File processing method, file processing device, storage medium and electronic equipment

Abstract

A file processing method, a file processing device, a computer-readable storage medium, and an electronic device, relating to the field of computer technology. The file processing method includes: obtaining a file to be processed and a shell file corresponding to the file to be processed (S310); modifying the shell file based on section information of the file to be processed and the shell file to obtain a first intermediate file (S320); encrypting the file to be processed to obtain a second intermediate file (S330); and merging the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed (S340). This method can effectively process files and improve file security.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a file processing method, a file processing device, a computer-readable storage medium, and an electronic device. Background Art

[0002] While the rapid development of computer technology has brought convenience to people, various applications and software have also presented numerous security issues. For example, the programming languages ​​used in some applications are easily decompiled, which can lead to the inclusion of malicious code and affect the normal operation of the application. Therefore, it is imperative to protect files and improve their security.

[0003] Prior art often employs software packing technology, injecting a binary code into files to protect them. However, after packing files using this method, the shell's characteristics are often obvious, and due to the wide variety of depacketizing tools, the packed files are still relatively easy to recover, making it difficult to effectively ensure file security. Therefore, how to effectively process files to improve their security is an urgent problem in the prior art.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] The present disclosure provides a file processing method, a file processing device, a computer-readable storage medium, and an electronic device, thereby improving file security at least to a certain extent.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a file processing method is provided, comprising: obtaining a file to be processed and a shell file corresponding to the file to be processed; modifying the shell file according to section information of the file to be processed and section information of the shell file to obtain a first intermediate file; encrypting the file to be processed to obtain a second intermediate file; and merging the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed.

[0008] According to a second aspect of the present disclosure, a file processing device is provided, comprising: a file acquisition module for acquiring a file to be processed and a shell file corresponding to the file to be processed; a file modification module for modifying the shell file according to section information of the file to be processed and section information of the shell file to obtain a first intermediate file; a file encryption module for encrypting the file to be processed to obtain a second intermediate file; and a file fusion module for fusion of the first intermediate file and the second intermediate file to generate an executable file corresponding to the file to be processed.

[0009] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned file processing method is implemented.

[0010] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned file processing method by executing the executable instructions.

[0011] The technical solution disclosed in this disclosure has the following beneficial effects:

[0012] According to the above-mentioned file processing method, file processing device, computer-readable storage medium, and electronic device, a file to be processed and a shell file corresponding to the file to be processed are obtained; the shell file is modified based on the section information of the file to be processed and the section information of the shell file to obtain a first intermediate file; the file to be processed is encrypted to obtain a second intermediate file; and the first intermediate file and the second intermediate file are merged to generate an executable file corresponding to the file to be processed. On the one hand, compared with the existing technology, this exemplary embodiment proposes a new file processing method that modifies the shell file and merges the modified shell file with the file to be processed to generate an executable file corresponding to the file to be processed, which can effectively prevent static decompilation of the file to be processed. On the other hand, in the generated executable file, whether in file form or in memory, the shell file and the file to be processed are in a highly fused state, making it difficult to restore it to the original complete file to be processed, thereby ensuring the security of the file to be processed. On the other hand, this exemplary embodiment also encrypts the file to be processed before performing the file fusion, further improving the security and reliability of the generated executable file.

[0013] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0015] Figure 1 A schematic diagram showing a system architecture of this exemplary embodiment;

[0016] Figure 2 A schematic diagram showing a file processing method in related art;

[0017] Figure 3 A flowchart showing a file processing method according to the present exemplary embodiment;

[0018] Figure 4 A chain view schematic diagram showing this exemplary embodiment;

[0019] Figure 5 A schematic diagram showing an execution view of this exemplary embodiment;

[0020] Figure 6 A sub-flowchart showing a file processing method according to this exemplary embodiment;

[0021] Figure 7 A sub-flowchart showing another file processing method according to this exemplary embodiment;

[0022] Figure 8 A block diagram showing the structure of a file processing device according to this exemplary embodiment. DETAILED DESCRIPTION

[0023] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0024] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0025] An exemplary embodiment of the present disclosure provides an electronic device for implementing a file processing method. The electronic device includes at least a processor and a memory, wherein the memory is used to store executable instructions of the processor, and the processor is configured to execute the file processing method by executing the executable instructions.

[0026] Electronic devices can be implemented in various forms, for example, including mobile devices such as mobile phones, tablet computers, laptops, personal digital assistants (PDAs), navigation devices, wearable devices, drones, and fixed devices such as desktop computers and smart TVs. Figure 1 The structure of the electronic device is exemplarily described by taking the mobile terminal 100 in FIG. 1 as an example. It should be understood by those skilled in the art that, in addition to the components specifically used for mobile purposes, Figure 1 The structure in the figure can also be applied to fixed type devices. In other embodiments, the mobile terminal 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure can be implemented in hardware, software, or a combination of software and hardware. The interface connection relationship between the components is only shown schematically and does not constitute a structural limitation of the mobile terminal 100. In other embodiments, the mobile terminal 100 may also adopt the same Figure 1 Different interface connection methods, or a combination of multiple interface connection methods.

[0027] like Figure 1As shown, the mobile terminal 100 may specifically include: a processor 110, an internal memory 121, an external memory interface 122, a Universal Serial Bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 171, a receiver 172, a microphone 173, an earphone interface 174, a sensor module 180, a display 190, a camera module 191, an indicator 192, a motor 193, a button 194, and a Subscriber Identification Module (SIM) card interface 195. The sensor module 180 may include a depth sensor 1801, a pressure sensor 1802, a gyroscope sensor 1803, an air pressure sensor 1804, and the like.

[0028] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0029] The controller can generate an operation control signal based on the instruction operation code and timing signal to complete the control of reading and executing instructions.

[0030] The processor 110 may also be provided with a memory for storing instructions and data. The memory can store instructions for implementing six modular functions: detection instructions, connection instructions, information management instructions, analysis instructions, data transmission instructions, and notification instructions, and the execution thereof is controlled by the processor 110. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that have just been used or are recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0031] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an Inter-Integrated Circuit (I2C) interface, an Inter-Integrated Circuit Sound (I2S) interface, a Pulse Code Modulation (PCM) interface, a Universal Asynchronous Receiver / Transmitter (UART) interface, a Mobile Industry Processor Interface (MIPI), a General-Purpose Input / Output (GPIO) interface, a Subscriber Identity Module (SIM) interface, and / or a Universal Serial Bus (USB) interface. Connections are formed with other components of the mobile terminal 100 through different interfaces.

[0032] The USB interface 130 is an interface that complies with USB standards and may be a MiniUSB interface, a MicroUSB interface, a USB Type-C interface, etc. The USB interface 130 can be used to connect a charger to charge the mobile terminal 100, connect headphones to play audio through the headphones, and connect the mobile terminal 100 to other electronic devices, such as a computer or peripheral devices.

[0033] The charging management module 140 is configured to receive charging input from a charger. The charger can be either a wireless charger or a wired charger. In some wired charging implementations, the charging management module 140 can receive charging input from the wired charger via the USB interface 130. In some wireless charging implementations, the charging management module 140 can receive wireless charging input via the wireless charging coil of the mobile terminal 100. While charging the battery 142, the charging management module 140 can also power the electronic device through the power management module 141.

[0034] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the display 190, the camera module 191 and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0035] The wireless communication function of the mobile terminal 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, the baseband processor, and the like.

[0036] Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in mobile terminal 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In other embodiments, the antennas can be used in conjunction with a tuning switch.

[0037] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the mobile terminal 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 can be set in the same device as at least some modules of the processor 110.

[0038] The modem processor may include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After being processed by the baseband processor, the low-frequency baseband signal is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 171, a receiver 172, etc.) or displays an image or video through the display screen 190. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0039] The wireless communication module 160 can provide wireless communication solutions applied to the mobile terminal 100, including Wireless Local Area Networks (WLAN) (such as Wireless Fidelity (Wi-Fi) network), Bluetooth (BT), Global Navigation Satellite System (GNSS), Frequency Modulation (FM), Near Field Communication (NFC), Infrared (IR), etc. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, frequency modulate it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0040] In some embodiments, antenna 1 of the mobile terminal 100 is coupled to the mobile communication module 150, and antenna 2 is coupled to the wireless communication module 160, so that the mobile terminal 100 can communicate with a network and other devices via wireless communication technologies. The wireless communication technologies may include Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division-Synchronous Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), New Radio (NR), BT, GNSS, WLAN, NFC, FM, and / or IR technologies. GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the Beidou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS) and / or the Satellite Based Augmentation System (SBAS).

[0041] Mobile terminal 100 implements display functions through a GPU, display screen 190, and an application processor. A GPU is a microprocessor for image processing that connects display screen 190 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or modify display information.

[0042] The display screen 190 is used to display images, videos, etc. The display screen 190 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a mini-LED, a micro-LED, a micro-o-LED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the mobile terminal 100 may include one or N display screens 190, where N is a positive integer greater than 1.

[0043] The mobile terminal 100 can implement a shooting function through an ISP, a camera module 191, a video codec, a GPU, a display screen 190, and an application processor.

[0044] The ISP processes data fed back by the camera module 191. For example, when taking a photo, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, which is then passed to the ISP for processing and transformed into a visible image. The ISP can also perform algorithmic optimization on image noise, brightness, and skin tone. It can also optimize parameters such as exposure and color temperature of the captured scene. In some embodiments, the ISP can be located within the camera module 191.

[0045] The camera module 191 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal oxide semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the mobile terminal 100 may include 1 or N camera modules 191, where N is a positive integer greater than 1. If the mobile terminal 100 includes N cameras, one of the N cameras is a main camera.

[0046] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the mobile terminal 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0047] Video codecs are used to compress or decompress digital video. Mobile terminal 100 may support one or more video codecs. This allows mobile terminal 100 to play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, and MPEG4.

[0048] The external memory interface 122 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the mobile terminal 100. The external memory card communicates with the processor 110 via the external memory interface 122 to implement data storage functions. For example, files such as music and videos can be stored on the external memory card.

[0049] The internal memory 121 can be used to store computer executable program codes, and the executable program codes include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the mobile terminal 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash memory (Universal Flash Storage, UFS), etc. The processor 110 executes various functional applications and data processing of the mobile terminal 100 by running instructions stored in the internal memory 121 and / or instructions stored in a memory provided in the processor.

[0050] The mobile terminal 100 can implement audio functions such as music playback and recording through the audio module 170 , the speaker 171 , the receiver 172 , the microphone 173 , the headphone jack 174 and the application processor.

[0051] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be provided in the processor 110, or some functional modules of the audio module 170 can be provided in the processor 110.

[0052] The speaker 171 , also called a “horn,” is configured to convert an audio electrical signal into a sound signal. The mobile terminal 100 can listen to music or make hands-free calls through the speaker 171 .

[0053] The receiver 172, also called a "handset", is used to convert audio electrical signals into sound signals. When the mobile terminal 100 receives a call or voice message, the user can place the receiver 172 close to the ear to receive the voice.

[0054] The microphone 173, also known as a "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to the microphone 173 to input the sound signal into the microphone 173. The mobile terminal 100 can be provided with at least one microphone 173. In other embodiments, the mobile terminal 100 can be provided with two microphones 173, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the mobile terminal 100 can also be provided with three, four or more microphones 173 to realize sound signal collection, noise reduction, and identification of sound sources, and realize directional recording function, etc.

[0055] The headphone jack 174 is used to connect a wired headphone and can be the USB interface 130 or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface or a Cellular Telecommunications Industry Association of the USA (CTIA) standard interface.

[0056] The depth sensor 1801 is used to obtain depth information of the scene. In some embodiments, the depth sensor can be provided in the camera module 191.

[0057] Pressure sensor 1802 is used to sense pressure signals and convert them into electrical signals. In some embodiments, pressure sensor 1802 can be provided on display screen 190. There are many types of pressure sensors 1802, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc.

[0058] The gyroscope sensor 1803 can be used to determine the motion posture of the mobile terminal 100. In some embodiments, the angular velocity of the mobile terminal 100 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 1803. The gyroscope sensor 1803 can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 1803 detects the angle of the mobile terminal 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the mobile terminal 100 through reverse movement to achieve anti-shake. The gyroscope sensor 1803 can also be used for navigation and somatosensory game scenes.

[0059] The air pressure sensor 1804 is used to measure air pressure. In some embodiments, the mobile terminal 100 calculates the altitude using the air pressure value measured by the air pressure sensor 1804 to assist in positioning and navigation.

[0060] In addition, according to actual needs, sensors with other functions can also be set in the sensor module 180, such as magnetic sensors, acceleration sensors, distance sensors, proximity light sensors, fingerprint sensors, temperature sensors, touch sensors, ambient light sensors, bone conduction sensors, etc.

[0061] The keys 194 include a power button, a volume button, etc. The keys 194 may be mechanical keys or touch keys. The mobile terminal 100 may receive key inputs and generate key signal inputs related to user settings and function control of the mobile terminal 100.

[0062] Motor 193 can generate vibration prompts, such as those for incoming calls, alarms, and received messages. It can also be used for touch vibration feedback. For example, touch operations on different applications (such as photography, gaming, and audio playback) or touch operations on different areas of the display 190 can correspond to different vibration feedback effects. The touch vibration feedback effects can be customized.

[0063] The indicator 192 may be an indicator light, which may be used to indicate the charging status, power level changes, messages, missed calls, notifications, etc.

[0064] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and disconnected from the mobile terminal 100 by inserting or removing it from the SIM card interface 195. The mobile terminal 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 is also compatible with different types of SIM cards. The SIM card interface 195 is also compatible with external memory cards. The mobile terminal 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the mobile terminal 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the mobile terminal 100 and cannot be separated from the mobile terminal 100.

[0065] In a related technology of a file processing method, the file can be packed by using the UPX (the Ultimate Packer for eXecutables, advanced executable program file compressor) compression shell principle, and the ELF (Executable and Linkable Format, executable and linkable format) file is used as an example for explanation. Figure 2 As shown, the ELF file to be packed 210 may include an ELF header, and multiple sections such as Section 1, Section 2, ..., Section n. Specifically, the packing steps may include parsing the ELF file to be packed to obtain information about each section in the ELF file; traversing the ELF sections and compressing the contents of the sections; reassembling the compressed data of each section into an ELF file, and inserting decompression code therein to generate a new ELF file 220. However, since the UPX compression shell is widely used and has obvious shell features, and after decompression, the ELF file contents are continuous in memory and can be easily restored to the original ELF file, this method is difficult to ensure file security.

[0066] Based on this, the present disclosure first proposes a file processing method, which can be applied to the scenario of processing relevant business files to perform shell processing on them, thereby improving the security of business files.

[0067] Figure 3 The flowchart of a file processing method in this exemplary embodiment includes the following steps S310 to S340:

[0068] Step S310: Obtain the file to be processed and the shell file corresponding to the file to be processed.

[0069] Among them, the file to be processed refers to the source business file that needs to be packed. It can be a file in a variety of formats, such as an ELF file or a BIN (Binary) file. The packed file refers to a shell file used to pack the file to be processed. It is a file of the same type as the file to be processed and contains the core packing logic. In this exemplary embodiment, the packed file can be obtained from the packing system. For example, when a specific packing system or tool is used for file processing, the corresponding packed file is obtained from the packing system or tool.

[0070] In this exemplary embodiment, considering that the virtual machine-based programming language Java is more easily decompiled, more and more applications are implementing their core code in C / C++ and using ELF files for upper-layer Java code to call to ensure security. Therefore, this exemplary embodiment can specifically perform file processing on ELF files.

[0071] In an exemplary embodiment, the above-mentioned files to be processed and the packed files are both ELF files.

[0072] Wherein, ELF file is a kind of for binary file, executable file, object code, shared library and core dump format file, and it can be made up of 4 parts, be respectively ELF header (ELF header), program header table (Program headertable), section (Section) or segment (segments) and section header table (Section header table).Wherein, the ELF header is used to describe the organization of whole ELF file, and program header table is used to describe the various segments in ELF file, so that system creates process image.Wherein, segment describes ELF file from the angle of operation, and section describes ELF file from the angle of link, and segment and section are the relation that comprises, and a segment can comprise several sections.The section header table is used to describe the information of file section area, such as information such as size, offset.

[0073] Generally, the ELF file format can provide two views, such as Figure 4 The link view 400 shown, and Figure 5 The execution view 500 is shown. The link view 400 is based on sections, while the execution view 500 is based on segments. The link view is the view used during linking, while the execution view is the view used during execution.

[0074] In an exemplary embodiment, after the above step S310, the file processing method may further include the following steps:

[0075] The file to be processed and the packed file are loaded using the data structure of the link view to obtain the section information of the file to be processed and the section information of the packed file.

[0076] In this exemplary embodiment, after obtaining the file to be processed and the packed file, it is necessary to perform initialization operations on the file to be processed and the packed file. The packing tool or system loads the file to be processed and the packed file into memory as a linked view data structure, and determines the section information of the file to be processed and the section information of the packed file. The section information may include the name, type, memory size, and specific content contained in the section, such as data code or string.

[0077] Step S320 , transforming the packed file according to the section information of the file to be processed and the section information of the packed file to obtain a first intermediate file.

[0078] In order to improve the security of the file, this exemplary embodiment can transform the structure of the shell file to deform it. Among them, the first intermediate file is the file after the shell file is transformed, and the framework of the new file used for file fusion can be determined based on the first intermediate file. Transforming the shell file can include calculating the memory size of the multiple sections contained in the file to be processed and the shell file, adjusting the size of the sections contained in the shell file according to the calculated memory size, or moving the section header of a specific section in the shell file. In this exemplary embodiment, the section information of each section in the shell file can be copied to the corresponding section of the first intermediate file. In addition, in order to improve the security strength of the shell file, other security processing can also be performed on the shell file, such as performing native method obfuscation protection on the source code of the shell file.

[0079] In an exemplary embodiment, Figure 6 As shown, the above step S320 may include the following steps:

[0080] Step S610, comparing the section capacity in the file to be processed with the section capacity in the packed file, and determining the largest section capacity as the standard capacity;

[0081] Step S620, adjusting the section of the packed file according to the standard capacity;

[0082] Step S630: Erasing at least one section in the packed file to obtain a first intermediate file.

[0083] Specifically, when performing the transformation of a shell file, the to-be-processed file and the shell file can be first searched, the section capacity in the to-be-processed file and the section capacity in the shell file can be calculated, and their respective section information can be recorded, wherein the section capacity is the section size. The section with the largest capacity is determined as the standard capacity, and then the section of the shell file is adjusted according to the standard capacity. For example, when the capacity of a certain section in the to-be-processed file is calculated to be greater than the capacity of the corresponding section in the shell file, the capacity of the section in the to-be-processed file can be selected as the standard capacity, and the capacity of the corresponding section of the first intermediate file can be expanded to the standard capacity, so that the section capacity of the shell file increases after the transformation, so as to achieve the expansion of the shell file.

[0084] In addition, to further protect the security of the shelled file, the section information of the shelled file can also be erased. Erasing at least one section in the shelled file can be performed by hiding the section or deleting the section. Depending on the application scenario, a corresponding processing method can be adopted, and this disclosure does not specifically limit this. Specifically, this can be achieved by erasing at least one section in the shelled file. The at least one section can be any section or a specific section, and this disclosure does not specifically limit this.

[0085] In an exemplary embodiment, erasing at least one section in a packed file may include the following steps:

[0086] Erase sections of a preset type in a packed file.

[0087] Typically, when parsing a file, section information of certain sections is often required. However, this exemplary embodiment protects the shelled file by erasing sections of preset types in the shelled file, thereby preventing the file from being parsed while ensuring the normal operation of the program. Erasing sections of preset types in the shelled file may include erasing specific types of data in the section header, such as ".interp", ".hash", ".rel.dyn", ".rel.plt", ".plt", ".text", ".code", ".ARM.extab", ".ARM.exidx", ".rodata", ".init_array", ".fini_array", ".got", ".got.plt", ".eh_frame", ".eh_frame_hdr", ".data", ".bss", etc.

[0088] Step S330: encrypt the file to be processed to obtain a second intermediate file.

[0089] The second intermediate file refers to the file obtained by encrypting the file to be processed. In practical applications, files are often encrypted using symmetric encryption technology, with the key hard-coded in the program code. However, if the program is attacked by a black box, this encryption method can threaten the operating environment of the encryption device, including memory information and disk read and write permissions, and the key running in memory is no longer secure. Therefore, this exemplary embodiment can adopt white box encryption, or white box the key to ensure key security.

[0090] Specifically, in an exemplary embodiment, encrypting the file to be processed in step S330 may include the following steps:

[0091] The files to be processed are compressed and encrypted using white box encryption technology.

[0092] This exemplary embodiment can encrypt the entire file to be processed using white-box encryption technology. White-box encryption technology can hide the encryption key in a series of data tables. During the encryption process, the key value will not appear in the memory, enabling encryption calculations to be performed in an unsafe environment. Specifically, when encrypting the file to be processed, a static white box or a dynamic white box can be used, and this disclosure does not specifically limit this. In addition, before encryption, this exemplary embodiment can also compress the file to be processed to save memory space and accelerate network transmission.

[0093] Step S340: Merge the first intermediate file and the second intermediate file to generate an executable file corresponding to the file to be processed.

[0094] Among them, the executable file corresponding to the pending file is the file after the pending file is shelled. Its type is the same as the type of the pending file and the shelled file. For example, if the pending file and the shelled file are ELF files, the generated executable file is also an ELF file. After determining the first intermediate file and the second intermediate file, the two can be merged to generate an executable file corresponding to the pending file. The fusion process can be regarded as the process of shelling the pending file. When running the executable file corresponding to the generated pending file, the first intermediate file can be executed first to protect the information such as the entry address of the second intermediate file. When the program of the first intermediate file ends, the second intermediate file begins to execute.

[0095] Furthermore, the executable file corresponding to the generated to-be-processed file is larger than the unfused to-be-processed file. For example, the executable file may be 40KB-80KB larger than the original to-be-processed file. In practical applications, for applications that are sensitive to size, a larger executable file may affect the user experience. Based on this, this exemplary embodiment can also compress the to-be-processed file after it is generated to improve memory space utilization.

[0096] Specifically, when the first intermediate file and the second intermediate file are merged, if Figure 7 As shown, the above step S340 may include the following steps:

[0097] Step S710, starting from a preset first address, copying a first intermediate file, and determining a second address where the last character of the copied first intermediate file is located;

[0098] Step S720, copying the second intermediate file to a third address located after the second address;

[0099] Step S730: Merge the copied first intermediate file and the copied second intermediate file to generate an executable file.

[0100] In this exemplary embodiment, the first intermediate file is a file after the shell file is modified, and the second intermediate file is a file after the file to be processed is encrypted. The process of fusing the first intermediate file with the second intermediate file is essentially a process of generating a new file (the executable file corresponding to the file to be processed) based on these two files. The specific fusion process may include determining the position of the first intermediate file in the executable file to be generated, that is, the first address, and copying the entire content of the first intermediate file to the first address. The first address may refer to the starting address of the executable file. Then, based on the position of the last character of the first intermediate file, the end address of the first intermediate file in the executable file, that is, the second address, can be determined. Further, the entire content of the second intermediate file is copied to the position after the second address, that is, the third address, to achieve the fusion of the first intermediate file and the second intermediate file and generate the final executable file.

[0101] In summary, in this exemplary embodiment, a file to be processed and a shell file corresponding to the file to be processed are obtained; the shell file is modified based on the section information of the file to be processed and the section information of the shell file to obtain a first intermediate file; the file to be processed is encrypted to obtain a second intermediate file; and the first intermediate file and the second intermediate file are merged to generate an executable file corresponding to the file to be processed. On the one hand, compared to the existing technology, this exemplary embodiment proposes a new file processing method that modifies the shell file and merges the modified shell file with the file to be processed to generate an executable file corresponding to the file to be processed, which can effectively prevent static decompilation of the file to be processed. On the other hand, in the generated executable file, whether in file form or in memory, the shell file and the file to be processed are in a highly fused state, making it difficult to restore it to the original complete file to be processed, thereby ensuring the security of the file to be processed. On the other hand, this exemplary embodiment also encrypts the file to be processed before performing the file fusion, further improving the security and reliability of the generated executable file.

[0102] The exemplary embodiment of the present disclosure also provides a file processing device. Figure 8 As shown, the file processing device 800 may include: a file acquisition module 810, used to obtain a file to be processed and a shell file corresponding to the file to be processed; a file transformation module 820, used to transform the shell file according to the section information of the file to be processed and the section information of the shell file to obtain a first intermediate file; a file encryption module 830, used to encrypt the file to be processed to obtain a second intermediate file; a file fusion module 840, used to fuse the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed.

[0103] In an exemplary embodiment, the file transformation module includes: a capacity comparison unit, used to compare the section capacity in the file to be processed with the section capacity in the shell file, and determine the largest section capacity as the standard capacity; a section adjustment unit, used to adjust the section of the shell file according to the standard capacity; and a section erasing unit, used to erase at least one section in the shell file to obtain a first intermediate file.

[0104] In an exemplary embodiment, the file fusion module includes: a first copying unit, used to copy the first intermediate file starting from a preset first address, and determine the second address where the last character of the copied first intermediate file is located; a second copying unit, used to copy the second intermediate file to a third address located after the second address; and a file merging unit, used to merge the copied first intermediate file and the second intermediate file to generate an executable file.

[0105] In an exemplary embodiment, the section erasing unit is used to erase a section of a preset type in the packed file.

[0106] In an exemplary embodiment, the file encryption module is used to compress the file to be processed and encrypt the file to be processed using a white box encryption technology.

[0107] In an exemplary embodiment, the file to be processed and the packed file are both executable and linkable format files.

[0108] In an exemplary embodiment, the file processing device further includes: a loading module for, after obtaining the file to be processed and the shell file corresponding to the file to be processed, loading the file to be processed and the shell file using a data structure of a link view to obtain section information of the file to be processed and the section information of the shell file.

[0109] The specific details of each module in the above device have been described in detail in the implementation method part. For details not disclosed, please refer to the implementation method part, and they will not be repeated here.

[0110] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0111] The exemplary embodiments of the present disclosure further provide a computer-readable storage medium on which a program product capable of implementing the above-mentioned method of the present specification is stored. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code. When the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the above-mentioned "Exemplary Method" section of the present disclosure, for example, Figure 3 、 Figure 6 or Figure 7 Any one or more steps in .

[0112] The exemplary embodiments of the present disclosure also provide a program product for implementing the above-mentioned method, which can be a portable compact disc read-only memory (CD-ROM) and includes program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0113] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0114] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0115] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0116] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0117] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and embodiments are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the claims.

[0118] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A file processing method, characterized in that: include: Obtaining a file to be processed and a shell file corresponding to the file to be processed; According to the section information of the file to be processed and the section information of the packed file, the packed file is modified to obtain a first intermediate file; Encrypting the file to be processed to obtain a second intermediate file; Merging the first intermediate file and the second intermediate file to generate an executable file corresponding to the file to be processed; The step of transforming the shell file according to the section information of the file to be processed and the section information of the shell file to obtain a first intermediate file includes: Comparing the section capacity in the to-be-processed file with the section capacity in the packed file, and determining the largest section capacity as the standard capacity; Adjusting the section of the packed file according to the standard capacity; At least one section in the packed file is erased to obtain the first intermediate file.

2. The method according to claim 1, characterized in that The step of fusing the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed includes: Starting from a preset first address, copying the first intermediate file, and determining a second address where the last character of the copied first intermediate file is located; Copying the second intermediate file to a third address located after the second address; The copied first intermediate file and the copied second intermediate file are merged to generate the executable file.

3. The method according to claim 1, characterized in that Erasing at least one section in the packed file includes: Erasing a section of a preset type in the packed file.

4. The method according to claim 1, wherein The encrypting the file to be processed includes: The file to be processed is compressed and encrypted using a white box encryption technology.

5. The method according to any one of claims 1 to 4, characterized in that The to-be-processed file and the packed file are both executable and linkable format files.

6. The method according to claim 5, characterized in that After obtaining the file to be processed and the shell file corresponding to the file to be processed, the method further includes: The file to be processed and the packed file are loaded using a data structure of a link view to obtain section information of the file to be processed and section information of the packed file.

7. A file processing device, characterized in that: include: A file acquisition module, used to acquire a file to be processed and a shell file corresponding to the file to be processed; A file transformation module, configured to transform the shell file according to the section information of the file to be processed and the section information of the shell file to obtain a first intermediate file; A file encryption module, used for encrypting the file to be processed to obtain a second intermediate file; A file fusion module, configured to fuse the first intermediate file with the second intermediate file to generate an executable file corresponding to the file to be processed; The file transformation module is further used to: Comparing the section capacity in the to-be-processed file with the section capacity in the packed file, and determining the largest section capacity as the standard capacity; Adjusting the section of the packed file according to the standard capacity; At least one section in the packed file is erased to obtain the first intermediate file.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to perform the method according to any one of claims 1 to 6 by executing the executable instructions.

Images