Fine-grained code encryption method based on variable window and running method of code thereof

Abstract

This invention provides a fine-grained code encryption method based on a variable window and a method for executing the code thereon. The fine-grained code encryption method includes: setting a window size based on the machine code length of the instruction statements in the target program; and targeting window P... i The machine code of each instruction statement is used with key K. i Encryption is performed, and based on window P i The machine code length and type of the instruction statement in the window P are used to determine the window P. i Slide to a new window; after processing the target program, an initial encryption program is obtained; after injecting the interpreter into the initial encryption program and adaptively modifying the metadata of the initial encryption program, the encryption program of the target program is obtained. This invention utilizes a variable window mechanism to ensure data confidentiality and effectively increases the analysis cost for attackers.

Description

Technical Field

[0001] This invention belongs to the field of software security and network security technology, and relates to a method for improving the granularity of code encryption and decryption, particularly to a fine-grained code encryption method based on variable windows and its code execution method. Background Technology

[0002] Code encryption is a common software protection technique. Depending on the object being encrypted, it can be divided into source code encryption and binary file encryption. Source code encryption is commonly used in scripting languages ​​such as Python, PHP, and JavaScript, encrypting only the program's code and primarily reducing its readability. To circumvent analysis, methods such as removing temporary variables, using meaningless variable names, and dynamically generating constants are commonly used. Structurally, equivalent transformations can be used to obfuscate the code structure, such as switching loop statements, adding invalid jumps, and recursive transformations to further reduce the likelihood of code identification.

[0003] Unlike scripting languages, programs written in C++, Rust, and Golang require compilation before execution. In these cases, source code encryption is largely ineffective because the machine code generated by the compiler doesn't change significantly. Binary file encryption, on the other hand, encrypts and protects the generated executable file directly. Since file execution follows the operating system's design rules—first, the file loader loads the program, then it locates the entry point, and finally, execution begins—the core principle of binary file encryption is to first encrypt the program's machine code, then inject a relevant interpreter. After the program runs, the injected code is interpreted and executed. Without compromising the program's semantics, it performs data decryption before the entry point code, restoring the actual executed code and ensuring the program's normal operation.

[0004] While binary file encryption is effective against static analysis, the common practice is to encrypt only once, which lacks the ability to sustain resistance. It is less effective against dynamic analysis methods such as dynamic debugging and memory dumping. For reverse engineering, memory dumping can be used to directly obtain memory data, even if it's a black box (e.g., data before and after encryption), without needing to know the specific function implementation, and then perform offline analysis. However, in actual analysis, attackers need to know when and where to dump data. Poor timing will result in incorrect data; failing to filter addresses will lead to a large amount of useless data, increasing the difficulty of subsequent processing. Therefore, in code encryption, it's crucial to increase the granularity of encryption and minimize the amount of code exposed at any given time, thus significantly increasing the difficulty for attackers.

[0005] In academia, several teams have proposed methods for refining the granularity of code encryption. Wu et al. (Wu M, Zhang Y, Mi X. Binary protection using dynamic fine-grained code hiding and obfuscation[C] / / Proceedings of the 4th International Conference on Information and Network Security.2016:1-8.) proposed a basic block-based code encryption protection method, dynFCHO. Its advantage lies in hiding the program's control flow, which is also a code virtualization framework. It implements all functions through additional components and incorporates code obfuscation techniques. Lee et al. (Lee JY, Suk JH, Lee DH. VODKA: Virtualization Obfuscation Using Dynamic Key Approach[C] / / International Workshop on Information Security Applications.Springer,Cham,2018:131-145.) also proposed a basic block-based virtual code protection method, VODKA. This method focuses on both anti-debugging and anti-dynamic binary instrumentation, effectively limiting the debuggable range of attackers. However, this method can only encrypt basic blocks, without further improving the granularity. It lacks flexibility in handling different situations during actual encryption, and there is no secondary encryption after decryption during program execution, meaning it doesn't effectively cooperate with anti-debugging modules. Suk et al. (Suk JH, Lee D H. VCF: Virtual Code Folding to Enhance Virtualization Obfuscation[J].IEEE Access,2020,8:139161-139175.) proposed another code folding-based encryption protection technology, VCF. Also based on binary file encryption, it folds temporarily unexecuted code and decrypts it at runtime, effectively protecting against code analysis. However, its protection granularity is still too coarse. Offline analysis can be performed using memory dumping, as memory dumping can be done once the virtual instructions are decompressed. Furthermore, during implementation, special handling is required when the program encounters assembly instructions like Call / Jmp / Ret that cause control flow jumps. The running efficiency and algorithm design also need improvement.

[0006] These studies generally use basic blocks as the smallest unit of code encryption, but in reality, the granularity can be even smaller. For example, basic blocks can be divided into sub-basic blocks, which are then randomly stored but sequentially joined during execution. Semantic equivalence of the basic blocks is achieved through continuous jumps. Furthermore, introducing self-modifying code during code encryption can further improve the program's understandability. Self-modifying code is a technique that allows a program to modify its own instructions during runtime. Computer viruses and Trojans often use this technique to evade static analysis and antivirus software detection. This self-modifying code is a mechanism for program self-protection, rendering disassemblers and debuggers ineffective. Because the code obtained through disassembly is not the code in the execution process, even if the code appears illogical and difficult to understand, it still possesses certain semantics when actually executed. These methods can further enhance the strength of encryption methods. With a thorough consideration of these techniques, the granularity of encryption can be refined by adjusting certain strategies to effectively resist attackers' analysis. Summary of the Invention

[0007] The purpose of this invention is to provide a fine-grained code encryption method based on a variable window and a method for running the code. This encryption method is based on a variable window, which refines the granularity of encryption and decryption, can effectively resist dynamic analysis methods such as memory dumping, and the window size can be customized, thus having good adaptability.

[0008] In this invention, a variable window refers to a finer-grained encryption unit that is based on assembly statements and consists of several assembly statements. The length of the window is determined by the machine code length of the assembly statements, and its length is generally less than the average length of the basic blocks in the program.

[0009] The technical solution adopted in this invention is as follows:

[0010] A fine-grained code encryption method based on a variable window, the method comprising:

[0011] Set the window size based on the machine code length of the instructions in the target program;

[0012] For window P i The machine code of each instruction statement is used with key K. i Encryption is performed, and based on window P i The machine code length and type of the instruction statement in the window P are used to determine the window P. i Slide to a new window, where i is the window number;

[0013] The initial encryption program is obtained after the target program has been processed.

[0014] After embedding the interpreter into the initial encryption program and adaptively modifying the metadata of the initial encryption program, the encryption program of the target program is obtained. The interpreter's contents include: the stated window size and the key K. i .

[0015] Furthermore, the statement based on window P i The machine code length and type of the instruction statement in the window P are used to determine the window P. i Slide to a new window, including:

[0016] For window P i Obtain the number of machine codes for each extracted instruction statement;

[0017] The number of machine codes for each extracted instruction statement is added together to obtain the value m;

[0018] If the type of the instruction statement in the window does not include a jump statement, then the window P will be... i Slide m steps to get a new window;

[0019] or,

[0020] For window P i Obtain the number of machine codes for each extracted instruction statement;

[0021] The number of machine codes for each extracted instruction statement is added together to obtain the value m;

[0022] If the type of the instruction statement in the window contains a jump statement, then the target statement of the jump statement is obtained, the first machine code of the target statement is used as the first machine code of the new window, and combined with the value m, a new window is constructed.

[0023] The window P i Slide to a new window.

[0024] Furthermore, the metadata includes: program image size and entry point address.

[0025] A method for running code for any of the above-mentioned encryption programs, the method comprising:

[0026] Based on the interpreter, the window size is extracted;

[0027] Execution window P i When processing the machine code, extract the instruction statements and extract the key K based on the interpreter. i and using the key K i Decrypt each machine code in the extracted instruction statement;

[0028] After executing the instruction statement based on the decrypted machine code, the key K is used. i After encrypting each machine code in the extracted instruction statement, the window P is then configured according to the instructions in the instruction statement. i Slide to a new window;

[0029] The encryption process continues until the encryption program is completed, at which point the code execution result is obtained.

[0030] Furthermore, after executing the instruction statement based on the decrypted machine code, the key K is used. i After encrypting each machine code in the extracted instruction statement, the window P is then configured according to the instructions in the instruction statement. i Slide to a new window, including:

[0031] Based on the decrypted machine code, window P is executed sequentially. i All instruction statements within;

[0032] Using the key K i Encrypt each machine code in the extracted instruction statement;

[0033] According to window P i The machine code length of the instruction statement, and the window P i Slide to a new window;

[0034] or,

[0035] Based on the decrypted machine code, window P is executed sequentially. i The instructions within the jump statement will be executed until the jump statement is completed.

[0036] Using the key K i For window P i The machine code in each extracted instruction statement is encrypted;

[0037] Obtain the target statement of the jump statement, use the first machine code of the target statement as the first machine code of the new window, and construct the new window in combination with the window size;

[0038] The window P i Slide to the new window.

[0039] A fine-grained code encryption device based on a variable window, comprising:

[0040] The window size setting module is used to set the window size based on the machine code length of the instruction statements in the target program;

[0041] Window encryption module, used to target window P i The machine code of each instruction statement is used with key K.i Encryption is performed, and based on window P i The machine code length and type of the instruction statement in the window P are used to determine the window P. i Slide to a new window, where i is the window number; until the target program is processed, the initial encryption program is obtained;

[0042] The program generation module is used to implant an interpreter into an initial encryption program and adaptively modify the metadata of the initial encryption program to obtain the encryption program of the target program. The interpreter includes the specified window size and the key K. i .

[0043] A fine-grained code execution device based on a variable window includes:

[0044] A window size extraction module is used to extract the window size based on the interpreter;

[0045] The window decryption module is used to execute window P. i When processing the machine code, extract the instruction statements and extract the key K based on the interpreter. i and using the key K i Decrypt each machine code in the extracted instruction statement;

[0046] The encryption and sliding module is used to execute the instruction statement based on the decrypted machine code, and then use the key K. i After encrypting each machine code in the extracted instruction statement, the window P is then configured according to the instructions in the instruction statement. i Slide to a new window;

[0047] The result generation module is used to obtain the code execution result until the encryption program is completed.

[0048] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described above.

[0049] A computer device includes a memory and a processor, the memory storing a computer program which is loaded and executed by the processor to implement any of the methods described above.

[0050] A computer program product, when run on a computer device, causes the computer device to perform any of the methods described above.

[0051] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0052] In recent years, with the prevalence of cyberattacks and the spread of piracy, software analysis by attackers is inevitable, and software security and data security issues have received increasing attention. However, in the process of code encryption, the strength of encryption has not been significantly improved. Traditional methods encrypt data at the basic block level or use self-modifying code technology to encrypt the entire code at once. The granularity of encryption determines the number of memory dumps and the difficulty of analysis for attackers.

[0053] Based on thorough research and experimental testing, and combined with practical application scenarios, this invention innovatively proposes a fine-grained code encryption method based on a variable window. The variable window mechanism ensures data confidentiality, allowing for multiple successful encryption and decryption attempts during program execution. It guarantees that instructions can only be correctly decrypted within the current window, and the decryption width is not necessarily equal to the window size. Even if an attacker obtains the window size, they cannot decrypt and reconstruct the code, effectively increasing the attacker's analysis cost. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating the operation of the present invention;

[0055] Figure 2 This is a flowchart illustrating the execution process of the present invention.

[0056] Figure 3 Flowchart a is a flowchart of Embodiment 1 of the present invention;

[0057] Figure 4 This is flowchart b of Embodiment 1 of the present invention.

[0058] Figure 5 This is flowchart c, which is a first embodiment of the present invention. Detailed Implementation

[0059] The technical solutions in the embodiments of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely specific embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] The main objective of this invention is to encrypt instructions and implement runtime code encryption and decryption, refine the granularity of encryption and decryption, and effectively resist dynamic analysis methods. The window has the following two main features.

[0061] 1) Window movement is directional. Window can be moved, and the distance moved each time can be fixed or inconsistent.

[0062] 2) The window size is not fixed, and the window size has a maximum and a minimum value.

[0063] To reflect these two key features and considering the need for encryption, the invention internally divides the entire encryption model into four states: decryption, execution, encryption, and movement. First, when the program executes to the relevant instruction area, the interpreter decrypts the data within the instruction area based on the current window's position; the decryption scope covers the entire window's data. After decryption, the relevant instruction is executed. After execution, the instructions within the window are encrypted again to ensure consistency with the data before decryption. Once all instructions within the window have been executed, the window is moved, and the operation is repeated for the instructions in the next area; the distance moved is determined by the length of the executed instruction.

[0064] The operation flow of the method of the present invention is as follows: Figure 1 As shown. First, the window size is set before the program executes, and different window sizes will determine the granularity of encryption; second, the binary file code is encrypted to complete data protection; then, the interpreter is injected, and the program's metadata is modified to enable the program to run normally.

[0065] The execution flow of this invention during operation is as follows: Figure 2 As shown. During program execution, the program first locates the instruction to determine the address of the currently executing instruction; then, it performs a decryption operation to decrypt the data and execute the code; afterwards, the interpreter determines whether the current code is within the window. If it is within the range, it continues to execute the relevant code; if it is outside the range, it means that all instructions within the window have been executed, and a second encryption process is performed. After encryption, the window is moved to decrypt and execute the next piece of code. This cycle continues until all code has been executed, and the program automatically exits.

[0066] In the key generation section, this invention uses memory integrity verification to check the function code, which is used to generate a key and encrypt the instructions. Since the start and end addresses of the function can be statically determined and do not change during runtime, and the content is also fixed, the static encryption and runtime decryption processes are consistent.

[0067] The following is a detailed description using an example.

[0068] This example uses a variable window size of 4 bytes as an example to illustrate the invention in detail. Figure 3As shown in the diagram, the letters represent the machine code of the instructions. Indicators of the same color represent the same instruction. There are five instructions in total: AB, CDE, FG, H, and I. AB, CDE, FG, and I represent sequential execution instructions, while H represents an unconditional jump instruction, jumping directly from H to C. The lengths of the five instructions are 2, 3, 2, 1, and 1 bytes respectively. The shaded area enclosed by the diagonal lines represents the current window position; the starting position of the window is A, containing 4 bytes (ABCD). The program begins executing code from the AB instruction.

[0069] Once the program starts executing, it needs to locate the instruction, find the current window's position, and determine if the currently executing instruction is inside the window. Figure 3 In this case, since the AB instruction is entirely within the window and needs to be executed, the interpreter needs to decrypt the AB instruction data. After obtaining the encryption key K1, the interpreter decrypts the data. At this time, the decryption length is not determined by the length of the instruction itself, but by the size of the sliding window. That is, the interpreter uses key K1 to decrypt a total of 4 bytes of data, obtaining A⊕K1, B⊕K1, C⊕K1, and D⊕K1.

[0070] After decryption, the interpreter executes the instruction sequence within the current window sequentially. Since instruction AB was successfully decrypted, it can be executed. After AB execution, the interpreter determines whether the next instruction needs to be executed. Because instruction E in CDE is outside the current window, a complete instruction is truncated by the window, and the correct key K2 was not used for decrypting CDE (C⊕K1 and D⊕K1 are incorrect data), decryption fails, and CDE cannot be executed successfully. Upon receiving this information, the controller performs error control, determines that all instructions within the window have been executed, and enters the re-encryption stage.

[0071] Since the entire window has now completed execution, the interpreter first re-encrypts the data within the window, restoring it to its original state before decryption. The key Ki used at this point is the same as the decryption key used during the previous code execution; that is, the data within the window is restored to ABCD. Using the same key effectively reduces the storage complexity of different keys and avoids situations where loop structures are difficult to handle, preventing subsequent decryption failures after the first decryption.

[0072] After encryption, in order to execute the CDE instructions, the window needs to be moved to fully contain the CDE instructions and use the correct key. For example... Figure 4 As shown, at this time, the controller obtains the distance the window moves based on the length of the instructions executed in the current window. Since only the AB instruction was executed at this time, and the instruction length is 2, the window will move forward 2 bytes, that is, move to the starting address of the CDE instruction.

[0073] Since the CDE commands are all within the window at this time, the execution status is the same as... Figure 3 If the conditions are met, proceed to the second round of decryption, execution, encryption, and data movement. After obtaining the key K2 corresponding to the CDE instruction, the interpreter decrypts the data to obtain C⊕K2, D⊕K2, E⊕K2, and F⊕K2. After successfully executing the CDE instruction, the interpreter, similarly, determines that the instructions in the current window have been completed if the next instruction FG is truncated by the current window and cannot be executed, and then continues with the encryption and data movement process.

[0074] However, the situation becomes much more complicated when the window contains jump instructions. For example... Figure 5 As shown, the window currently contains 4 bytes of data (FGHI), and the FG, H, and I instructions are all within the window, so they can all be successfully decrypted and executed. However, executing the H instruction will cause a change in the program's control flow, resulting in an unconditional jump to the CDE instruction location. Since the data in the CDE instruction has been encrypted at this point, a direct jump will cause problems.

[0075] Therefore, considering the special nature of jump instructions, this invention postpones the execution of jump instructions such as Call, Ret, and Jmp. This eliminates the need to consider the impact of differences between instruction semantics and execution at the instruction level, making window movement entirely dependent on the currently executing instruction address. Instructions execute sequentially, causing the window to move; instructions jump, causing the window's position to change. Since the encrypted data is completed before the instruction jump, control flow transfer instructions do not affect the encryption / decryption effect. Figure 5 In the scenario shown, the interpreter determines that the CDE instruction will be executed after the H instruction is completed, and the CDE instruction is located outside the window. Therefore, the interpreter will first re-encrypt the data inside the window, and then the window will jump to the starting address of the CDE instruction. The subsequent execution is not described in detail.

[0076] The specific effects of the invention are briefly described below. During the experimental testing, several programs using cryptographic and encoding algorithms as their main logic were selected as test objects, and their core functions were encrypted. These test examples included Base64, RC4, AES, and MD5. The number of memory dumps for different functions under different window sizes was tested to quantify the difficulty of analysis for attackers. The experimental data is shown in Table 1.

[0077] Table 1. Number of memory dumps under different instances and window sizes

[0078] Window size Base64 RC4 AES MD5 6 109 88 333 1019 7 92 75 285 837 8 81 66 244 784 9 69 58 209 657 10 62 48 185 583 15 39 32 122 388 20 29 23 89 281 25 24 19 71 224 30 19 16 59 186 40 14 12 43 137 50 12 10 35 110 60 10 8 29 92 70 8 7 25 78 80 7 6 22 69

[0079] When the window size is variable, attackers often use memory dump analysis, requiring them to dump each decrypted instruction. Based on the variable window model proposed in this invention, since the decrypted data exists only within the window, even if an attacker deduces the window size, they cannot obtain the length of each decryption. The data in the table shows that the number of memory dumps is inversely proportional to the window size. When the window is small, less data is decrypted each time, resulting in more dumps; as the window gradually increases, more bytes are decrypted each time, leading to fewer dumps and reduced security. This is because the variable window size is controllable and more flexible. Therefore, in the actual process of protecting a program, it is necessary to assess the introduced overhead based on the file's characteristics before adjusting the window. If we disregard the program's own factors, setting the window size to 15 bytes has a smaller impact on the program, resulting in lower average overhead, while the average number of memory dumps is more than five times that of 80 bytes, thus balancing execution efficiency and security.

[0080] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A fine-grained code encryption method based on a variable window, the method comprising: setting a window size based on the length of machine code of an instruction statement in a target program; For each instruction statement in the window P i encrypting the machine code of each instruction statement using a key K i based on the length of the machine code of the instruction statement and the type of the instruction statement in the window P i sliding the window P i to a new window, wherein i is a window number, the sliding the window P i to a new window based on the length of the machine code of the instruction statement and the type of the instruction statement in the window P i sliding the window P For window P i , the number of machine codes of each extracted instruction sentence is obtained; adding the number of machine codes of each of the extracted instruction statements to obtain a value m; If the type of instruction statement in the window does not contain a jump statement, then the window P i Slide m steps to get a new window; or, For window P i , the number of machine codes of each extracted instruction sentence is obtained; adding the number of machine codes of each of the extracted instruction statements to obtain a value m; if the type of the instruction statement in the window includes a jump statement, obtaining a target statement of the jump statement, taking the first machine code of the target statement as the first machine code of a new window, and combining the value m to construct the new window; P i Slide to new window; until the target program is processed completely, an initial encrypted program is obtained; The interpreter is implanted into the initial encryption program, and the metadata of the initial encryption program is adaptively modified, to obtain an encryption program of the target program, wherein the content of the interpreter includes the window size and the key K i .

2. The method of claim 1, wherein, the metadata includes a program image size and an entry point address. 3.A code running method for the encrypted program of any one of claims 1-2, the method comprising: extracting the window size based on the interpreter; Execution window P i machine code in the execution window P i extracts the instruction statements and extracts the key K i decrypts each machine code in the extracted instruction statements using the key K After executing the instruction statement based on the decrypted machine code, the key K is used to encrypt the instruction statement i After encrypting each machine code in the extracted instruction statement, the window P is slid to a new window according to the instruction of the instruction statement i sliding to a new window; until the encrypted program is executed completely, a code running result is obtained.

4. The method of claim 3, wherein, After executing the instruction statement based on the decrypted machine code, using the key K i After encrypting each machine code in the extracted instruction statement, according to the instruction of the instruction statement, the window P i Sliding to a new window includes: Based on the decrypted machine code, the window P is executed in turn i All the instruction statements within the innermost loop; using the key K i encrypting each machine code in the extracted instruction statement; According to the window P i the machine code length of the instruction statement, the window P i slides to a new window; or, Based on the decrypted machine code, the instruction statements in the window P are executed in turn until the jump statement is executed. i The instruction statements in the window P are executed in turn until the jump statement is executed. using the key K i to the window P i machine code encryption in each extracted instruction statement obtaining a target statement of the jump statement, taking the first machine code of the target statement as the first machine code of a new window, and combining the window size to construct the new window; P i slide to the new window. 5.A fine-grained code encryption device based on a variable window, comprising: a window size setting module configured to set a window size based on the length of machine code of an instruction statement in a target program; a window encryption module, configured to encrypt each instruction statement in a window P i using a key K i according to the machine code length of the instruction statement in the window P i and the type of the instruction statement, and slide the window P i to a new window, i being a window serial number; until the target program is processed completely, an initial encrypted program is obtained; wherein the sliding the window P i to a new window comprises: i sliding the window P For window P i , the number of machine codes of each extracted instruction sentence is obtained; adding the number of machine codes of each of the extracted instruction statements to obtain a value m; If the type of instruction statement in the window does not contain a jump statement, then the window P i Slide m steps to get a new window. or, For window P i , the number of machine codes of each extracted instruction sentence is obtained; adding the number of machine codes of each of the extracted instruction statements to obtain a value m; if the type of the instruction statement in the window includes a jump statement, obtaining a target statement of the jump statement, taking the first machine code of the target statement as the first machine code of a new window, and combining the value m to construct the new window; P i Slide to new window; A program generation module is configured to implant an interpreter into an initial encrypted program and adaptively modify the metadata of the initial encrypted program to obtain an encrypted program of the target program, wherein the content of the interpreter comprises the window size and the key K i . 6.A fine-grained code running device based on a variable window for the encrypted program of claim 5, comprising: a window size extraction module configured to extract the window size based on the interpreter; a window decryption module for decrypting each machine code in the extracted instruction statements using the key K i when executing the machine codes in the window P i based on the interpreter, and using the key K i ; a cryptographic and sliding module for, after execution of said instruction statement based on the decrypted machine code, using said key K i encrypting each machine code in the extracted instruction statement, and according to the instruction of said instruction statement, sliding said window P i to a new window; a result generation module configured to obtain a code running result until the encrypted program is executed completely. 7.A computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement any one of the methods of claims 1-4. 8.A computer device comprising a memory and a processor, the memory having a computer program stored therein, the computer program being loaded and executed by the processor to implement any one of the methods of claims 1-4. 9.A computer program product, when the computer program product is run on a computer device, causing the computer device to execute any one of the methods of claims 1-4.

Images