Anti-cracking application running method and device, computer equipment and medium
By performing trustworthiness checks on bytecode at application startup and using a proxy to repair untrusted code, the problem of application vulnerability is solved, achieving higher security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- KINGDEE SOFTWARE(CHINA) CO LTD
- Filing Date
- 2022-12-05
- Publication Date
- 2026-05-12
AI Technical Summary
Existing applications are easily decompiled and cracked, posing a security threat. Obfuscated compilation methods are insufficient to effectively prevent cracking.
When the application starts, the trustworthiness of the target code in bytecode form already loaded in the target virtual machine is checked, and the untrusted code is repaired by loading a backup set of target code through an agent program.
It improves application security, prevents cracking, and ensures that the application can still function normally even after being cracked.
Smart Images
Figure CN116204855B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of application technology, and in particular to a method, apparatus, computer device, medium, and computer program product for running applications that are resistant to cracking. Background Technology
[0002] With the development of computer technology, applications have emerged. Applications can be written using computer programming languages. In a development scenario, applications are written by developers using high-level languages, forming the application's source code in high-level language form. This high-level language source code needs to be compiled before it can be executed by a computer. For example, an application written in the Java programming language needs to be compiled into Java bytecode, which is then interpreted into machine code by the Java Virtual Machine for execution. Once an application is developed and put into use, it is easily decompiled back into its high-level language source code, making it vulnerable to cracking. Running a cracked application can pose a security threat to the application's runtime environment. Currently, to prevent applications from being cracked, obfuscation compilation is commonly used to compile the high-level language source code.
[0003] However, obfuscated compilation can only compile a portion of the application's code, making it vulnerable to brute-force attacks and resulting in low application security. Summary of the Invention
[0004] Therefore, it is necessary to provide a method, apparatus, computer device, medium, and computer program product that can improve the security of applications and prevent cracking, in order to address the above-mentioned technical problems.
[0005] Firstly, this application provides a method for running an application that is resistant to cracking. The method includes:
[0006] In response to the launch of the application, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test result is obtained;
[0007] When the detection result indicates that the target code is untrusted, load the agent program;
[0008] A set of backup target code in bytecode form is obtained, and the agent program repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0009] The application is run in the target virtual machine based on the repaired target code.
[0010] In one embodiment, loading the agent program when the detection result indicates that the target code is untrusted includes:
[0011] When the detection result indicates that the target code is untrustworthy, acquire the agent program data and start the agent virtual machine;
[0012] Establish communication between the agent virtual machine and the target virtual machine, and have the agent virtual machine transmit the agent program data to the target virtual machine;
[0013] The agent program data is executed through the target virtual machine to load the agent program.
[0014] In one embodiment, obtaining the agent data includes:
[0015] Retrieve pre-configured, encrypted source proxy data;
[0016] The proxy program data is obtained by decrypting the source proxy program data.
[0017] In one embodiment, the method further includes:
[0018] After obtaining the agent program data, if it is detected that the agent program data has been tampered with, backup agent program data is obtained; the agent program is then loaded using the backup agent program data.
[0019] In one embodiment, the acquisition of the backup target code set in bytecode form, by the agent program, involves repairing the target code already loaded in the target virtual machine based on the backup target code set, including:
[0020] Obtain a pre-configured encrypted source backup target code set, and decrypt the source backup target code set to obtain a backup target code set in bytecode form;
[0021] Identify the backup target code in the backup target code set that corresponds to the loaded target code;
[0022] The agent program replaces the untrusted target code already loaded in the target virtual machine with the backup target code.
[0023] In one embodiment, the process of performing a trustworthiness test on the target code in bytecode form of the application already loaded in the target virtual machine and obtaining the test result includes:
[0024] From the target virtual machine used to run the application, determine the loading source of the target code in bytecode form of the loaded application;
[0025] When the determined loading source is different from the pre-configured loading source, a detection result is obtained indicating that the loaded target code is untrustworthy.
[0026] In one embodiment, the process of performing a trustworthiness test on the target code in bytecode form of the application already loaded in the target virtual machine and obtaining the test result includes:
[0027] For the target code in bytecode form of the application already loaded in the target virtual machine, determine whether the target code has been tampered with;
[0028] In the event that the target code has been tampered with, a detection result is obtained indicating that the loaded target code is untrustworthy.
[0029] In one embodiment, determining whether the target code, in bytecode form, of the application already loaded in the target virtual machine has been tampered with includes:
[0030] For the target code in bytecode form of the application already loaded in the target virtual machine, determine the source file to which the target code belongs;
[0031] Calculate the hash value of the source file and compare the hash value with the preset hash value of the source file;
[0032] If the hash value is different from the preset hash value, a detection result indicating that the loaded target code is untrustworthy is obtained.
[0033] Secondly, this application also provides an anti-cracking application running device. The device includes:
[0034] The detection module is used to perform trustworthiness detection on the target code in bytecode form of the application that has been loaded in the target virtual machine in response to the launch of the application, and obtain the detection result;
[0035] The proxy loading module is used to load the proxy program when the detection result indicates that the target code is untrustworthy.
[0036] The acquisition module is used to acquire a set of backup target code in bytecode form and notify the agent program, which then repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0037] The program execution module is used to run the application in the target virtual machine based on the repaired target code.
[0038] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:
[0039] In response to the launch of the application, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test result is obtained;
[0040] When the detection result indicates that the target code is untrusted, load the agent program;
[0041] A set of backup target code in bytecode form is obtained, and the agent program repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0042] The application is run in the target virtual machine based on the repaired target code.
[0043] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:
[0044] In response to the launch of the application, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test result is obtained;
[0045] When the detection result indicates that the target code is untrusted, load the agent program;
[0046] A set of backup target code in bytecode form is obtained, and the agent program repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0047] The application is run in the target virtual machine based on the repaired target code.
[0048] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:
[0049] In response to the launch of the application, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test result is obtained;
[0050] When the detection result indicates that the target code is untrusted, load the agent program;
[0051] A set of backup target code in bytecode form is obtained, and the agent program repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0052] The application is run in the target virtual machine based on the repaired target code.
[0053] The aforementioned anti-cracking application running method, apparatus, computer equipment, media, and computer program product, when the application starts, can determine whether the application is secure by performing a trustworthiness test on the target code in bytecode form of the loaded application; if the target code is detected to be untrustworthy, it indicates that the application may be cracked and has security risks. By loading an agent program, the agent program repairs the loaded target code according to a backup target code set in bytecode form, thus preventing the application from being cracked and improving the security of the application. Attached Figure Description
[0054] Figure 1 This is an application environment diagram of an anti-cracking application running method in one embodiment;
[0055] Figure 2 This is a flowchart illustrating an anti-cracking application execution method in one embodiment;
[0056] Figure 3 This is a flowchart illustrating the steps of obtaining a backup target code set in bytecode form in one embodiment, and then having an agent program repair the target code already loaded in the target virtual machine based on the backup target code set.
[0057] Figure 4 This is a flowchart illustrating a method for running an anti-cracking application in a specific embodiment.
[0058] Figure 5 This is a structural block diagram of an anti-cracking application running device in one embodiment;
[0059] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0061] The anti-cracking application running method provided in this application embodiment can be applied to, for example... Figure 1The application environment shown is illustrated. The target virtual machine 102 can communicate with the agent virtual machine 104. Both the target virtual machine 102 and the agent virtual machine 104 run on computer devices. A virtual machine is a virtual computer simulated by computer software for running programs, possessing a virtual hardware architecture and instruction set. Its function is to parse and run applications written in computer programming languages. The target virtual machine 102 is the virtual machine used to run applications, and the agent virtual machine 104 is the virtual machine used to inject agent programs into the target virtual machine 102. It is understood that the target virtual machine 102 and the agent virtual machine 104 can also run on a server. The computer device can be a desktop computer, laptop computer, smartphone, or tablet computer. The server can be a standalone server or a server cluster composed of multiple servers.
[0062] based on Figure 1 In the application environment shown, the target virtual machine 102 can respond to the startup of the application by performing a trustworthiness test on the target code in bytecode form of the application already loaded in the target virtual machine 102 and obtaining the test result. When the test result indicates that the target code is untrustworthy, the target virtual machine 102 executes the agent program data passed by the agent virtual machine 104 to load the agent program. The agent program repairs the target code already loaded in the target virtual machine 102 according to the backup target code set, and the target virtual machine 102 runs the application based on the repaired target code.
[0063] In one embodiment, such as Figure 2 As shown, a method for running an anti-cracking application is provided. This embodiment applies this method to... Figure 1 Taking the target virtual machine 102 as an example, the method includes the following steps:
[0064] Step 202: In response to the application startup, perform a trustworthiness test on the target code in bytecode form of the application already loaded in the target virtual machine, and obtain the test results.
[0065] An application is a computer program that can perform at least one specific task. Applications can include standalone programs that run locally and distributed applications that require network resources. Applications can be written in various computer programming languages; for example, an application can be a Java application written in the Java programming language. Applications can also be written in other interpreted high-level programming languages, including Go, Python, C#, Ruby, Scala, or other programming languages. When running an application written in the Java programming language, the Java Virtual Machine (JVM) loads the application's data and runs the application within the JVM. The target virtual machine is the virtual machine used to run the application, and it can be the Java Virtual Machine.
[0066] Bytecode is compiled from high-level language source code. It represents an intermediate state between the high-level language source code and machine-readable and executable code, and is saved in corresponding code files. Trustworthiness testing is the process of determining whether the target code is trustworthy.
[0067] In one embodiment, the target virtual machine may, in response to an application startup event, perform a trustworthiness check on the loaded application's target code before executing it, and obtain the check result. The startup event is the event that initiates the application to run it; it can be an automatically triggered event or a manually triggered operation. An automatically triggered event could be the application starting automatically when the computer boots up, or the application automatically restarting after an abnormal shutdown. A manually triggered operation could be a click operation on application identification information, which could be an icon or text; the click operation could be a mouse pointer click or a touch click.
[0068] In one embodiment, the target virtual machine can determine the loading source of the target code in the form of bytecode of the application already loaded in the target virtual machine, perform a credibility test on the loading source of the target code, and obtain the test result.
[0069] In one embodiment, the target virtual machine can determine the source file to which the target code in the form of the bytecode of the application loaded in the target virtual machine belongs, perform a trustworthiness test on the source file, and obtain the test result.
[0070] Step 204: When the detection result indicates that the target code is untrustworthy, load the agent program.
[0071] The detection results are obtained by performing a trustworthiness test on the target code, and can include results indicating that the target code is trustworthy and results indicating that the target code is untrustworthy. When the target code is untrustworthy, the application can be considered cracked, and running the application in this case poses a security risk. A proxy program is a computer program that can interfere with the operation of an application.
[0072] In one embodiment, when the detection result indicates that the target code is untrusted, the target virtual machine can obtain pre-configured encrypted source agent program data, decrypt the source agent program data to obtain agent program data, and load the agent program through the agent program data.
[0073] In one embodiment, when the detection result indicates that the target code is untrusted, the target virtual machine can obtain the agent program data of the agent program, create a temporary agent file, start the agent virtual machine based on the temporary agent file, and inject the agent program data into the target virtual machine to load the agent program in the target virtual machine. The temporary agent file is a temporary file formed by packaging the agent program data.
[0074] Step 206: Obtain the backup target code set in bytecode form. The agent program then repairs the target code already loaded in the target virtual machine based on the backup target code set.
[0075] The backup target code set is a collection of data containing backups of multiple target codes within the application. This set can include multiple backup target codes that were present before the application's target code was compromised and became untrusted. Repair is the act of modifying untrusted target code to transform it into trusted target code.
[0076] In one embodiment, the target virtual machine can obtain a pre-configured encrypted source backup target code set, decrypt the source backup target code set to obtain a backup target code set in bytecode form, and then the agent program repairs the target code already loaded in the target virtual machine based on the backup target code set.
[0077] In one embodiment, the target virtual machine can determine the backup target code in the backup target code set that corresponds to the loaded target code, and the agent program can repair the loaded target code in the target virtual machine based on the corresponding backup target code.
[0078] Step 208: Run the application in the target virtual machine based on the repaired target code.
[0079] In one embodiment, the target virtual machine can unload the target code of the loaded application, reload the repaired target code, interpret the reloaded repaired target code into machine code, and execute the machine code to run the application.
[0080] In one embodiment, after step 202, if the detection result indicates that the target code is trustworthy, the target virtual machine on the computer device directly runs the application based on the target code in the form of the bytecode of the application already loaded in the target virtual machine.
[0081] In the above-mentioned anti-cracking application running method, when the application starts, the trustworthiness of the target code in the form of the loaded application's bytecode can be checked to determine whether the application is safe. If the target code is found to be untrustworthy, it means that the application may be cracked and there is a security risk. By loading an agent program, the agent program repairs the loaded target code according to the backup target code set in the form of bytecode, so that the application cracking is unsuccessful and the application security is improved.
[0082] In one embodiment, step 204 includes: when the detection result indicates that the target code is untrustworthy, acquiring agent program data and starting the agent virtual machine; establishing communication between the agent virtual machine and the target virtual machine, with the agent virtual machine transmitting the agent program data to the target virtual machine; and executing the agent program data through the target virtual machine to load the agent program.
[0083] Among them, agent program data is computer program data used to load agent programs.
[0084] In one embodiment, when the detection result indicates that the target code is untrustworthy, the target virtual machine can load pre-configured agent program data, automatically create a temporary agent file based on the agent program data, and start the agent virtual machine based on the temporary agent file.
[0085] In one embodiment, the agent virtual machine can obtain the process ID of the current target virtual machine. When the process ID of the current target virtual machine is obtained, the agent virtual machine establishes communication with the target virtual machine through the obtained process ID and loads a temporary agent file. The agent virtual machine then registers and attaches the agent program data in the temporary agent file to the target virtual machine so that the agent program can be loaded on the target virtual machine.
[0086] In one embodiment, after establishing communication between the agent virtual machine and the target virtual machine, the target virtual machine can determine the file path where the agent program data is located, and load the agent program data according to the file path to load the agent program.
[0087] In this embodiment, when the target code is untrusted, the agent program data is obtained to run the agent program, which creates conditions for subsequently repairing the untrusted target code through the agent program. Moreover, by starting the agent virtual machine and establishing communication between the agent virtual machine and the target virtual machine, the agent program is loaded into the target virtual machine, thereby enabling the agent program to repair the untrusted target code of the application already loaded in the target virtual machine, thus improving the security of the application.
[0088] In one embodiment, step 204 includes obtaining proxy program data, which includes: obtaining pre-configured encrypted source proxy program data; and decrypting the source proxy program data to obtain the proxy program data. In this embodiment, the proxy program data is stored in encrypted form, making the proxy program difficult to crack and improving its security.
[0089] Source proxy program data is program data formed by encrypting proxy program data. In a development scenario, source proxy program data can be encrypted using encryption tools and then embedded into the application data used to run the application through obfuscation compilation. Source proxy program data can also be embedded into application data that has undergone high-strength obfuscation compilation. Encryption can employ algorithms such as Base64 (based on 64 printable characters to represent binary data), message digest algorithms, and DES (Data Encryption Standard). Obfuscation compilation involves reorganizing and processing the program code so that the processed program code has a different appearance than the original program code but performs the same function.
[0090] In one embodiment, the target virtual machine can obtain encrypted source proxy data from the application data. In this embodiment, the encrypted source proxy data is embedded in the obfuscated and compiled application data, making it difficult to retrieve. This increases the difficulty of obtaining the proxy data, thereby improving the security of the proxy and further enhancing the security of the application.
[0091] In one embodiment, the above-described anti-cracking application running method further includes a step of loading a proxy program through backup proxy program data. This step includes: after obtaining proxy program data, when it is detected that the proxy program data has been tampered with, obtaining backup proxy program data; and loading the proxy program through the backup proxy program data. In this embodiment, when the proxy program data is tampered with and it is impossible to load the proxy program through the proxy program data to repair untrusted target code, loading the proxy program through backup proxy program data improves the runnability of the proxy program and further enhances the security of the application.
[0092] The backup agent data refers to the backup data before the agent data was tampered with. Tampering is the act of modifying data to compromise the program. Tampering can involve adding, deleting, or replacing data.
[0093] In one embodiment, after the target virtual machine obtains the agent program data, it can determine the source file of the agent program data, determine whether the source file of the agent program data has been tampered with, and if the source file has been tampered with, obtain backup agent program data, and execute the agent program data through the target virtual machine to load the agent program.
[0094] In one embodiment, after the target virtual machine obtains the agent program data, it can compare the agent program data with a pre-configured copy of the agent program data. If the agent program data is different from the pre-configured copy of the agent program data, it is determined that the agent program data has been tampered with. The pre-configured copy of the agent program data and the agent program data can be stored separately.
[0095] In one embodiment, after the target virtual machine obtains the agent program data, if it detects that the agent program data has been tampered with, it can obtain the pre-configured encrypted source backup agent program data, and obtain the backup agent program data after decrypting the source backup agent program data.
[0096] In one embodiment, such as Figure 3 As shown, step 206 includes steps 302 to 306:
[0097] Step 302: Obtain the pre-configured encrypted source backup target code set, and decrypt the source backup target code set to obtain the backup target code set in bytecode form.
[0098] The source backup target code set is a data set formed by encrypting the backup target code set. In a development scenario, the source backup target code set can be encrypted by an encryption tool and then embedded into the application data used to run the application through obfuscation compilation.
[0099] In one embodiment, the target virtual machine can load and decrypt a pre-configured, encrypted set of source backup target code using a decryption class loader to obtain a set of backup target code in bytecode form. The decryption class loader is the target code within the target virtual machine used to load and decrypt other target code.
[0100] In one embodiment, the source backup target code set can be formed by encrypting it using an encryption algorithm. After obtaining the source backup target code set, the target virtual machine can decrypt it by performing the inverse operation of the encryption algorithm used to encrypt the source backup target code set.
[0101] Step 304: Determine the backup target code in the backup target code set that corresponds to the loaded target code.
[0102] The backup target code set can include backup target codes for multiple target codes. These multiple target codes can be all the target code of the application. In this embodiment, if any target code in the application is cracked, it can be repaired using the backup target code set, resulting in a high level of application security. Alternatively, the multiple target codes can be only a portion of the application's target code, such as target code used to control the application's data access permissions. In this embodiment, this can, to a certain extent, ensure that the application is not cracked.
[0103] In one embodiment, the target virtual machine can traverse the class names of backup target code in the backup target code set. When the class name of the backup target code is the same as the class name of the loaded target code, it can determine that the traversed backup target code is the backup target code in the backup target code set that corresponds to the loaded target code.
[0104] Step 306: The agent program replaces the untrusted target code already loaded in the target virtual machine based on the backup target code.
[0105] The untrusted target code can be either loaded from an untrusted source or it can be tampered with. Untrusted target code can also be target code that controls the application's data access permissions.
[0106] In one embodiment, the target virtual machine can use an agent program loaded on the target virtual machine to replace the class body of the untrusted target code already loaded in the target virtual machine with the class body of the corresponding backup target code of the untrusted target code.
[0107] In one embodiment, when multiple untrusted target codes have been loaded in the target virtual machine, the target virtual machine can use an agent program loaded on the target virtual machine to traverse the multiple untrusted target codes that have been loaded, and replace the class body of the traversed target code with the class body of the corresponding backup target code of the traversed target code.
[0108] In this embodiment, the backup target code set used to repair untrusted target code is stored in an encrypted manner, making it difficult to obtain and improving the security of the backup target code set. Moreover, by replacing the untrusted target code already loaded in the target virtual machine through the agent program, the application can be restored to an unhacked state even if it is cracked, thus improving the security of the application.
[0109] In one embodiment, step 202, which involves performing a trustworthiness test on the target code in bytecode form of the application already loaded in the target virtual machine and obtaining the test result, includes: determining the loading source of the target code in bytecode form of the application already loaded from the target virtual machine used to run the application; and obtaining a test result indicating that the loaded target code is untrustworthy if the determined loading source is different from the pre-configured loading source.
[0110] Here, the load source is the network address of the application's target code loaded by the target virtual machine. The pre-configured load source is the load source pre-configured for the application's target code.
[0111] In one embodiment, the target virtual machine can obtain the source address of the target code in bytecode form of the loaded application. When the source address indicates that the target code is on the network, the source address is compared with the pre-configured loading source. If the source address is different from the pre-configured loading source, a detection result indicating that the loaded target code is untrustworthy is obtained.
[0112] In this embodiment, for the target code of the loaded application, by determining the loading source of the target code and comparing the determined loading source with the pre-configured loading source, the loading source of the target code can be easily determined. When the determined loading source is different from the pre-configured loading source, it means that the target code of the application loaded by the target virtual machine is loaded from an illegal source. At this time, the application may be cracked, and the loaded target code can be considered untrusted, which provides a basis for subsequent repair of the untrusted target code, thereby improving the security of the application.
[0113] In one embodiment, step 202, which involves performing a trustworthiness test on the target code in bytecode form of the application loaded in the target virtual machine and obtaining the test result, further includes: determining whether the target code in bytecode form of the application loaded in the target virtual machine has been tampered with; and if the target code has been tampered with, obtaining a test result indicating that the loaded target code is untrustworthy.
[0114] Target code tampering refers to the act of modifying the target code of an application to make the application vulnerable to hacking.
[0115] In one embodiment, the target virtual machine can determine the source file to which the loaded target code belongs based on the bytecode of the application loaded in the target virtual machine, determine whether the source file has been tampered with, and if the source file has been tampered with, obtain a detection result indicating that the loaded target code is untrustworthy.
[0116] In one embodiment, a copy of the application's bytecode object code can be generated and pre-stored before the application is released to make it public. The target virtual machine can determine the corresponding pre-stored copy of the loaded object code for the loaded application's bytecode object code, compare the loaded object code with the corresponding pre-stored copy, obtain a comparison result, and determine that the loaded object code has been tampered with if the comparison result indicates that the loaded object code is different from the corresponding pre-stored copy, thus obtaining a detection result indicating that the loaded object code is untrustworthy.
[0117] In this embodiment, when the target code of the application already loaded in the target virtual machine is tampered with, it indicates that the application may have been cracked. At this time, the application has security vulnerabilities. Obtaining the detection result that the loaded target code is untrusted provides a basis for subsequent repair of the untrusted target code, thereby improving the security of the application.
[0118] In one embodiment, determining whether the target code has been tampered with in the form of bytecode of an application loaded in the target virtual machine includes: determining the source file to which the target code belongs in the form of bytecode of the application loaded in the target virtual machine; calculating the hash value of the source file and comparing the hash value with a preset hash value of the source file; and obtaining a detection result indicating that the loaded target code is untrustworthy if the hash value is different from the preset hash value.
[0119] The source file is the code file containing the application's target code. The hash value is a fixed-length value obtained by calculating the file's hash using a hash algorithm. A hash algorithm is an algorithm that converts data of arbitrary length into fixed-length data. Examples of hash algorithms include MD5 (Message-Digest Algorithm 5) and SHA-1 (Secure Hash Algorithm 1). The preset hash value is the hash value pre-calculated on the source file when the application development is complete.
[0120] In one embodiment, the target virtual machine can obtain the source address of the target code in the form of bytecode of the loaded application. When the obtained source address indicates that the loaded target code originates from the local file system, the source file to which the loaded target code belongs is determined in the local file system based on the obtained source address.
[0121] In this embodiment, by calculating the hash value of the source file of the target code and comparing the calculated hash value with the preset hash value of the source file, it is easy to know whether the source file has been tampered with. If the calculated hash value of the source file is different from the preset hash value of the source file, it indicates that the source file has been tampered with, and the target code in the source file may have been tampered with, which leads to a security risk in the application. The detection result that indicates that the loaded target code is untrusted provides a basis for subsequent repair of the untrusted target code, thereby improving the security of the application.
[0122] In one embodiment, in a specific application scenario, the application program can be a Java application written in the Java computer programming language, and the target virtual machine and the proxy virtual machine can be the target Java Virtual Machine and the proxy Java Virtual Machine, respectively. Figure 4 As shown, the specific steps for implementing the above-mentioned anti-cracking application running method are as follows:
[0123] The target virtual machine can perform trustworthiness checks in a separate thread in response to application startup: the target virtual machine can perform trustworthiness checks on the license classes in the bytecode form of the loaded application and obtain the check results. The license classes are classes (target code) used to control the application's data access permissions.
[0124] The trustworthiness detection step can be implemented by detecting the loading source. Specifically, the target virtual machine can determine the loading source of the target code in the form of the bytecode of the loaded application. If the determined loading source is different from the pre-configured loading source, a detection result indicating that the loaded target code is untrustworthy can be obtained.
[0125] The trustworthiness detection step can also be implemented by detecting whether the target code has been tampered with. Specifically, the target virtual machine can determine the source file to which the target code belongs for the target code in the form of the bytecode of the application loaded in the target virtual machine, calculate the hash value of the source file, compare the calculated hash value of the source file with the preset hash value of the source file, and obtain a detection result indicating that the loaded target code is untrustworthy if the hash value is different from the preset hash value.
[0126] When the detection results indicate that the target code is untrusted, the target virtual machine can initiate anti-cracking measures to repair the untrusted target code. The target virtual machine can obtain pre-configured encrypted source proxy program data, decrypt the source proxy program data to obtain the proxy program data, automatically create a temporary proxy file based on the proxy program data, and start the proxy virtual machine based on the temporary proxy file.
[0127] The proxy virtual machine can obtain the process ID of the current target virtual machine. Once the process ID of the current target virtual machine is obtained, the proxy virtual machine establishes communication with the target virtual machine through the obtained process ID and loads a temporary proxy file. The proxy virtual machine then registers and attaches the proxy program data in the temporary proxy file to the target virtual machine so that the proxy program can be loaded on the target virtual machine.
[0128] The target virtual machine can obtain a pre-configured encrypted source backup target code set, decrypt the source backup target code set to obtain a backup target code set in bytecode form; determine the backup target code in the backup target code set that corresponds to the loaded target code; and the agent program loaded in the target virtual machine replaces the untrusted target code already loaded in the target virtual machine according to the backup target code, so as to repair the target code already loaded in the target virtual machine.
[0129] The target virtual machine can unload the target code of the loaded application, reload the repaired target code, interpret the reloaded repaired target code into machine code, and execute the machine code to run the application.
[0130] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0131] Based on the same inventive concept, this application also provides an anti-cracking application running device for implementing the aforementioned anti-cracking application running method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more anti-cracking application running device embodiments provided below can be found in the limitations of the anti-cracking application running method described above, and will not be repeated here.
[0132] In one embodiment, such as Figure 5 As shown, an anti-cracking application running device 500 is provided, including: a detection module 510, an agent program loading module 520, an acquisition module 530, and a program running module 540, wherein:
[0133] The detection module 510 is used to perform trustworthiness detection on the target code in bytecode form of the application loaded in the target virtual machine in response to the application startup, and obtain the detection result;
[0134] The proxy loading module 520 is used to load the proxy program when the detection result indicates that the target code is untrustworthy.
[0135] The acquisition module 530 is used to acquire a set of backup target code in bytecode form and notify the agent program, which then repairs the target code already loaded in the target virtual machine based on the set of backup target code.
[0136] Program execution module 540 is used to run the application in the target virtual machine based on the repaired target code.
[0137] In one embodiment, the agent loading module 520 is further configured to, when the detection result indicates that the target code is untrustworthy, obtain agent data, start the agent virtual machine; establish communication between the agent virtual machine and the target virtual machine, and have the agent virtual machine transfer the agent data to the target virtual machine; and execute the agent data through the target virtual machine to load the agent program.
[0138] In one embodiment, the agent loading module 520 is further configured to obtain pre-configured encrypted source agent data; and to obtain agent data after decrypting the source agent data.
[0139] In one embodiment, the agent loading module 520 is further configured to, after obtaining agent data, obtain backup agent data when it is detected that the agent data has been tampered with; and load the agent program using the backup agent data.
[0140] In one embodiment, the acquisition module 530 is further configured to acquire a pre-configured encrypted source backup target code set, decrypt the source backup target code set to obtain a backup target code set in bytecode form; determine the backup target code in the backup target code set that corresponds to the loaded target code; and have the agent program replace the untrusted target code loaded in the target virtual machine according to the backup target code.
[0141] In one embodiment, the detection module 510 is further configured to determine the loading source of the target code in bytecode form of the loaded application from the target virtual machine used to run the application; and to obtain a detection result characterizing that the loaded target code is untrustworthy if the determined loading source is different from the pre-configured loading source.
[0142] In one embodiment, the detection module 510 is further configured to determine whether the target code in the form of bytecode of the application loaded in the target virtual machine has been tampered with; if the target code has been tampered with, obtain a detection result indicating that the loaded target code is untrustworthy.
[0143] In one embodiment, the detection module 510 is further configured to determine the source file to which the target code belongs for the target code in the form of bytecode of the application loaded in the target virtual machine; calculate the hash value of the source file and compare the hash value with the preset hash value of the source file; and obtain a detection result indicating that the loaded target code is untrustworthy if the hash value is different from the preset hash value.
[0144] The modules in the aforementioned anti-cracking application runtime device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0145] In one embodiment, a computer device is provided, the internal structure of which can be shown as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external computer devices; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for running uncrackable applications. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.
[0146] Those skilled in the art will understand that Figure 6The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0147] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0148] In response to the application's startup, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test results are obtained.
[0149] When the detection result indicates that the target code is untrusted, load the agent program;
[0150] The agent program obtains a set of backup target code in bytecode form and then repairs the target code already loaded in the target virtual machine based on the backup target code set.
[0151] Run the application in the target virtual machine based on the repaired target code.
[0152] In one embodiment, when the processor executes the computer program, it further performs the following steps: when the detection result indicates that the target code is untrustworthy, it acquires agent program data and starts the agent virtual machine; it establishes communication between the agent virtual machine and the target virtual machine, and the agent virtual machine transmits the agent program data to the target virtual machine; and the target virtual machine executes the agent program data to load the agent program.
[0153] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining pre-configured encrypted source proxy program data; and decrypting the source proxy program data to obtain proxy program data.
[0154] In one embodiment, when the processor executes the computer program, it further performs the following steps: after obtaining agent program data, when it detects that the agent program data has been tampered with, it obtains backup agent program data; and loads the agent program using the backup agent program data.
[0155] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining a pre-configured encrypted source backup target code set; decrypting the source backup target code set to obtain a backup target code set in bytecode form; determining the backup target code in the backup target code set that corresponds to the loaded target code; and having an agent program replace the untrusted target code loaded in the target virtual machine according to the backup target code.
[0156] In one embodiment, when the processor executes a computer program, it further performs the following steps: determining the loading source of the target code in bytecode form of the loaded application from the target virtual machine used to run the application; and obtaining a detection result characterizing the untrustworthiness of the loaded target code if the determined loading source is different from the pre-configured loading source.
[0157] In one embodiment, when the processor executes a computer program, it further performs the following steps: determining whether the target code, in bytecode form, of the application loaded in the target virtual machine has been tampered with; and if the target code has been tampered with, obtaining a detection result indicating that the loaded target code is untrustworthy.
[0158] In one embodiment, when the processor executes a computer program, it further performs the following steps: for target code in bytecode form of an application loaded in a target virtual machine, determine the source file to which the target code belongs; calculate the hash value of the source file and compare the hash value with a preset hash value of the source file; if the hash value is different from the preset hash value, obtain a detection result indicating that the loaded target code is untrustworthy.
[0159] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0160] In response to the application's startup, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test results are obtained.
[0161] When the detection result indicates that the target code is untrusted, load the agent program;
[0162] The agent program obtains a set of backup target code in bytecode form and then repairs the target code already loaded in the target virtual machine based on the backup target code set.
[0163] Run the application in the target virtual machine based on the repaired target code.
[0164] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: when the detection result indicates that the target code is untrustworthy, it obtains agent program data and starts the agent virtual machine; it establishes communication between the agent virtual machine and the target virtual machine, and the agent virtual machine transmits the agent program data to the target virtual machine; and the target virtual machine executes the agent program data to load the agent program.
[0165] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining pre-configured encrypted source proxy program data; and decrypting the source proxy program data to obtain proxy program data.
[0166] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: after obtaining agent program data, when it is detected that the agent program data has been tampered with, obtaining backup agent program data; and loading the agent program using the backup agent program data.
[0167] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining a pre-configured encrypted source backup target code set; decrypting the source backup target code set to obtain a backup target code set in bytecode form; determining the backup target code in the backup target code set that corresponds to the loaded target code; and having an agent program replace the untrusted target code loaded in the target virtual machine according to the backup target code.
[0168] In one embodiment, when the computer program is executed by a processor, the following steps are also performed: determining the loading source of the target code in bytecode form of the loaded application from the target virtual machine used to run the application; and obtaining a detection result characterizing the untrustworthiness of the loaded target code if the determined loading source is different from the pre-configured loading source.
[0169] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining whether the target code, in the form of bytecode of the application loaded in the target virtual machine, has been tampered with; and if the target code has been tampered with, obtaining a detection result indicating that the loaded target code is untrustworthy.
[0170] In one embodiment, when the computer program is executed by the processor, the following steps are also performed: for the target code in bytecode form of the application loaded in the target virtual machine, determine the source file to which the target code belongs; calculate the hash value of the source file and compare the hash value with a preset hash value of the source file; if the hash value is different from the preset hash value, obtain a detection result indicating that the loaded target code is untrustworthy.
[0171] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:
[0172] In response to the application's startup, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test results are obtained.
[0173] When the detection result indicates that the target code is untrusted, load the agent program;
[0174] The agent program obtains a set of backup target code in bytecode form and then repairs the target code already loaded in the target virtual machine based on the backup target code set.
[0175] Run the application in the target virtual machine based on the repaired target code.
[0176] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: when the detection result indicates that the target code is untrustworthy, it obtains agent program data and starts the agent virtual machine; it establishes communication between the agent virtual machine and the target virtual machine, and the agent virtual machine transmits the agent program data to the target virtual machine; and the target virtual machine executes the agent program data to load the agent program.
[0177] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining pre-configured encrypted source proxy program data; and decrypting the source proxy program data to obtain proxy program data.
[0178] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: after obtaining agent program data, when it is detected that the agent program data has been tampered with, obtaining backup agent program data; and loading the agent program using the backup agent program data.
[0179] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining a pre-configured encrypted source backup target code set; decrypting the source backup target code set to obtain a backup target code set in bytecode form; determining the backup target code in the backup target code set that corresponds to the loaded target code; and having an agent program replace the untrusted target code loaded in the target virtual machine according to the backup target code.
[0180] In one embodiment, when the computer program is executed by a processor, the following steps are also performed: determining the loading source of the target code in bytecode form of the loaded application from the target virtual machine used to run the application; and obtaining a detection result characterizing the untrustworthiness of the loaded target code if the determined loading source is different from the pre-configured loading source.
[0181] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining whether the target code, in the form of bytecode of the application loaded in the target virtual machine, has been tampered with; and if the target code has been tampered with, obtaining a detection result indicating that the loaded target code is untrustworthy.
[0182] In one embodiment, when the computer program is executed by the processor, the following steps are also performed: for the target code in bytecode form of the application loaded in the target virtual machine, determine the source file to which the target code belongs; calculate the hash value of the source file and compare the hash value with a preset hash value of the source file; if the hash value is different from the preset hash value, obtain a detection result indicating that the loaded target code is untrustworthy.
[0183] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.
[0184] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.
[0185] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0186] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A method for running an anti-cracking application, characterized in that, The method includes: In response to the launch of the application, a trustworthiness test is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the test result is obtained; When the detection result indicates that the target code is untrustworthy, acquire the agent program data and start the agent virtual machine; Establish communication between the agent virtual machine and the target virtual machine, and have the agent virtual machine transmit the agent program data to the target virtual machine; The agent program data is executed through the target virtual machine to load the agent program; A set of backup target code in bytecode form is obtained, and the agent program repairs the target code already loaded in the target virtual machine based on the set of backup target code. The application is run in the target virtual machine based on the repaired target code.
2. The method according to claim 1, characterized in that, The application is a computer program that performs at least one specific task.
3. The method according to claim 1, characterized in that, The acquisition of agent program data includes: Retrieve pre-configured, encrypted source proxy data; The proxy program data is obtained by decrypting the source proxy program data.
4. The method according to claim 1, characterized in that, The method further includes: After obtaining the agent program data, if it is detected that the agent program data has been tampered with, backup agent program data is obtained; the agent program is then loaded using the backup agent program data.
5. The method according to claim 1, characterized in that, The process of obtaining a backup target code set in bytecode format, and then using the agent program to repair the target code already loaded in the target virtual machine based on the backup target code set, includes: Obtain a pre-configured encrypted source backup target code set, and decrypt the source backup target code set to obtain a backup target code set in bytecode form; Identify the backup target code in the backup target code set that corresponds to the loaded target code; The agent program replaces the untrusted target code already loaded in the target virtual machine with the backup target code.
6. The method according to claim 1, characterized in that, The trustworthiness detection is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the detection results are obtained, including: From the target virtual machine used to run the application, determine the loading source of the target code in bytecode form of the loaded application; When the determined loading source is different from the pre-configured loading source, a detection result is obtained indicating that the loaded target code is untrustworthy.
7. The method according to any one of claims 1 to 6, characterized in that, The trustworthiness detection is performed on the target code in bytecode form of the application already loaded in the target virtual machine, and the detection results are obtained, including: For the target code in bytecode form of the application already loaded in the target virtual machine, determine whether the target code has been tampered with; In the event that the target code has been tampered with, a detection result is obtained indicating that the loaded target code is untrustworthy.
8. The method according to claim 7, characterized in that, The determination of whether the target code, in bytecode form, of the application already loaded in the target virtual machine has been tampered with includes: For the target code in bytecode form of the application already loaded in the target virtual machine, determine the source file to which the target code belongs; Calculate the hash value of the source file and compare the hash value with the preset hash value of the source file; If the hash value is different from the preset hash value, a detection result indicating that the loaded target code is untrustworthy is obtained.
9. A crack-resistant application running device, characterized in that, The device includes: The detection module is used to perform trustworthiness detection on the target code in bytecode form of the application that has been loaded in the target virtual machine in response to the launch of the application, and obtain the detection result; The agent loading module is used to, when the detection result indicates that the target code is untrustworthy, acquire agent program data, start the agent virtual machine; establish communication between the agent virtual machine and the target virtual machine, and have the agent virtual machine transmit the agent program data to the target virtual machine; execute the agent program data through the target virtual machine to load the agent program; and the acquisition module is used to acquire a set of backup target code in bytecode form and notify the agent program, which then repairs the target code already loaded in the target virtual machine according to the set of backup target code. The program execution module is used to run the application in the target virtual machine based on the repaired target code.
10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.
11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.
12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.