Method and device for multi-dimensional virtualization protection of programs based on llvm ir

Abstract

The application relates to an LLVM IR-based program multidimensional virtualization protection method and device. The method comprises the following steps: acquiring an LLVM IR file of a source code; performing instruction-level virtualization protection on the LLVM IR file to obtain a once-protected file; determining a to-be-protected function in the once-protected file; determining a plurality of basic blocks constituting the to-be-protected function, and constructing a virtual machine module based on the plurality of basic blocks; replacing the to-be-protected function in the source code with an instruction for calling the virtual machine module to obtain a program protected by multidimensional virtualization. The application designs a basic block-level virtualization protection means, and combines the instruction-level virtualization protection means to perform protection processing on an IR bytecode file generated by an LLVM compiler, so that the difficulty of reverse cracking can be greatly improved. Virtualization protection in the intermediate representation stage can reduce the influence of the diversity of front-end languages and back-end architectures on the virtualization protection of codes.

Description

Technical Field

[0001] This application relates to the field of computer security technology, specifically to a method and apparatus for multi-dimensional virtualization protection of programs based on LLVM IR. Background Technology

[0002] Existing program security issues stem from malicious reverse engineering attacks. Reverse engineers analyze the software's working principles and internal implementation details to obtain critical information and pinpoint key locations within the program. They can then manually modify or delete these critical parts of the code. Code obfuscation is a technique to resist reverse engineering attacks, and among existing techniques, a dynamic obfuscation method—virtualization protection—offers the highest level of protection. However, virtualization protection technology has been around for many years, and the structure of virtual machines is well-known. Reverse engineers can analyze the virtual machine's structural characteristics to crack it. Therefore, traditional virtualization protection methods are susceptible to being cracked, and their self-protection capabilities are relatively weak.

[0003] Virtualization protection involves embedding a virtual machine into the target program, breaking down the original instructions into virtual instructions within the virtual machine. During program execution, a large amount of code logic is incorporated and interpreted by the virtual machine, increasing the complexity for malicious attackers to reverse engineer the program's logic. Therefore, while improving protection effectiveness, it suffers from significant performance and size overhead. If traditional virtualization protection techniques are used in conjunction with this approach, the performance overhead can increase hundreds of times, rendering the technology unusable. Summary of the Invention

[0004] To overcome at least one deficiency in the prior art, embodiments of this application provide a method and apparatus for multi-dimensional virtualization protection of programs based on LLVM IR.

[0005] Firstly, a method for multi-dimensional virtualization protection of programs based on LLVM IR is provided, including:

[0006] Obtain the LLVM IR file from the source code;

[0007] Perform instruction-level virtualization protection on the LLVM IR file to obtain a protected file;

[0008] Identify the functions to be protected in the file after one protection step;

[0009] Identify the multiple basic blocks that constitute the function to be protected, and construct a virtual machine module based on the multiple basic blocks;

[0010] By replacing the functions to be protected in the source code with instructions that call virtual machine modules, a program with multi-dimensional virtualization protection is obtained.

[0011] In one embodiment, multiple basic blocks constituting the function to be protected are determined, and a virtual machine module is constructed based on the multiple basic blocks, including:

[0012] Create multiple empty basic blocks equal in number to the number of basic blocks of the function to be protected;

[0013] Copy the instructions of each basic block of the function to be protected to the corresponding empty basic block, configure the predecessor and successor of each empty basic block, and obtain multiple handler basic blocks;

[0014] Assign a virtual instruction code to each handler basic block;

[0015] The virtual instruction codes corresponding to multiple handler basic blocks are stored in an array according to the execution logic to form driver data. When the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction codes in the driver data and executes the instructions in the handler basic block.

[0016] In one embodiment, building a virtual machine module based on multiple basic blocks further includes:

[0017] The virtual machine module is created using multiple components, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component.

[0018] When the virtual machine module executes the program, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing, and jump to the scheduler component; the scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier, so as to determine the next handler basic block to be executed.

[0019] The Exit Component is used to exit the virtual machine module after all handler basic blocks have been executed.

[0020] Secondly, a multi-dimensional virtualization protection device for programs based on LLVM IR is provided, comprising:

[0021] The LLVM IR file acquisition unit is used to acquire the LLVM IR file of the source code;

[0022] The instruction-level virtualization protection unit is used to perform instruction-level virtualization protection on LLVM IR files, resulting in a protected file.

[0023] The function to be protected unit is used to determine the functions to be protected in the file after one protection.

[0024] Virtual machine building units are used to determine multiple basic blocks that constitute the function to be protected, and to build virtual machine modules based on multiple basic blocks;

[0025] The program refactoring unit is used to replace the functions to be protected in the source code with instructions that call virtual machine modules, so as to obtain a program with multi-dimensional virtualization protection.

[0026] In one embodiment, the virtual machine building unit is further configured to:

[0027] Create multiple empty basic blocks equal in number to the number of basic blocks of the function to be protected;

[0028] Copy the instructions of each basic block of the function to be protected to the corresponding empty basic block, configure the predecessor and successor of each empty basic block, and obtain multiple handler basic blocks;

[0029] Assign a virtual instruction code to each handler basic block;

[0030] The virtual instruction codes corresponding to multiple handler basic blocks are stored in an array according to the execution logic to form driver data. When the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction codes in the driver data and executes the instructions in the handler basic block.

[0031] In one embodiment, the virtual machine building unit is also used for:

[0032] The virtual machine module is created using multiple components, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component.

[0033] When the virtual machine module executes the program, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing and jump to the scheduler component; the scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier, so as to determine the next handler basic block to be executed; the exit component is used to exit the virtual machine module after all handler basic blocks have been executed.

[0034] Compared with existing technologies, this application has the following advantages: This application designs a basic block-level virtualization protection method and combines it with an instruction-level virtualization protection method to protect the LLVM IR (Intermediate Representation) bytecode file generated by the LLVM (Low Level Virtual Machine) compiler. This can significantly increase the difficulty of reverse engineering. Performing virtualization protection at the intermediate representation stage can reduce the impact of the diversity of front-end languages ​​and back-end architectures on the virtualization protection of the code. Attached Figure Description

[0035] This application can be better understood by referring to the description given below in conjunction with the accompanying drawings, which, together with the detailed description below, are incorporated in and form part of this specification. In the drawings:

[0036] Figure 1 A flowchart of a method for multi-dimensional virtualization protection of programs based on LLVM IR according to an embodiment of this application is shown;

[0037] Figure 2 A schematic diagram of a program multi-dimensional virtualization protection method based on LLVM IR according to an embodiment of this application is shown;

[0038] Figure 3 A structural block diagram of a program multidimensional virtualization protection device based on LLVM IR according to an embodiment of this application is shown. Detailed Implementation

[0039] Exemplary embodiments of the present application will be described below with reference to the accompanying drawings. For clarity and brevity, not all features of the actual embodiments are described in the specification. However, it should be understood that many embodiment-specific decisions can be made in the development of any such actual embodiment to achieve the developer’s specific objectives, and these decisions may vary as the embodiments differ.

[0040] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the device structure closely related to the solution according to this application is shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0041] It should be understood that this application is not limited to the described embodiments by virtue of the following description with reference to the accompanying drawings. In this document, embodiments may be combined with each other, features may be substituted or borrowed between different embodiments, and one or more features may be omitted in one embodiment, where feasible.

[0042] Based on the concept of code virtualization protection, this application provides a multi-dimensional virtualization protection method for programs based on LLVM IR, which is a code obfuscation protection method. The object of virtualization protection in this application is the LLVM IR (Intermediate Representation) bytecode file generated by the LLVM (Low-Level Virtual Machine) compiler. After instruction-level virtualization protection, basic block-level virtualization protection is then performed, thus providing obfuscation protection for the program at a higher dimension.

[0043] Figure 1 A flowchart of a method for multi-dimensional virtualization protection of programs based on LLVM IR according to an embodiment of this application is shown. The method includes:

[0044] Step S110: Obtain the LLVM IR file of the source code; here, the source code is processed by the front end of the LLVM compiler to generate the IR bytecode file LLVM IR.

[0045] Step S120: Perform instruction-level virtualization protection on the LLVM IR file to obtain a protected file, denoted as LLVM IR-A.

[0046] Step S130: Determine the functions to be protected in the file after one protection; the source code includes multiple functions, and set custom tags for the functions to be protected. Here, the function can be identified as a function to be protected based on the tag. A specified string of characters is added as a marker when defining the function name.

[0047] Step S140: Determine multiple basic blocks constituting the function to be protected, and construct a virtual machine module based on the multiple basic blocks; a basic block is a combination of one or more instructions, which has a unique entry point pointing to the beginning of the block and a unique exit point pointing to the end of the block. Therefore, there is at most one jump instruction in a basic block, and it appears at the end of the basic block; a function generally has more than one basic block. Since the implementation of conditional statements, comparison statements, loop statements, etc. in a function all require the use of jump instructions, a function is composed of one or more basic blocks;

[0048] Step S150: Replace the functions to be protected in the source code with instructions that call the virtual machine module to obtain the program after multi-dimensional virtualization protection. In this step, the functions to be protected in the source code are replaced with instructions that call the virtual machine module, and the necessary information of the functions to be protected is retained. The necessary information may be function attribute information, such as whether the function is public or private, inheritance information, whether the function is inlined, and the function's linking type.

[0049] In this embodiment, a basic block-level virtualization protection method is designed, combined with an instruction-level virtualization protection method, to protect the LLVM IR bytecode file generated by the LLVM compiler. This can significantly increase the difficulty of reverse engineering. Performing virtualization protection at the intermediate representation stage can reduce the impact of the diversity of front-end languages ​​and back-end architectures on the virtualization protection of the code.

[0050] In one embodiment, Figure 2 The diagram illustrates a schematic of a multi-dimensional virtualization protection method for programs based on LLVM IR according to an embodiment of this application. Step S130, which determines multiple basic blocks constituting the function to be protected and constructs a virtual machine module based on these basic blocks, may include:

[0051] Step S210: Create multiple empty basic blocks, the same number as the number of basic blocks of the function to be protected;

[0052] Step S220: Copy the instructions of each basic block of the function to be protected to the corresponding empty basic block, configure the predecessor and successor of each empty basic block, and obtain multiple handler basic blocks. Here, when creating multiple empty basic blocks, no predecessor and successor are associated with the empty basic blocks, so it is necessary to configure the predecessor and successor associated with the empty basic blocks into the empty basic blocks.

[0053] Step S230: Assign a virtual instruction code to each handler basic block;

[0054] In step S240, the virtual instruction codes corresponding to multiple handler basic blocks are stored in an array according to the execution logic to form driver data. When the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction codes in the driver data and executes the instructions in the handler basic block.

[0055] In this embodiment, the virtual instruction code allocated to the handler basic block in the virtual machine module is random, and the process of extracting the handler basic block of the function is also random. Therefore, the results obtained after each virtualization protection are different, which will increase the difficulty of reverse engineering. It is difficult for reverse engineers to obtain some useful information by studying and analyzing a single file, and the analysis of multiple files is also extremely difficult, which increases the strength of protection.

[0056] In one embodiment, building a virtual machine module based on multiple basic blocks further includes:

[0057] The virtual machine module is created using multiple components, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component.

[0058] When the virtual machine module executes the program, which is the multi-dimensional virtualization protected program obtained in step S150, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing and jump to the scheduler component; the scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier to determine the next handler basic block to be executed; the exit component is used to exit the virtual machine module after all handler basic blocks have been executed.

[0059] Based on the same inventive concept as the above-mentioned LLVM IR-based multi-dimensional virtualization protection method for programs, this embodiment also provides a corresponding LLVM IR-based multi-dimensional virtualization protection device. Figure 3 A structural block diagram of a program multi-dimensional virtualization protection device based on LLVM IR according to an embodiment of this application is shown, including:

[0060] LLVM IR file acquisition unit 310 is used to acquire the LLVM IR file of the source code; here, the source code is generated into an IR bytecode file LLVM IR by the front end of the LLVM compiler.

[0061] The instruction-level virtualization protection unit 320 is used to perform instruction-level virtualization protection on LLVM IR files, resulting in a protected file, denoted as LLVM IR-A.

[0062] The function to be protected determination unit 330 is used to determine the functions to be protected in the file after one protection. The source code includes multiple functions, and custom tags are set for the functions to be protected. Here, the function can be identified as a function to be protected based on the tag.

[0063] Virtual machine construction unit 340 is used to determine multiple basic blocks that constitute the function to be protected, and to construct a virtual machine module based on the multiple basic blocks;

[0064] The program refactoring unit 350 is used to replace the functions to be protected in the source code with instructions that call virtual machine modules, resulting in a program with multi-dimensional virtualization protection. Here, the functions to be protected in the source code are replaced with instructions that call virtual machine modules, while retaining the necessary information of the functions to be protected. The necessary information may be function attribute information, such as whether the function is public or private, inheritance information, whether the function is inlined, and the function's linking type.

[0065] This application's embodiments design a basic block-level virtualization protection method, combined with an instruction-level virtualization protection method, to protect the LLVM IR bytecode file generated by the LLVM compiler. This significantly increases the difficulty of reverse engineering and has a smaller impact on program performance and size. Performing virtualization protection at the intermediate representation stage can reduce the impact of the diversity of front-end languages ​​and back-end architectures on code virtualization protection.

[0066] In one embodiment, the virtual machine building unit 340 is further configured to:

[0067] Create multiple empty basic blocks equal in number to the number of basic blocks of the function to be protected;

[0068] The instructions of each basic block of the function to be protected are copied to the corresponding empty basic block. The predecessor and successor of each empty basic block are configured to obtain multiple handler basic blocks. Here, when multiple empty basic blocks are created, their predecessors and successors are not associated with them. Therefore, the predecessors and successors associated with the empty basic blocks need to be configured in the empty basic blocks.

[0069] Assign a virtual instruction code to each handler basic block;

[0070] The virtual instruction codes corresponding to multiple handler basic blocks are stored in an array according to the execution logic to form driver data. When the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction codes in the driver data and executes the instructions in the handler basic block.

[0071] In one embodiment, the virtual machine building unit 340 is further configured to:

[0072] The virtual machine module is created using multiple components, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component.

[0073] When the virtual machine module executes the program, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing and jump to the scheduler component; the scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier, so as to determine the next handler basic block to be executed; the exit component is used to exit the virtual machine module after all handler basic blocks have been executed.

[0074] The above descriptions are merely various embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for multi-dimensional virtualization protection of programs based on LLVM IR, characterized in that, include: Obtain the LLVM IR file from the source code; The LLVM IR file is subjected to instruction-level virtualization protection to obtain a protected file. Determine the functions to be protected in the file after the first protection step; Determine multiple basic blocks constituting the function to be protected, and construct a virtual machine module based on the multiple basic blocks, including: Create multiple empty basic blocks, the same number as the number of basic blocks of the function to be protected; The instructions of each basic block of the function to be protected are copied into the corresponding empty basic block, and the predecessor and successor of each empty basic block are configured to obtain multiple handler basic blocks; A virtual instruction code is assigned to each of the aforementioned handler basic blocks; The virtual instruction codes corresponding to the multiple handler basic blocks are stored in an array according to the execution logic to form driver data; when the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction codes in the driver data and executes the instructions in the handler basic block. The function to be protected in the source code is replaced with an instruction that calls the virtual machine module to obtain a program with multi-dimensional virtualization protection.

2. The method as described in claim 1, characterized in that, The virtual machine module built upon the aforementioned basic blocks also includes: Multiple components are created for the virtual machine module, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component; When the virtual machine module executes the program, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing, and jump to the scheduler component; the scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier, so as to determine the next handler basic block to be executed. The exit component is used to exit the virtual machine module after all handler basic blocks have been executed.

3. A program multi-dimensional virtualization protection device based on LLVM IR, characterized in that, include: The LLVM IR file acquisition unit is used to acquire the LLVM IR file of the source code; An instruction-level virtualization protection unit is used to perform instruction-level virtualization protection on the LLVM IR file to obtain a file after one level of protection; The function to be protected unit is used to determine the function to be protected in the file after the first protection. A virtual machine construction unit is used to determine multiple basic blocks that constitute the function to be protected, and to construct a virtual machine module based on the multiple basic blocks; The program refactoring unit is used to replace the function to be protected in the source code with instructions that call the virtual machine module, so as to obtain a program with multi-dimensional virtualization protection. The virtual machine construction unit is also used for: Create multiple empty basic blocks, the same number as the number of basic blocks of the function to be protected; The instructions of each basic block of the function to be protected are copied into the corresponding empty basic block, and the predecessor and successor of each empty basic block are configured to obtain multiple handler basic blocks; A virtual instruction code is assigned to each of the aforementioned handler basic blocks; The virtual instruction codes corresponding to the multiple handler basic blocks are stored in an array according to the execution logic to form driver data; When the virtual machine module executes the program, it determines the handler basic block to be executed based on the virtual instruction code in the driver data, and executes the instructions in the handler basic block.

4. The apparatus as described in claim 3, characterized in that, The virtual machine building unit is also used for: Multiple components are created for the virtual machine module, including an entry component, a scheduler component, a running status identifier, a tail component, and an exit component; When the virtual machine module executes the program, the entry component is used for initialization configuration; the value of the running status identifier is used to record the position of the virtual instruction code corresponding to the next handler basic block to be executed in the driver data; the tail component is used to modify the value of the running status identifier after the current handler basic block has finished executing, and jump to the scheduler component. The scheduler component is used to obtain the virtual instruction code corresponding to the next handler basic block to be executed from the driver data according to the value of the running status identifier, so as to determine the next handler basic block to be executed; the exit component is used to exit the virtual machine module after all handler basic blocks have been executed.

Images