An opaque predicate code obfuscation device and method based on floating-point type conversion and operation

Abstract

The present invention discloses an opaque predicate code obfuscation device and method based on floating-point type conversion and operation. The device includes a floating-point type conversion precision loss digit collection module, a floating-point addition operation precision loss digit collection module, a floating-point multiplication operation precision loss digit collection module, an opaque predicate database, an obfuscated code insertion point collection module, an opaque predicate construction module, and an opaque predicate code obfuscation implementation module. The present invention can construct a series of opaque predicates for code obfuscation of target software through pre-collected floating-point numbers or pairs of floating-point numbers that meet the conditions. The present invention can perform structural obfuscation on the code, and has the advantages of high concealment, good versatility, reversibility, low overhead, etc. The present invention can also balance the software performance requirements and software security requirements, and achieve enhanced protection of the software on demand with a lower overhead.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and particularly relates to an opaque predicate code obfuscation device and method based on floating-point type conversion and operation. Background Art

[0002] With the rapid development of computer technology, the application of computer software has become increasingly complex, with a wider range of application fields, gradually penetrating into all aspects of people's work and life. One of its negative impacts is that the number of vulnerabilities in computer software is proportional to the scale of computer software. At the same time, the development of information technology has also popularized computer technology, indirectly leading to a lower threshold for attacking computer software. Therefore, malicious behaviors such as software reverse engineering, software cracking, and software piracy have been increasing continuously, and software security issues have gradually become the focus and research direction widely concerned in the industry.

[0003] The demand for software security has given rise to a series of software protection technologies, which can be classified into hardware-based software protection technologies and software-based software protection technologies according to their implementation methods. Among them, software-based software protection technologies mainly include software tamper protection, software watermarking, software encryption, software anti-debugging, software virtual machine protection, code obfuscation, etc. Code obfuscation is widely used. It mainly rewrites part of the implementation logic in the code or modifies the identifier names in the software, etc., and modifies it while maintaining the original function of the program, mainly used to counter reverse engineering and create obstacles for attackers to understand and analyze the program. According to the different principles of code obfuscation, it can be divided into appearance obfuscation, control structure obfuscation, data obfuscation, and preventive obfuscation. Currently, the research on code obfuscation mainly focuses on control structure obfuscation. Most of the relevant research results are still in the theoretical research stage, and the relevant new technical methods often do not consider practicality, generality, and performance loss, resulting in difficulty in promotion. Therefore, a control structure obfuscation method with high generality, low overhead, good concealment, etc. is needed to improve software protection capabilities. Summary of the Invention

[0004] Currently, the research on code obfuscation mainly focuses on control structure obfuscation. Most of the relevant research results are still in the theoretical research stage, and the relevant new technical methods often do not consider practicality, generality, and performance loss, resulting in difficulty in promotion. Therefore, a control structure obfuscation method with high generality, low overhead, good concealment, etc. is needed to improve software protection capabilities. In view of the above problems, the present invention proposes an opaque predicate code obfuscation device and method based on floating-point type conversion and operation, which can construct a series of opaque predicates for code obfuscation of the target software through pre-collected floating-point numbers or pairs of floating-point numbers that meet the conditions.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] On the one hand, the present invention provides an opaque predicate code obfuscation device based on floating-point type conversion and operations, including a floating-point type conversion precision loss digit collection module, a floating-point addition operation precision loss digit collection module, a floating-point multiplication operation precision loss digit collection module, an opaque predicate database, an obfuscated code insertion point collection module, an opaque predicate construction module, and an opaque predicate code obfuscation implementation module;

[0007] The floating-point type conversion precision loss digit collection module is used to collect floating-point numbers with precision loss when the computer processes floating-point type conversion;

[0008] The floating-point addition operation precision loss digit collection module is used to collect pairs of floating-point numbers with precision loss when the computer performs floating-point addition;

[0009] The floating-point multiplication operation precision loss digit collection module is used to collect pairs of floating-point numbers with precision loss when the computer performs floating-point multiplication;

[0010] The opaque predicate database includes a floating-point type conversion array, a floating-point addition operation floating-point number pair array, and a floating-point multiplication operation floating-point number pair array, which are respectively used to store the data collected by the floating-point type conversion precision loss digit collection module, the floating-point addition operation precision loss digit collection module, and the floating-point multiplication operation precision loss digit collection module;

[0011] The opaque predicate construction module is used to generate opaque predicate code obfuscation code based on the data stored in the opaque predicate database;

[0012] The obfuscated code insertion point collection module is used to scan and collect the obfuscable points of the code to be obfuscated;

[0013] The opaque predicate code obfuscation implementation module is used to perform opaque predicate code obfuscation on the input code to be obfuscated based on the opaque predicate code obfuscation code generated by the opaque predicate construction module and the obfuscable points of the code to be obfuscated scanned and collected by the obfuscated code insertion point collection module.

[0014] Further, the opaque predicate construction module is specifically used for:

[0015] Select an opaque predicate construction method through a random algorithm; if the selected construction method is floating-point type conversion, randomly select a floating-point number from the floating-point type conversion array in the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point addition, randomly select a pair of floating-point numbers from the floating-point addition operation floating-point number pair array in the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point multiplication, randomly select a pair of floating-point numbers from the floating-point multiplication operation floating-point number pair array in the opaque predicate database to construct an opaque predicate.

[0016] Further, the obfuscation code insertion point collection module is specifically used for:

[0017] Create an array for storing obfuscation code insertion points, scan each function in the code to be obfuscated in the form of LLVM intermediate bytecode, identify each basic block in the function, and insert each basic block in the function into the array.

[0018] Further, the opaque predicate code obfuscation implementation module is specifically used for:

[0019] Convert the input code to be obfuscated into LLVM intermediate bytecode;

[0020] For each obfuscable point of the code to be obfuscated collected by the obfuscation code insertion point collection module, decide whether to perform code obfuscation according to the obfuscation probability provided by the user;

[0021] If code obfuscation needs to be performed, when performing opaque predicate obfuscation, first select an opaque predicate through the opaque predicate construction module;

[0022] And construct a basic block for false execution to counter the attacker's reverse analysis of the code;

[0023] Then, according to the jump relationship between the basic blocks constructed by the opaque predicate;

[0024] Compile the obfuscated LLVM intermediate bytecode into an executable file.

[0025] On the other hand, the present invention proposes an opaque predicate code obfuscation method based on floating-point type conversion and operation, including:

[0026] The floating-point type conversion precision loss digital collection module, the floating-point addition operation precision loss digital collection module, and the floating-point multiplication operation precision loss digital collection module respectively collect the floating-point numbers with precision loss when the computer processes floating-point type conversion, the floating-point number pairs with precision loss when the computer performs floating-point addition, and the floating-point number pairs with precision loss when the computer performs floating-point multiplication; and store them in the floating-point type conversion array, the floating-point addition operation floating-point number pair array, and the floating-point multiplication operation floating-point number pair array of the opaque predicate database respectively.

[0027] The opaque predicate construction module generates opaque predicate code obfuscation code based on the data stored in the opaque predicate database.

[0028] The obfuscation code insertion point collection module scans and collects the obfuscation points of the code to be obfuscated.

[0029] For each obfuscation point, it is decided whether to perform code obfuscation according to the obfuscation probability provided by the user. If code obfuscation needs to be performed, opaque predicate code obfuscation is carried out based on the opaque predicate code obfuscation implementation module.

[0030] Further, before the obfuscation code insertion point collection module scans and collects the obfuscation points of the code to be obfuscated, it further includes:

[0031] The opaque predicate code obfuscation implementation module converts the input code to be obfuscated into LLVM intermediate bytecode.

[0032] Further, the generating of the opaque predicate code obfuscation code based on the data stored in the opaque predicate database includes:

[0033] A method of constructing an opaque predicate is selected through a random algorithm; if the selected construction method is floating-point type conversion, a floating-point number is randomly selected from the floating-point type conversion array of the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point addition, a floating-point number pair is randomly selected from the floating-point addition operation floating-point number pair array of the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point multiplication, a floating-point number pair is randomly selected from the floating-point multiplication operation floating-point number pair array of the opaque predicate database to construct an opaque predicate.

[0034] Further, the scanning and collecting of the obfuscation points of the code to be obfuscated includes:

[0035] An array for storing obfuscation code insertion points is created, each function in the code to be obfuscated in the form of LLVM intermediate bytecode is scanned, each basic block in the function is identified, and each basic block in the function is inserted into the array.

[0036] Further, for each obfuscation point, it is determined whether to perform code obfuscation according to the obfuscation probability provided by the user. If code obfuscation needs to be performed, the opaque predicate code obfuscation based on the opaque predicate code obfuscation implementation module includes:

[0037] For each obfuscation point of the code to be obfuscated collected by the obfuscated code insertion point collection module, it is determined whether to perform code obfuscation according to the obfuscation probability provided by the user;

[0038] If code obfuscation needs to be performed, when performing opaque predicate obfuscation, first select an opaque predicate through the opaque predicate construction module;

[0039] And construct a basic block for false execution to counter the attacker's reverse analysis of the code;

[0040] Then, according to the opaque predicate, construct the jump relationship between basic blocks;

[0041] Compile the obfuscated LLVM intermediate bytecode into an executable file.

[0042] Compared with the prior art, the beneficial effects of the present invention are:

[0043] The present invention can construct a series of opaque predicates for code obfuscation of the target software through pre-collected eligible floating-point numbers or pairs of floating-point numbers. The present invention can perform structural obfuscation on the code, and has the advantages of high concealment, good generality, reversibility, low overhead, etc. The present invention can also balance the software performance requirements and software security requirements, and achieve enhanced protection of the software on demand with low overhead. The present invention can not only resist static analysis techniques, but also resist some dynamic analysis techniques. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic structural diagram of an opaque predicate code obfuscation device based on floating-point type conversion and operation disclosed in an embodiment of the present invention;

[0045] Figure 2 It is a flowchart of an opaque predicate code obfuscation method based on floating-point type conversion and operation disclosed in an embodiment of the present invention;

[0046] Figure 3 It is a flowchart of collecting floating-point type conversion precision loss numbers disclosed in an embodiment of the present invention;

[0047] Figure 4 It is a flowchart of collecting floating-point addition operation precision loss numbers disclosed in an embodiment of the present invention;

[0048] Figure 5Flowchart for collecting floating - point multiplication operation precision loss digits disclosed in embodiments of the present invention;

[0049] Figure 6 Flowchart for constructing opaque predicates based on floating - point type conversion or operations disclosed in embodiments of the present invention;

[0050] Figure 7 Flowchart for collecting obfuscation points disclosed in embodiments of the present invention;

[0051] Figure 8 Flowchart for obfuscating opaque predicate code disclosed in embodiments of the present invention. Detailed implementation manners

[0052] The following further explains the present invention in conjunction with the accompanying drawings and specific embodiments:

[0053] As Figure 1 shown, an opaque predicate code obfuscation device based on floating - point type conversion and operations includes a floating - point type conversion precision loss digit collection module, a floating - point addition operation precision loss digit collection module, a floating - point multiplication operation precision loss digit collection module, an opaque predicate database, an obfuscation code insertion point collection module, an opaque predicate construction module, and an opaque predicate code obfuscation implementation module;

[0054] The floating - point type conversion precision loss digit collection module is used to collect floating - point numbers with precision loss when the computer processes floating - point type conversion;

[0055] The floating - point addition operation precision loss digit collection module is used to collect pairs of floating - point numbers with precision loss when the computer performs floating - point addition;

[0056] The floating - point multiplication operation precision loss digit collection module is used to collect pairs of floating - point numbers with precision loss when the computer performs floating - point multiplication;

[0057] The opaque predicate database includes a floating - point type conversion array, a floating - point addition operation floating - point number pair array, and a floating - point multiplication operation floating - point number pair array, which are respectively used to store the data collected by the floating - point type conversion precision loss digit collection module, the floating - point addition operation precision loss digit collection module, and the floating - point multiplication operation precision loss digit collection module;

[0058] The opaque predicate construction module is used to generate opaque predicate code obfuscation code based on the data stored in the opaque predicate database;

[0059] The obfuscation code insertion point collection module is used to scan and collect the obfuscation points of the code to be obfuscated;

[0060] The opaque predicate code obfuscation implementation module is used to perform opaque predicate code obfuscation on the input code to be obfuscated, based on the opaque predicate code obfuscation code generated by the opaque predicate construction module and the obfuscation points of the code to be obfuscated scanned and collected by the obfuscation code insertion point collection module.

[0061] The specific functions of each module are introduced as follows:

[0062] 1. Floating-point type conversion precision loss number collection module

[0063] This module is responsible for collecting floating-point numbers with precision loss that occur during the computer's processing of floating-point type conversion. In terms of its specific construction, it is necessary to first screen infinite recurring decimals, and then use computer forced type conversion to test each infinite recurring decimal. The screening of infinite recurring decimals is achieved through fractions. First, select integers within a certain range, such as integers from 3 to 10,000, and remove multiples of 2 or 5. These numbers are used as the denominators to be selected. Traverse each denominator, and screen out each relatively prime number less than it as the numerator. Dividing them gives an infinite recurring decimal. Store this decimal in the double data type, perform a forced type conversion to the float type, and then convert it back to the double type. This process must be accompanied by precision loss. If the double-type decimal after this process is not equal to the original decimal, then the original decimal is placed in the floating-point type conversion array of the opaque predicate library.

[0064] 2. Floating-point addition operation precision loss number collection module

[0065] This module is responsible for collecting pairs of floating-point numbers with precision loss that occur during the computer's floating-point addition. In terms of its specific construction, randomly select two floating-point numbers in the computer. If the actual value of the sum of the two is not equal to the theoretical value, then this pair of floating-point numbers is placed in the floating-point addition operation floating-point number pair array of the opaque predicate library.

[0066] 3. Floating-point multiplication operation precision loss number collection module

[0067] This module is responsible for collecting pairs of floating-point numbers with precision loss that occur during the computer's floating-point multiplication. In terms of its specific construction, randomly select two floating-point numbers in the computer. If the actual value of the product of the two is not equal to the theoretical value, then this pair of floating-point numbers is placed in the floating-point multiplication operation floating-point number pair array of the opaque predicate library.

[0068] 4. Opaque predicate construction module

[0069] This module is responsible for generating opaque predicate code obfuscation code. Opaque predicate construction can be achieved through floating-point type conversion, floating-point addition operation, or floating-point multiplication operation. First, an opaque predicate construction method is selected through a random algorithm. If the selected construction method is floating-point type conversion, a floating-point number is randomly selected from the floating-point type conversion array in the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point addition, a floating-point pair is randomly selected from the floating-point addition operation floating-point pair array in the opaque predicate database to construct an opaque predicate, such as the opaque predicate "0.1 + 0.6 == 0.7" with a false value or the opaque predicate "0.1 + 0.6 != 0.7" with a true value; if the selected construction method is floating-point multiplication, a floating-point pair is randomly selected from the floating-point multiplication operation floating-point pair array in the opaque predicate database to construct an opaque predicate, such as the opaque predicate "0.1 * 0.3 == 0.03" with a false value or the opaque predicate "0.1 * 0.3 != 0.03" with a true value.

[0070] 5. Obfuscation Code Insertion Point Collection Module

[0071] This module is responsible for scanning and collecting the obfuscable points of the code to be obfuscated, facilitating subsequent opaque predicate code obfuscation processing. Its input is the code to be obfuscated in the form of LLVM intermediate bytecode. This module scans each function in the code to be obfuscated, identifies each basic block in the function, and puts them into an array.

[0072] 6. Opaque Predicate Code Obfuscation Implementation Module

[0073] The opaque predicate code obfuscation implementation module is responsible for implementing opaque predicate code obfuscation on the input code to be obfuscated. This module depends on LLVM, which is a modern and extensible compiler framework. Our code obfuscation takes the code to be obfuscated in the form of LLVM intermediate bytecode, including the human-readable text form with the file suffix ".ll" and the machine-processable binary format with the file suffix ".bc", and the output result is the LLVM intermediate bytecode after code obfuscation. If you want to obfuscate the code in the form of source code, you can use LLVM to first convert the source code into LLVM intermediate bytecode. If you only want to perform opaque predicate obfuscation on the code, you can compile the obfuscated LLVM intermediate bytecode into an executable file. You can also combine this opaque predicate obfuscation with other obfuscation methods, and the obfuscated LLVM intermediate bytecode is used as the input for subsequent obfuscation. The obfuscation code insertion points are provided by the obfuscation code insertion point collection module. For each obfuscation code insertion point, the opaque predicate code obfuscation implementation module is responsible for deciding whether to perform code obfuscation according to the obfuscation probability provided by the user. For example, if the obfuscation probability provided by the user is 10%, then there is a 10% probability of performing code obfuscation for each obfuscation code insertion point. When performing opaque predicate obfuscation, first, an opaque predicate needs to be selected through the opaque predicate construction module. Here, it is assumed that an opaque predicate with a false value is selected. In addition, we need to construct a basic block for false execution, which will never be executed and is only used to counter the attacker's reverse analysis of the code. The basic block at the obfuscation code insertion point is split into a head basic block, a middle basic block, and a tail basic block. Then, the opaque predicate construction module provides the if statement judgment condition, and the if statement is used as the subsequent basic block of the head basic block. The middle basic block is used as the code block corresponding to the case when the value of the if statement is false, and the tail basic block is used as its absolute jump address. The basic block for false execution is used as the code block corresponding to the case when the value of the if statement is true, and the middle basic block or a neighboring basic block is used as its absolute jump address. If an opaque predicate with a true value is selected, the roles of the middle basic block and the basic block for false execution can be interchanged.

[0074] Based on the above embodiments, as Figure 2 shown, the present invention also proposes an opaque predicate code obfuscation method based on floating-point type conversion and operation, including:

[0075] S101: Opaque predicate database construction: The floating-point number type conversion precision loss number collection module, the floating-point number addition operation precision loss number collection module, and the floating-point number multiplication operation precision loss number collection module respectively collect the floating-point numbers with precision loss when the computer processes floating-point number type conversion, the floating-point number pairs with precision loss when the computer performs floating-point number addition, and the floating-point number pairs with precision loss when the computer performs floating-point number multiplication; and store them in the floating-point number type conversion array, the floating-point number addition operation floating-point number pair array, and the floating-point number multiplication operation floating-point number pair array of the opaque predicate database respectively;

[0076] S102: The opaque predicate construction module generates opaque predicate code obfuscation code based on the data stored in the opaque predicate database;

[0077] S103: The obfuscation code insertion point collection module scans and collects the obfuscable points of the code to be obfuscated;

[0078] S104: For each obfuscable point, it is decided whether to perform code obfuscation according to the obfuscation probability provided by the user. If code obfuscation is required, opaque predicate code obfuscation is performed based on the opaque predicate code obfuscation implementation module.

[0079] Further, before S103, it also includes:

[0080] The input code to be obfuscated is converted into LLVM intermediate bytecode through the opaque predicate code obfuscation implementation module.

[0081] Further, in S101, as Figure 3 shown, the floating-point numbers with precision loss collected by the floating-point number type conversion precision loss number collection module when the computer processes floating-point number type conversion specifically include:

[0082] S201: Create a floating-point number type conversion array in the opaque predicate library;

[0083] S202: Screen the denominators that meet the conditions;

[0084] S203: Use relatively prime numbers smaller than the denominator as the numerators;

[0085] S204: Divide the numerator by the denominator;

[0086] S205: Whether the result is not equal to the logical value after two forced type conversions. If so, execute S206, otherwise end;

[0087] S206: Insert the floating-point number into the floating-point number type conversion array in the opaque predicate library.

[0088] Further, in S101, as Figure 4As shown in the figure, the floating-point number pairs with precision loss occurring during floating-point addition in a computer collected by the precision loss number collection module for floating-point addition operations include:

[0089] S301: Create an array for floating-point addition operations in the opaque predicate library;

[0090] S302: Randomly select two floating-point numbers;

[0091] S303: The computer calculates the sum of the two floating-point numbers;

[0092] S304: Whether the actual value of the calculation result is equal to the logical value. If so, execute S305; otherwise, end;

[0093] S305: Insert the floating-point number pair into the array for floating-point addition operations in the opaque predicate library.

[0094] Furthermore, in S101, as Figure 5 shown, the floating-point number pairs with precision loss occurring during floating-point multiplication in a computer collected by the precision loss number collection module for floating-point multiplication operations include:

[0095] S401: Create an array for floating-point multiplication operations in the opaque predicate library;

[0096] S402: Randomly select two floating-point numbers;

[0097] S403: The computer calculates the product of the two floating-point numbers;

[0098] S404: Whether the actual value of the calculation result is equal to the logical value. If so, execute S405; otherwise, end;

[0099] S405: Insert the floating-point number pair into the array for floating-point multiplication operations in the opaque predicate library.

[0100] Furthermore, as Figure 6 shown, the generation of the opaque predicate code obfuscation code based on the data stored in the opaque predicate database includes:

[0101] S501: Randomly select whether to use floating-point type conversion to construct an opaque predicate. If so, execute S502; otherwise, execute S503;

[0102] S502: Select a certain floating-point number in the floating-point type conversion array in the opaque predicate database, and then execute S506;

[0103] S503: Randomly select whether to use floating-point addition operations to construct an opaque predicate. If so, execute S504; otherwise, execute S505;

[0104] S504: Select a floating - point number pair in the floating - point addition operation array in the opaque predicate database, and then execute S506;

[0105] S505: Select a floating - point number pair in the floating - point multiplication operation array in the opaque predicate database, and then execute S506;

[0106] S506: Generate an opaque predicate statement according to the provided information.

[0107] Further, as Figure 7 shown, the scanning and collecting of the obfuscation points of the code to be obfuscated include:

[0108] S601: Create an array for storing the insertion points of the obfuscated code;

[0109] S602: Scan each function in the code to be obfuscated in the form of LLVM intermediate bytecode;

[0110] S603: Identify each basic block in the function and insert each basic block of the function into the array.

[0111] Further, as Figure 8 shown, for each obfuscation point, decide whether to perform code obfuscation according to the obfuscation probability provided by the user. If code obfuscation needs to be performed, the opaque predicate code obfuscation based on the opaque predicate code obfuscation implementation module includes:

[0112] S701: Convert the source code into LLVM intermediate bytecode;

[0113] S702: For each obfuscation point of the code to be obfuscated collected by the obfuscated code insertion point collection module, decide whether to perform code obfuscation according to the obfuscation probability provided by the user;

[0114] S703: If code obfuscation needs to be performed, when performing opaque predicate obfuscation, first select an opaque predicate through the opaque predicate construction module;

[0115] S704: And construct a basic block for false execution to counter the attacker's reverse analysis of the code;

[0116] S705: Then construct the jump relationship between basic blocks according to the opaque predicate;

[0117] S706: Compile the obfuscated LLVM intermediate bytecode into an executable file.

[0118] In summary, through the pre-collected qualified floating-point numbers or floating-point number pairs, the present invention can construct a series of opaque predicates for code obfuscation of the target software. The present invention can perform structural obfuscation on the code, and has the advantages of high concealment, good generality, reversibility, low overhead, etc. The present invention can also balance the software performance requirements and software security requirements, and achieve enhanced protection of the software on demand with lower overhead. The present invention has reversibility and can restore the obfuscated program under special circumstances; it can not only resist static analysis techniques, but also resist some dynamic analysis techniques.

[0119] The above are only the preferred embodiments of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. An opaque predicate code obfuscation device based on floating-point type conversion and operations, characterized in that It includes a floating-point type conversion precision loss digit collection module, a floating-point addition operation precision loss digit collection module, a floating-point multiplication operation precision loss digit collection module, an opaque predicate database, a obfuscated code insertion point collection module, an opaque predicate construction module, and an opaque predicate code obfuscation implementation module; The floating-point type conversion precision loss digit collection module is used to collect floating-point numbers with precision loss that occur during the computer's processing of floating-point type conversion; The floating-point addition operation precision loss digit collection module is used to collect pairs of floating-point numbers with precision loss that occur during the computer's floating-point addition; The floating-point multiplication operation precision loss digit collection module is used to collect pairs of floating-point numbers with precision loss that occur during the computer's floating-point multiplication; The opaque predicate database includes a floating-point type conversion array, a floating-point addition operation floating-point number pair array, and a floating-point multiplication operation floating-point number pair array, which are respectively used to store the data collected by the floating-point type conversion precision loss digit collection module, the floating-point addition operation precision loss digit collection module, and the floating-point multiplication operation precision loss digit collection module; The opaque predicate construction module is used to generate opaque predicate code obfuscation code based on the data stored in the opaque predicate database; The opaque predicate construction module specifically is used to: select an opaque predicate construction method through a random algorithm; if the selected construction method is floating-point type conversion, randomly select a floating-point number from the floating-point type conversion array in the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point addition, randomly select a pair of floating-point numbers from the floating-point addition operation floating-point number pair array in the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point multiplication, randomly select a pair of floating-point numbers from the floating-point multiplication operation floating-point number pair array in the opaque predicate database to construct an opaque predicate; The obfuscated code insertion point collection module is used to scan and collect the obfuscable points of the code to be obfuscated; The opaque predicate code obfuscation implementation module is used to perform opaque predicate code obfuscation on the input code to be obfuscated based on the opaque predicate code obfuscation code generated by the opaque predicate construction module and the obfuscable points of the code to be obfuscated scanned and collected by the obfuscated code insertion point collection module; The opaque predicate code obfuscation implementation module specifically is used to: convert the input code to be obfuscated into LLVM intermediate bytecode; for each obfuscable point of the code to be obfuscated collected by the obfuscated code insertion point collection module, decide whether to perform code obfuscation according to the obfuscation probability provided by the user; If code obfuscation needs to be performed, when performing opaque predicate obfuscation, first select an opaque predicate through the opaque predicate construction module; and construct a basic block for false execution to counter the attacker's reverse analysis of the code; then construct the jump relationship between basic blocks according to the opaque predicate; compile the obfuscated LLVM intermediate bytecode into an executable file.

2. The opaque predicate code obfuscation device based on floating-point type conversion and operation according to claim 1, characterized in that, The obfuscated code insertion point collection module specifically is used to: Create an array for storing the insertion points of obfuscated code, scan each function in the code to be obfuscated in the form of LLVM intermediate bytecode, identify each basic block in the function, and insert each basic block in the function into the array.

3. A method for obfuscating opaque predicates based on floating-point type conversion and operation of an opaque predicate code obfuscation device according to any one of claims 1-2, characterized in that, Including: Collect the floating-point numbers with precision loss during computer floating-point type conversion, the floating-point number pairs with precision loss during computer floating-point addition, and the floating-point number pairs with precision loss during computer floating-point multiplication through the floating-point type conversion precision loss number collection module, the floating-point addition operation precision loss number collection module, and the floating-point multiplication operation precision loss number collection module respectively; and store them in the floating-point type conversion array, the floating-point addition operation floating-point number pair array, and the floating-point multiplication operation floating-point number pair array of the opaque predicate database respectively. Generate opaque predicate code obfuscated code through the opaque predicate construction module based on the data stored in the opaque predicate database. The generating opaque predicate code obfuscated code based on the data stored in the opaque predicate database includes: randomly selecting an opaque predicate construction method through a random algorithm; if the selected construction method is floating-point type conversion, randomly select a floating-point number from the floating-point type conversion array of the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point addition, randomly select a floating-point number pair from the floating-point addition operation floating-point number pair array of the opaque predicate database to construct an opaque predicate; if the selected construction method is floating-point multiplication, randomly select a floating-point number pair from the floating-point multiplication operation floating-point number pair array of the opaque predicate database to construct an opaque predicate. Scan and collect the obfuscation points of the code to be obfuscated through the obfuscated code insertion point collection module. For each obfuscation point, determine whether to perform code obfuscation according to the obfuscation probability provided by the user. If code obfuscation is required, perform opaque predicate code obfuscation based on the opaque predicate code obfuscation implementation module; the determining whether to perform code obfuscation for each obfuscation point according to the obfuscation probability provided by the user and performing opaque predicate code obfuscation based on the opaque predicate code obfuscation implementation module if code obfuscation is required includes: for each obfuscation point of the code to be obfuscated collected by the obfuscated code insertion point collection module, determine whether to perform code obfuscation according to the obfuscation probability provided by the user; if code obfuscation is required, when performing opaque predicate obfuscation, first select an opaque predicate through the opaque predicate construction module; and construct a basic block for false execution to counter the attacker's reverse analysis of the code; then according to the jump relationship between the opaque predicate construction basic blocks, compile the obfuscated LLVM intermediate bytecode into an executable file.

4. An opaque predicate code obfuscation method based on floating-point type conversion and operation according to claim 3, characterized in that Before the scanning and collecting the obfuscation points of the code to be obfuscated through the obfuscated code insertion point collection module, it also includes: Convert the input code to be obfuscated into LLVM intermediate bytecode through the opaque predicate code obfuscation implementation module.

5. An opaque predicate code obfuscation method based on floating-point type conversion and operation according to claim 4, characterized in that The scanning and collecting the obfuscation points of the code to be obfuscated includes: Create an array for storing the insertion points of obfuscated code, scan each function in the code to be obfuscated in the form of LLVM intermediate bytecode, identify each basic block in the function, and insert each basic block in the function into the array.

Images