtain a first script fragment; traversing the first call points in the code to be obfuscated that call the first function to be obfuscated; replacing the first function to be obfuscated at the first call point with the first script fragment; and transforming the call relationships of the first call points into reflection calls to obtain the first code fragment. Perform a second obfuscation process on the second function to be obfuscated to obtain a second code snippet. The second obfuscation process includes rewriting the call relationships of the second function to be obfuscated; and After the first and second functions to be obfuscated have completed their respective obfuscation processes, the obfuscated code is obtained.

2. The method according to claim 1, characterized in that, The process of obtaining the first and second functions to be obfuscated includes: Based on a pre-defined list of key functions, the first function to be obfuscated and the second function to be obfuscated are selected by character regular expression matching.

3. The method according to claim 1, characterized in that, After rewriting the function logic body information using the syntax of a scripting language to obtain the first script fragment, the method further includes: The first script fragment is encrypted using a preset first encryption algorithm to obtain the encrypted first script fragment.

4. The method according to claim 1, characterized in that, The second obfuscation process is performed on the second function to be obfuscated to obtain a second code fragment, including: Identify the function call relationships of the second function to be obfuscated; The second code snippet is obtained by modifying the code using corresponding reflection call techniques based on different function call relationships.

5. The method according to claim 4, characterized in that, After modifying the code snippet using corresponding reflection call modification techniques based on different function call relationships to obtain the second code snippet, the method further includes: Extract the first keyword involved in reflection calls; The first keyword is encrypted using a preset second encryption algorithm to obtain the second keyword; and A decryption function call is added based on the decryption algorithm corresponding to the preset second encryption algorithm. The decryption function call is used to decrypt the second keyword when the second code segment is run.

6. A code obfuscation device, characterized in that, include: The module includes a function to be obfuscated acquisition module, a first obfuscation processing module, a second obfuscation processing module, and an obfuscated code acquisition module, among which, The module for obtaining the function to be obfuscated is used to obtain the first function to be obfuscated and the second function to be obfuscated. The first obfuscation module is used to perform first obfuscation on the first function to be obfuscated to obtain a first code fragment. The first obfuscation includes rewriting the function content and call relationship of the first function to be obfuscated. Specifically, performing the first obfuscation on the first function to be obfuscated to obtain the first code fragment includes: extracting the function content from the first function to be obfuscated, the function content including function logic body information; performing a rewriting operation on the function logic body information using the syntax of a scripting language to obtain a first script fragment; traversing the first call points in the code to be obfuscated that call the first function to be obfuscated; replacing the first function to be obfuscated at the first call point with the first script fragment; and transforming the call relationship of the first call point into a reflection call to obtain the first code fragment. The second obfuscation module is used to perform a second obfuscation process on the second function to be obfuscated to obtain a second code fragment. The second obfuscation process includes rewriting the call relationships of the second function to be obfuscated; and The obfuscated code acquisition module is used to obtain obfuscated code after the first function to be obfuscated and the second function to be obfuscated have completed the corresponding obfuscation processing.

7. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images