A .Net platform code protection and operation method based on dynamic method

Abstract

The present invention relates to the technical field of software security, and discloses a .Net platform code protection and operation method based on a dynamic method, the method comprising extracting a first method body from metadata of a first .NET program. Obfuscating and encrypting the first method body in turn to obtain a second method body. The second method body is stored in a preset custom heap stream, and a protection system runtime code for creating a dynamic method is injected into the custom heap stream to obtain a second .NET program. The present invention stores the method body of the .NET program in a custom heap stream after obfuscation and encryption, and injects the protection system runtime code for creating a dynamic method, so that the method body can be decrypted and created as a dynamic method at runtime, and the MSIL code that needs to be compiled is dynamically changed at runtime to prevent reverse engineers from analyzing the original MSIL code, thereby improving the security of the protected MSIL code.

Description

Technical Field

[0001] The present invention relates to the technical field of software security, and in particular to a .Net platform code protection and operation method based on a dynamic method. Background Art

[0002] All languages ​​under the .NET platform are based on the common language runtime, follow the standards of the common language architecture, and are uniformly compiled into MSIL code, which is executed by the common language architecture. MSIL code is an open infrastructure, and various decompilers can be used to convert the underlying MSIL code back to the corresponding .NET language such as C#, VB.NET, etc.

[0003] At present, the MSIL code protection scheme only changes the method body in the original metadata, and uses control flow obfuscation, constant encryption, proxy call, resource protection and other obfuscation methods. However, the protected MSIL code can still be deciphered using various common reverse engineering tools, and combined with dynamic debugging, the control flow of the code before obfuscation and their execution logic can be understood, and the software process can be analyzed, which has low security. Summary of the invention

[0004] In order to overcome the defects of the prior art that the protected MSIL code is easy to be deciphered and has low security, the present invention proposes the following technical solution:

[0005] In the first aspect, the present invention proposes a .Net platform code protection method based on a dynamic method, comprising:

[0006] Step 1: Extract a first method body from metadata of a first .NET program.

[0007] Step 2: Obfuscate and encrypt the first method body in sequence to obtain a second method body.

[0008] Step 3: Store the second method body into a preset custom heap stream, and inject the protection system runtime code for creating dynamic methods into the custom heap stream to obtain a second .NET program.

[0009] As a preferred technical solution, extracting the first method body from the metadata of the first .NET program specifically includes:

[0010] The metadata of the first .NET program is parsed to obtain a metadata table stream including a method table.

[0011] A first method body is parsed from the metadata table stream.

[0012] As a preferred technical solution, before sequentially performing obfuscation processing on the first method body, the method further includes:

[0013] A decoding operation is performed on the first method body to obtain a corresponding first MSIL code.

[0014] Obfuscation processing is performed on a first method body in which the amount of first MSIL code is greater than or equal to a threshold.

[0015] As a preferred technical solution, at least one processing method including control flow obfuscation, constant encryption, proxy call or resource protection is used to obfuscate the first method body.

[0016] As a preferred technical solution, the first method body that has been obfuscated is encrypted, specifically including:

[0017] Exception handling clauses are extracted from metadata of a first .NET program.

[0018] Build a mapping from constant numbers to opcodes.

[0019] According to the mapping relationship, an operation code of the first MSIL code corresponding to the first method body after obfuscation is output, and a byte array is constructed using the operation code.

[0020] The operands of each operation code and an exception handling clause are appended to the byte array to obtain a serialized method body.

[0021] The serialized method body is encrypted to obtain a second method body.

[0022] As a preferred technical solution, the serialized method body is encrypted using an AES encryption algorithm to obtain a second method body.

[0023] As a preferred technical solution, before appending the exception handling clause to the byte array, the method further includes:

[0024] The metadata of the first .NET program is parsed to obtain the user string heap, string heap, and Blob heap.

[0025] According to the user string heap, string heap and Blob heap, the Token of the operand of the first MSIL code is decoded into the corresponding member, string and member signature respectively.

[0026] According to the mapping relationship, the operands of each operation code are obtained from the members, the character string and the member signature, and the obtained operands are appended to the byte array.

[0027] In a second aspect, the present invention further proposes a .Net platform code running method based on a dynamic method, which is used to run a second .NET program generated by the .Net platform code protection method based on a dynamic method described in any solution of the first aspect, comprising:

[0028] S1: When the second .NET program starts, initialize the internal fields of the protection system runtime and obtain the address of the custom heap stream.

[0029] S2: Parse the custom heap stream to obtain the second method body.

[0030] S3: Save the second method body inside the protection system runtime.

[0031] S4: When the second .NET program runs to the stub method, the compiled dynamic method is obtained from the cache. If the acquisition is successful, it enters S7; if the acquisition fails, it enters S5.

[0032] S5: Obtain the token of the current stub method, and query the method body of the second MSIL code internally when the protection system is running according to the token.

[0033] S6: Create and compile a dynamic method according to the method body of the second MSIL code, and save the dynamic method into the cache.

[0034] S7: Execute anti-debugging detection. If the second .NET program is in a debugged state, an error is reported and the compiled dynamic method is not executed. If the second .NET program is not in a debugged state, the compiled dynamic method is executed.

[0035] As a preferred technical solution, after S1 and before S2, the method further includes:

[0036] Anti-debugging detection is performed, and if a debugger is detected, the second .NET program is exited.

[0037] As a preferred technical solution, according to the method body of the second MSIL code, an API in the System.Reflection.Emit namespace is used to create and compile a dynamic method.

[0038] The beneficial effects of the present invention include at least:

[0039] (1) The present invention obfuscates and encrypts the method body of a .NET program and stores it in a custom heap stream, and injects a protection system runtime code for creating a dynamic method into the heap stream. The method body can be decrypted and created as a dynamic method at runtime, and the hidden characteristics brought by the unreadable and non-debuggable nature of the dynamic method are utilized. The MSIL code that needs to be compiled is dynamically changed at runtime to prevent reverse engineers from analyzing the original MSIL code, thereby improving the security of the protected MSIL code.

[0040] (2) When the second .NET program is started, the present invention can achieve on-demand decryption and execution of the original method body by obtaining or creating and compiling a dynamic method from the cache, avoiding exposing the decrypted MSIL code in the memory, reducing the opportunity and time for reverse engineers to capture the code, and by performing anti-debugging detection, it can detect whether someone attempts to debug the second .NET program and prevent them from obtaining key information, thereby protecting the software code from being illegally copied and modified, and further improving the security of the protected MSIL code. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a .Net platform code protection method based on a dynamic method provided in an embodiment of the present application.

[0042] Figure 2 A flowchart of a .Net platform code running method based on a dynamic method provided in an embodiment of the present application.

[0043] Figure 3 This is a schematic diagram of the principle architecture of the .Net platform code running method based on the dynamic method provided in the embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred technical solutions. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred technical solutions are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0045] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0046] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0047] Specifically, the embodiment of the present application proposes a .Net platform code protection method based on a dynamic method.

[0048] like Figure 1 As shown, it is a flow chart of the .Net platform code protection method based on the dynamic method provided in the embodiment of the present application, which includes the following steps:

[0049] Step 1: Extract a first method body from metadata of a first .NET program.

[0050] Optionally, in one embodiment of the present application, extracting the first method body from metadata of the first .NET program specifically includes:

[0051] The metadata of the first .NET program is parsed to obtain a metadata table stream including a method table, and a first method body is parsed from the metadata table stream.

[0052] In the specific implementation process, the API in the System.Reflection namespace, such as Assembly.Load, Module.GetTypes, Type.GetMethods, etc., is used to load the assembly of the first .NET program and obtain its module, type and method information. Each method is traversed and the MethodBase.GetMethodBody method is used to obtain the first method body, which includes the MSIL code, local variables, exception handling clauses and other information of the method body.

[0053] Optionally, in an embodiment of the present application, before sequentially performing obfuscation processing on the first method body, the method further includes:

[0054] A decoding operation is performed on the first method body to obtain a corresponding first MSIL code.

[0055] Obfuscation processing is performed on a first method body in which the amount of first MSIL code is greater than or equal to a threshold.

[0056] In this embodiment, at least one processing method selected from the group consisting of control flow obfuscation, constant encryption, proxy call, and resource protection is used to obfuscate the first method body.

[0057] In this embodiment, the first method body that has been obfuscated is encrypted, specifically including:

[0058] Exception handling clauses are extracted from metadata of a first .NET program.

[0059] Construct a mapping relationship from constant numbers to opcodes, such as 0x01 corresponds to ldloc.0, and 0x02 corresponds to ldarg.0.

[0060] According to the mapping relationship, an operation code of the first MSIL code corresponding to the first method body after obfuscation is output, and a byte array is constructed using the operation code.

[0061] The operands of each operation code and an exception handling clause are appended to the byte array to obtain a serialized method body.

[0062] The serialized method body is encrypted to obtain a second method body.

[0063] In this embodiment, before appending the exception handling clause to the byte array, the method further includes:

[0064] The metadata of the first .NET program is parsed to obtain a user string heap, a string heap and a Blob heap, wherein the user string heap is used to decode the string token of the ldstr opcode, the string heap is used to obtain the member name, and the Blob heap is used to decode the member signature.

[0065] According to the user string heap, string heap and Blob heap, the Token of the operand of the first MSIL code is decoded into the corresponding member, string and member signature respectively.

[0066] According to the mapping relationship, the operands of each operation code are obtained from the members, the character string and the member signature, and the obtained operands are appended to the byte array.

[0067] In this embodiment, the serialized method body is encrypted using the AES encryption algorithm to obtain a second method body.

[0068] Step 2: Obfuscate and encrypt the first method body in sequence to obtain a second method body.

[0069] Optionally, in an embodiment of the present application, before sequentially performing obfuscation processing on the first method body, the method further includes:

[0070] A decoding operation is performed on the first method body to obtain a corresponding first MSIL code.

[0071] Obfuscation processing is performed on a first method body in which the amount of first MSIL code is greater than or equal to a threshold.

[0072] In this embodiment, at least one processing method selected from the group consisting of control flow obfuscation, constant encryption, proxy call, and resource protection is used to obfuscate the first method body.

[0073] In this embodiment, the first method body that has been obfuscated is encrypted, specifically including:

[0074] Exception handling clauses are extracted from metadata of a first .NET program.

[0075] Build a mapping from constant numbers to opcodes.

[0076] According to the mapping relationship, an operation code of the first MSIL code corresponding to the first method body after obfuscation is output, and a byte array is constructed using the operation code.

[0077] The operands of each operation code and an exception handling clause are appended to the byte array to obtain a serialized method body.

[0078] The serialized method body is encrypted to obtain a second method body.

[0079] In this embodiment, before appending the exception handling clause to the byte array, the method further includes:

[0080] The metadata of the first .NET program is parsed to obtain the user string heap, string heap, and Blob heap.

[0081] According to the user string heap, string heap and Blob heap, the Token of the operand of the first MSIL code is decoded into the corresponding member, string and member signature respectively.

[0082] According to the mapping relationship, the operands of each operation code are obtained from the members, the character string and the member signature, and the obtained operands are appended to the byte array.

[0083] In this embodiment, the serialized method body is encrypted using the AES encryption algorithm to obtain a second method body.

[0084] Step 3: Store the second method body into a preset custom heap stream (such as #ABC), and inject the protection system runtime code for creating dynamic methods into the custom heap stream to obtain a second .NET program.

[0085] In the specific implementation process, the protection system runtime code is written into the custom heap stream in the form of bytecode, and a jump instruction (br) is inserted before each method body that needs to be protected to jump to the protection system runtime code.

[0086] It can be understood that by obfuscating and encrypting the method body of the .NET program, storing it in a custom heap stream, and injecting the protection system runtime code for creating dynamic methods into the heap stream, the method body can be decrypted and created as a dynamic method at runtime, utilizing the hidden characteristics brought about by the unreadability and non-debuggability of the dynamic method, and dynamically changing the MSIL code that needs to be compiled at runtime to prevent reverse engineers from analyzing the original MSIL code, thereby improving the security of the protected MSIL code.

[0087] Secondly, the embodiment of the present application also proposes a .Net platform code running method based on a dynamic method, which is used to run a second .NET program generated by the .Net platform code protection method based on a dynamic method in the aforementioned embodiment.

[0088] like Figure 2 and Figure 3 As shown, Figure 2 The following is a flow chart of a .Net platform code running method based on a dynamic method provided in an embodiment of the present application. Figure 3 This is a schematic diagram of the principle architecture of the .Net platform code running method based on the dynamic method provided in the embodiment of the present application.

[0089] The .Net platform code running method includes the following steps:

[0090] S1: When the second .NET program starts, initialize the internal fields of the protection system runtime and obtain the address of the custom heap stream.

[0091] In this embodiment, after the address of the custom heap stream is obtained, an anti-debugging detection is performed, and if the presence of a debugger is detected, the second .NET program is exited.

[0092] S2: Parse the custom heap stream to obtain the second method body.

[0093] S3: Save the second method body inside the protection system runtime.

[0094] S4: When the second .NET program runs to the stub method, the compiled dynamic method is obtained from the cache. If the acquisition is successful, it enters S7; if the acquisition fails, it enters S5.

[0095] S5: Obtain the token of the current stub method, and query the method body of the second MSIL code internally when the protection system is running according to the token.

[0096] S6: Create and compile a dynamic method according to the method body of the second MSIL code, and save the dynamic method into the cache.

[0097] In this embodiment, according to the method body of the second MSIL code, an API in the System.Reflection.Emit namespace is used to create and compile a dynamic method.

[0098] S7: Execute anti-debugging detection. If the second .NET program is in a debugged state, an error is reported and the compiled dynamic method is not executed. If the second .NET program is not in a debugged state, the compiled dynamic method is executed.

[0099] It can be understood that when the second .NET program is started, by obtaining or creating and compiling a dynamic method from the cache, the original method body can be decrypted and executed on demand, avoiding exposing the decrypted MSIL code in the memory, reducing the opportunity and time for reverse engineers to capture the code, and by performing anti-debugging detection, it can be detected whether someone is trying to debug the second .NET program and prevent them from obtaining key information, protecting the software code from being illegally copied and modified, and further improving the security of the protected MSIL code.

[0100] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0101] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0102] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0103] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array, a field programmable gate array, etc.

[0104] A person skilled in the art may understand that all or part of the steps in the above-mentioned embodiment method may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0105] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A .Net platform code protection method based on a dynamic method, characterized in that: include: Step 1: extracting a first method body from metadata of a first .NET program, and performing a decoding operation on the first method body to obtain a corresponding first MSIL code; Step 2: Obfuscate and encrypt the first method body whose MSIL code quantity is greater than or equal to the threshold value in sequence to obtain a second method body; The encryption process of the first method body after the obfuscation process specifically includes: Extracting exception handling clauses from metadata of a first .NET program; Build a mapping from constant numbers to opcodes; Outputting, according to the mapping relationship, an operation code of the first MSIL code corresponding to the first method body after the obfuscation process, and constructing a byte array using the operation code; Appending the operands of each operation code and an exception handling clause to the byte array to obtain a serialized method body; Encrypting the serialized method body to obtain a second method body; Step 3: Store the second method body into a preset custom heap stream, and inject the protection system runtime code for creating dynamic methods into the custom heap stream to obtain a second .NET program.

2. The .Net platform code protection method based on dynamic method according to claim 1, characterized in that: Extracting a first method body from metadata of a first .NET program specifically includes: Parsing metadata of the first .NET program to obtain a metadata table stream including a method table; A first method body is parsed from the metadata table stream.

3. The .Net platform code protection method based on dynamic method according to claim 1, characterized in that: The first method body is obfuscated using at least one processing method selected from the group consisting of control flow obfuscation, constant encryption, proxy call, and resource protection.

4. The .Net platform code protection method based on dynamic method according to claim 1, characterized in that: The serialized method body is encrypted using the AES encryption algorithm to obtain a second method body.

5. The .Net platform code protection method based on dynamic method according to claim 1, characterized in that: Before appending the exception handling clause to the byte array, the method further includes: Parse the metadata of the first .NET program to obtain the user string heap, string heap and Blob heap; According to the user string heap, string heap and Blob heap, the token of the operand of the first MSIL code is decoded into the corresponding member, string and member signature respectively; According to the mapping relationship, the operands of each operation code are obtained from the members, the character string and the member signature, and the obtained operands are appended to the byte array.

6. A .Net platform code running method based on a dynamic method, used to run a second .NET program generated by the .Net platform code protection method based on a dynamic method as claimed in any one of claims 1 to 5, characterized in that: include: S1: When the second .NET program starts, it initializes the internal fields of the protection system runtime and obtains the address of the custom heap stream; S2: parse the custom heap stream to get the second method body; S3: Save the second method body into the protection system runtime; S4: When the second .NET program runs to the stub method, the compiled dynamic method is obtained from the cache. If the acquisition is successful, it enters S7. If the acquisition fails, it enters S5. S5: Get the token of the current stub method, and query the method body of the second MSIL code internally according to the token when the protection system is running; S6: creating and compiling a dynamic method according to the method body of the second MSIL code, and saving the dynamic method to a cache; S7: Execute anti-debugging detection. If the second .NET program is in a debugged state, an error is reported and the compiled dynamic method is not executed. If the second .NET program is not in a debugged state, the compiled dynamic method is executed.

7. The .Net platform code running method based on dynamic method according to claim 6, characterized in that: After S1 and before S2, the method further includes: Anti-debugging detection is performed, and if a debugger is detected, the second .NET program is exited.

8. The .Net platform code running method based on dynamic method according to claim 6, characterized in that: According to the method body of the second MSIL code, a dynamic method is created and compiled using the API in the System.Reflection.Emit namespace.

Images