A program code security method, device and electronic equipment

Abstract

Embodiments of the present application disclose a program code security method, device and electronic equipment, and relate to the technical field of computer application. The method comprises the following steps: receiving a PE file starting instruction; obtaining, by a shell program corresponding to the PE file starting instruction, a packed PE file data from a cloud server in a manner of encrypted transmission channel; loading, by the shell program, the packed PE file data into a memory for unpacking processing; and starting the PE file data after unpacking processing in the memory. The present application places the program code of the PE file in the cloud server and the memory, and does not form a specific program code landing file, thereby enhancing the difficulty of reverse engineering and improving the security of the program code.

Description

Technical Field

[0001] This invention belongs to the field of computer application technology, and in particular relates to a method, apparatus and electronic device for protecting program code. Background Technology

[0002] Program code is the underlying component of software applications and embodies a significant amount of labor, possessing high economic value and technical content. To reduce investment in funds and technology, some individuals and companies often steal the work of others, directly using program code developed by others without their consent. Therefore, program code confidentiality has always been a top priority for major enterprises. Currently, companies primarily use management systems and software to strictly manage and control program code. However, with the development of reverse engineering technology, simply ensuring program code confidentiality is no longer sufficient to meet current needs. Externally released portable and executable files (PE files), such as EXE, DLL, OCX, SYS, and COM, also expose compiled and optimized source code. To strengthen program code protection, methods such as local program code packing have emerged. However, even locally packed PE files, because they still contain all the program code from the PE file, are still at risk of being reverse engineered. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a program code confidentiality method, apparatus, and electronic device to address the problem of insufficient security in existing program code confidentiality methods. The present invention places the program code of the PE file in a cloud server and memory, avoiding the creation of a physical program code file, thus increasing the difficulty of reverse engineering and ensuring the security of the program code.

[0004] In a first aspect, embodiments of the present invention provide a method for keeping program code confidential, comprising:

[0005] Receive PE file boot command;

[0006] The shell program corresponding to the PE file startup instruction obtains the shelled PE file data from the cloud server through an encrypted transmission channel.

[0007] The shell program loads the packed PE file data into memory for unpacking.

[0008] Start the unpacked PE file data in memory.

[0009] In conjunction with the first aspect, in a first embodiment of the first aspect, the step of loading the packed PE file data into memory for unpacking via the shell program includes:

[0010] The shell program loads the packed PE file data into memory for decryption and decompression to obtain the corresponding decrypted and decompressed first memory data.

[0011] The shell program calls a preset PE loader to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtains the second memory data, which serves as the PE file data after unpacking.

[0012] In conjunction with the first aspect or the first implementation of the first aspect, in the second implementation of the first aspect, the unpacked PE file data in the boot memory includes:

[0013] Based on the memory layout format when the PE file is normally invoked, obtain the entry point for the unpacked PE file data in memory.

[0014] The program logic for executing the call entry point to start the unpacked PE file data is initiated.

[0015] In conjunction with the first aspect, in the third embodiment of the first aspect, the encrypted transmission channel is an asymmetric encrypted transmission channel.

[0016] In conjunction with the first aspect, in the fourth embodiment of the first aspect, after the unpacked PE file data in the startup memory, it further includes:

[0017] Receive PE file close command;

[0018] The shell program corresponding to the PE file closing instruction releases the memory occupied by the unpacked PE file data.

[0019] Secondly, embodiments of the present invention provide a program code confidentiality device, comprising:

[0020] The instruction receiving module is used to receive PE file startup instructions;

[0021] The data acquisition module is used to acquire the shelled PE file data from the cloud server through the shell program corresponding to the PE file startup instruction in an encrypted transmission channel;

[0022] The unpacking module is used to load the packed PE file data into memory through the shell program for unpacking processing;

[0023] The startup module is used to start the unpacked PE file data in memory.

[0024] In conjunction with the second aspect, in the first embodiment of the second aspect, the unpacking module includes:

[0025] The decryption and decompression unit is used to load the packed PE file data into memory through the shell program for decryption and decompression, so as to obtain the corresponding decrypted and decompressed first memory data.

[0026] The PE loading unit is used to call a preset PE loader through the shell program to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtain the second memory data as the PE file data after unpacking.

[0027] In conjunction with the second aspect or the first embodiment of the second aspect, in the second embodiment of the second aspect, the startup module includes:

[0028] The acquisition unit is used to obtain the entry point for the unpacked PE file data in memory based on the memory layout format when the PE file is normally called.

[0029] The execution unit is used to execute the program logic of the call entry point to start the unpacked PE file data.

[0030] In conjunction with the second aspect, in the third embodiment of the second aspect, the encrypted transmission channel is an asymmetric encrypted transmission channel.

[0031] In conjunction with the second aspect, in the fourth embodiment of the second aspect, the instruction receiving module is further configured to receive a PE file closing instruction;

[0032] The device further includes:

[0033] The memory release module is used to release the memory occupied by the unpacked PE file data through the shell program corresponding to the PE file closing instruction.

[0034] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing a program code confidentiality method described in any of the foregoing embodiments.

[0035] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement a program code confidentiality method as described in any of the foregoing embodiments.

[0036] This invention provides a method, apparatus, and electronic device for protecting program code. Upon receiving a PE file startup command, the device retrieves the packed PE file data from a cloud server via an encrypted transmission channel using a shell program. The retrieved packed PE file data is then directly loaded into memory for unpacking. Finally, the unpacked PE file data in memory is started. This invention places the PE file's program code on a cloud server, loading the PE file data into memory during use. This avoids creating a local file containing the actual source code, effectively reducing the size of the local PE file, increasing the difficulty of reverse engineering, and improving the security of the program code. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart of an embodiment of a program code confidentiality method provided by the present invention;

[0039] Figure 2 A flowchart of a second embodiment of a program code confidentiality method provided by the present invention;

[0040] Figure 3 A flowchart of a third embodiment of a program code confidentiality method provided by the present invention;

[0041] Figure 4 A flowchart of a program code confidentiality method according to an embodiment of the present invention;

[0042] Figure 5 A schematic diagram of the structure of a program code confidentiality device according to an embodiment of the present invention;

[0043] Figure 6 A schematic diagram of a second embodiment of a program code confidentiality device provided by the present invention;

[0044] Figure 7 A schematic diagram of the structure of a program code confidentiality device according to embodiment three of the present invention;

[0045] Figure 8 A schematic diagram of the structure of a program code confidentiality device according to an embodiment of the present invention (Embodiment 4);

[0046] Figure 9 This is a schematic diagram of the structure of an electronic device provided by the present invention. Detailed Implementation

[0047] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0048] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0049] Figure 1 This is a flowchart of an embodiment of a program code confidentiality method provided by the present invention. See also... Figure 1 The method includes the following steps S101-S104:

[0050] Step S101: Receive the PE file startup command.

[0051] In this embodiment, the startup command for the PE file originates from the user's mouse click event, or it may originate from calls to other PE files or applications, which is consistent with the current PE file startup method and does not change the user's usage habits, ensuring that the user experience is not affected.

[0052] Step S102: Obtain the packed PE file data from the cloud server through the shell program corresponding to the PE file startup instruction using an encrypted transmission channel.

[0053] In this embodiment, the PE file includes: a local shell program and a cloud server-side packed PE file data, wherein the packed PE file data includes PE program code. The PE file startup command only needs to specify the local shell program, which will obtain the packed PE file data from the cloud server through an encrypted transmission channel. This eliminates the need to pre-store the packed PE file data locally, effectively ensuring the security of the program code in the PE file.

[0054] Preferably, the encrypted transmission channel is an asymmetric encrypted transmission channel.

[0055] In this embodiment, an asymmetric encryption transmission channel is used to transmit the packed PE file. This ensures that the packed PE file is encrypted asymmetrically during transmission. Even if a malicious individual intercepts the encrypted packed PE file through the asymmetric encryption transmission channel, they cannot decrypt it without the corresponding key, thus offering the advantage of high decryption difficulty. Furthermore, since the PE file itself is also packed, reverse engineering is also quite difficult. Therefore, strict protection measures are implemented for both the transmission and data aspects of the PE file, improving the security of the PE file's program code.

[0056] Step S103: Load the packed PE file data into memory using the shell program for unpacking.

[0057] In this embodiment, the shell program directly loads the packed PE file data into memory for unpacking, ensuring that both the packed PE file data and the unpacked PE file remain in memory and do not form a specific data file locally. This increases the difficulty of reverse engineering and ensures the security of the PE file.

[0058] Step S104: Start the unpacked PE file data in memory.

[0059] This invention provides a method for protecting program code. Upon receiving a PE file startup command, the method retrieves the packed PE file data from a cloud server via an encrypted transmission channel using a shell program. The retrieved packed PE file data is then directly loaded into memory for unpacking. Finally, the unpacked PE file data in memory is started. This invention places the PE file's program code on the cloud server and in memory, avoiding the creation of a physical source code file. This effectively reduces the size of the local PE file, increases the difficulty of reverse engineering, and ensures the security of the program code.

[0060] Figure 2 This is a flowchart of a second embodiment of a program code confidentiality method provided by the present invention. See also... Figure 2 The method includes the following steps S201-S205:

[0061] S201: Receive PE file startup command.

[0062] S202: The shell program corresponding to the PE file startup instruction obtains the shelled PE file data from the cloud server through an encrypted transmission channel.

[0063] S203: The shell program loads the packed PE file data into memory for decryption and decompression to obtain the corresponding decrypted and decompressed first memory data.

[0064] S204: The shell program calls the preset PE loader to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtain the second memory data as the PE file data after unpacking.

[0065] The logic of the default PE loader is relatively fixed, which is to simulate the process of loading and deploying Windows DLLs into memory, such as the execution process Load, or NetDownload->Decrypt->Load, where Decrypt can be highly customized.

[0066] S205: Starts the unpacked PE file data in memory.

[0067] The present invention provides a method for protecting program code. After the local shell program obtains the packed PE file data from the cloud server, it directly loads the packed PE file data into memory for decryption and decompression to obtain the first memory data after decryption and decompression. Then, it calls a preset PE loader (i.e., a custom PE loader) to lay out the first memory data in memory according to the memory layout format of the PE file being called, thereby obtaining the unpacked PE file data. The whole process has the advantages of being convenient to implement and highly operable.

[0068] Figure 3 This is a flowchart of a second embodiment of a program code confidentiality method provided by the present invention. See also... Figure 3 The method includes the following steps S301-S305:

[0069] S301: Receives PE file startup instructions.

[0070] S302: The shell program corresponding to the PE file startup instruction obtains the shelled PE file data from the cloud server through an encrypted transmission channel.

[0071] S303: The shell program loads the packed PE file data into memory for unpacking.

[0072] S304: Based on the memory layout format when the PE file is normally invoked, obtain the entry point for calling the unpacked PE file data in memory.

[0073] Preferably, if the method of S203-S204 is used in S303 to load the packed PE file data into memory and perform unpacking processing to obtain the second memory data, then in S304, the entry point for the second memory data is obtained according to the memory layout format when the PE file is called normally.

[0074] S305: Execute the call entry point to start the program logic for the unpacked PE file data.

[0075] In this embodiment of the invention, the entry point for calling the PE file data is a call address. In S303, a preset PE file is loaded. However, after loading the PE file into memory, control of the current program flow needs to be transferred to the code within the PE file. At this point, it is necessary to obtain the call address of the first instruction of the PE file. For a DLL, this is a pre-defined exported function, or multiple exported functions. This is related to the loading process of the PE program and needs to be customized. Assuming the exported function is the DLL_EXPORT function, this invention will obtain the address of this function, ADDRESS_OF_DLL_EXEPORT, after loading is complete. Then, the overall execution flow is: NET_DWONLOADDECRYPTLOADPE EXECUTE_ADDRESS_OF_DLL_EXPORT DLL_XXXX, where DLL_XXXX represents the business logic flow of the PE file.

[0076] The present invention provides a method for keeping program code confidential. After obtaining the unpacked PE file data, the method obtains the call entry point according to the memory layout format when the PE file is normally called, and starts the program logic of the PE file data from the call entry point. Throughout the process, the call entry point of the PE file data will not be exposed to other programs, thereby effectively hiding the true entry point OEP of the program and preventing it from being cracked.

[0077] Figure 4 This is a flowchart of a fourth embodiment of a program code confidentiality method provided by an embodiment of the present invention. See also... Figure 4 The method includes the following steps S401-S406:

[0078] S401: Receives PE file startup instructions.

[0079] S402: The shell program corresponding to the PE file startup instruction obtains the shelled PE file data from the cloud server through an encrypted transmission channel.

[0080] S403: The shell program loads the packed PE file data into memory for unpacking.

[0081] S404: Startup memory contains the unpacked PE file data.

[0082] S405: Receives PE file closing command.

[0083] S406: Release the memory occupied by the unpacked PE file data through the shell program corresponding to the PE file closing instruction.

[0084] The present invention provides a method for protecting program code. After starting the unpacked PE file data in memory, the memory occupied by the unpacked PE file data is released when a PE file close command is received. This ensures that all program code data is in memory throughout the entire operation of the PE file data, and that the program code data is cleaned up in a timely manner after exiting, thereby effectively improving the security of the program code.

[0085] Figure 5 This is a schematic diagram of a program code confidentiality device according to an embodiment of the present invention.

[0086] like Figure 5 As shown, the device includes:

[0087] Instruction receiving module 1 is used to receive PE file startup instructions;

[0088] The data acquisition module 2 is used to acquire the shelled PE file data from the cloud server through the shell program corresponding to the PE file startup instruction in an encrypted transmission channel; preferably, the encrypted transmission channel is an asymmetric encrypted transmission channel.

[0089] The unpacking module 3 is used to load the packed PE file data into memory through the shell program for unpacking processing;

[0090] Startup module 4 is used to start the unpacked PE file data in memory.

[0091] The apparatus of this embodiment can be used to perform Figure 1 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0092] Figure 6 This is a schematic diagram of a second embodiment of a program code confidentiality device provided by an embodiment of the present invention. Figure 6 As shown, the device in this embodiment is Figure 5 Based on the structure of the device shown, the unpacking module 3 further includes:

[0093] The decryption and decompression unit 31 is used to load the data of the packed PE file into memory through the shell program for decryption and decompression, so as to obtain the corresponding first memory data after decryption and decompression.

[0094] The PE loading unit 32 is used to call a preset PE loader through the shell program to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtain the second memory data as the PE file data after unpacking.

[0095] The apparatus of this embodiment can be used to perform Figure 2 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0096] Figure 7 This is a schematic diagram of a third embodiment of a program code confidentiality device provided by an embodiment of the present invention. Figure 7 As shown, the device in this embodiment is Figure 5 Based on the structure of the device shown, the starting module 4 further includes:

[0097] The acquisition unit 41 is used to obtain the entry point for the unpacked PE file data in memory based on the memory layout format when the PE file is normally called.

[0098] The execution unit 42 is used to execute the program logic of the call entry to start the unpacked PE file data.

[0099] The apparatus of this embodiment can be used to perform Figure 3 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0100] Figure 8 This is a schematic diagram of a fourth embodiment of a program code confidentiality device provided by an embodiment of the present invention. Figure 8 As shown, the device in this embodiment is Figure 5 Based on the device structure shown, the instruction receiving module 1 is further used to receive PE file closing instructions;

[0101] The program code confidentiality device further includes:

[0102] The memory release module 5 is used to release the memory occupied by the unpacked PE file data through the shell program corresponding to the PE file closing instruction.

[0103] The apparatus of this embodiment can be used to perform Figure 4 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0104] This invention also provides an electronic device. Figure 9 This invention provides a schematic diagram of the structure of an electronic device, which can realize the invention. Figures 1-4 The process of the illustrated embodiment is as follows: Figure 9As shown, the aforementioned electronic device may include: a housing 91, a processor 92, a memory 93, a circuit board 94, and a power supply circuit 95. The circuit board 94 is disposed inside the space enclosed by the housing 91, and the processor 92 and the memory 93 are disposed on the circuit board 94. The power supply circuit 95 is used to supply power to various circuits or devices of the aforementioned electronic device. The memory 93 is used to store executable program code. The processor 92 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 93, for executing the program code confidentiality method described in any of the foregoing embodiments.

[0105] This electronic device exists in various forms, including but not limited to:

[0106] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0107] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0108] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video playback modules (e.g., iPod), handheld game consoles, e-book readers, as well as smart toys and portable car navigation devices.

[0109] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0110] (5) Other electronic devices with data interaction functions.

[0111] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement any of the program code confidentiality methods provided in the foregoing embodiments, thus achieving the corresponding technical effects. This has been described in detail above and will not be repeated here.

[0112] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0113] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0114] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0115] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0116] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for keeping program code confidential, characterized in that, include: Receive PE file boot command; The PE file boot command calls the local shell program to obtain the corresponding packed PE file data from the cloud server through an encrypted transmission channel; the program code of the PE file is divided into two parts: the local shell program and the packed PE file data from the cloud server. The local shell program does not contain the complete program code of the PE file. The shell program loads the packed PE file data into memory for unpacking. Start the unpacked PE file data in memory.

2. The program code confidentiality method as described in claim 1, characterized in that, The process of loading the packed PE file data into memory via the shell program for unpacking includes: The shell program loads the packed PE file data into memory for decryption and decompression to obtain the corresponding decrypted and decompressed first memory data. The shell program calls a preset PE loader to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtains the second memory data, which serves as the PE file data after unpacking.

3. The program code confidentiality method as described in claim 1 or 2, characterized in that, The unpacked PE file data in the boot memory includes: Based on the memory layout format when the PE file is normally invoked, obtain the entry point for the unpacked PE file data in memory. The program logic for executing the call entry point to start the unpacked PE file data is initiated.

4. The program code confidentiality method as described in claim 1, characterized in that, The encrypted transmission channel is an asymmetric encrypted transmission channel.

5. The program code confidentiality method as described in claim 1, characterized in that, Following the unpacked PE file data in the boot memory, the following is also included: Receive PE file close command; The shell program corresponding to the PE file closing instruction releases the memory occupied by the unpacked PE file data.

6. A program code security device, characterized in that, include: The instruction receiving module is used to receive PE file startup instructions; The data acquisition module is used to call the local shell program through the PE file boot instruction to obtain the packed PE file data corresponding to the PE file from the cloud server in an encrypted transmission channel; the program code of the PE file is divided into two parts: the local shell program and the packed PE file data of the cloud server, and the local shell program does not contain the complete program code of the PE file. The unpacking module is used to load the packed PE file data into memory through the shell program for unpacking processing; The startup module is used to start the unpacked PE file data in memory.

7. The program code confidentiality device as described in claim 6, characterized in that, The unpacking module includes: The decryption and decompression unit is used to load the packed PE file data into memory through the shell program for decryption and decompression, so as to obtain the corresponding decrypted and decompressed first memory data. The PE loading unit is used to call a preset PE loader through the shell program to lay out the first memory data in memory according to the memory layout format when the PE file is normally called, and obtain the second memory data as the PE file data after unpacking.

8. The program code confidentiality device as described in claim 6 or 7, characterized in that, The startup module includes: The acquisition unit is used to obtain the entry point for the unpacked PE file data in memory based on the memory layout format when the PE file is normally called. The execution unit is used to execute the program logic of the call entry point to start the unpacked PE file data.

9. The program code confidentiality device as described in claim 6, characterized in that, The encrypted transmission channel is an asymmetric encrypted transmission channel.

10. The program code confidentiality device as described in claim 6, characterized in that, The instruction receiving module is also used to receive PE file closing instructions; The device further includes: The memory release module is used to release the memory occupied by the unpacked PE file data through the shell program corresponding to the PE file closing instruction.

Images