A .NET platform code protection method based on member structure obfuscation

Abstract

The invention discloses a .NET platform code protection method based on member structure obfuscation, and the method comprises: S1: initializing a metadata table; S2: traversing members of an instance class, converting non-static members into static members, and beginning to move static members to randomly created classes; S3: re-traversing members of each class, forwarding generic parameters in the process of transferring static members, and moving static fields and static methods to randomly created classes; S4: re-traversing members of each class, uniformly processing field types, method parameters and return types, replacing corresponding types, randomizing the order of method parameters, and repairing references to method parameters; S5: re-traversing members of an instance class, and replacing access methods of instance fields; the invention hides the real types of members to achieve the purpose of code irreversibility.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a .NET platform code protection method based on member structure obfuscation. Background Art

[0002] .NET assemblies are composed of metadata. Metadata is a set of data that describes the structure of an assembly. It consists of five metadata streams: table stream (#~ or #-), heap stream (#US, #Strings, #Guid, #Blob). The table stream is the most important metadata stream, which records the contents of each metadata table. It provides the definition, characteristics, access modifiers, parameter information and other related metadata of each type and member in the assembly. The metadata table is a table that stores these metadata. The metadata table is a data structure used to store assembly and type information. It contains descriptive information about each member such as assembly, module, type, field, method, etc.

[0003] In .NET development, when you write code and compile it into an assembly, the compiler collects metadata about types and members and stores it in metadata tables. These metadata can be used by the runtime environment (such as CLR, Common Language Runtime) to perform type checking, member access, and execution when the program is running.

[0004] Metadata tables include but are not limited to the following types: Assembly table: stores assembly name, version number, public key token and other information; Module table: stores module name and hash value; TypeDef table: stores type definition information, including name, base class, interface implementation, etc.; Field table: stores field definition information, such as field name, type, access modifier, etc.; MethodDef table: stores method definition information, such as method name, parameter list, return type, etc.; Property table: stores property definition information, including name, type, access modifier, etc.

[0005] Other protection methods that confuse the MSIL code itself only change the method body in the MethodDef table, that is, the MSIL code itself. However, the present invention changes the Field table, Type table, MethodDef table, Event table, Property table, etc., but does not change the MSIL code itself.

[0006] The protection methods that change the MSIL code itself are all reversible, because the execution logic of the code will not change. According to the execution logic, it is possible to rewrite the MSIL code clearly without obfuscation. Therefore, in order to solve this problem, it is necessary to achieve the goal of irreversibility, so that reverse engineers cannot understand and restore the real member structure. Summary of the invention

[0007] In order to solve the problem that the code protection means in the prior art are reversible and the original code can be rewritten according to the execution logic, a .NET platform code protection method based on member structure obfuscation is proposed, which hides the real type of the member and replaces it with other types to achieve the purpose of irreversibility, making it impossible for reverse engineers to understand and restore the real member structure.

[0008] The technical solution of the present invention is as follows:

[0009] On one hand, the present invention discloses a .NET platform code protection method based on member structure obfuscation, comprising the following steps:

[0010] S1: Initialize the metadata table;

[0011] S2: traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement;

[0012] S3: Re-traverse the members of each class. During the transfer of static members, forward the generic parameters, move the static fields and static methods to the randomly created classes, and complete the transfer of static members.

[0013] S4: Re-traverse the members of each class, unify the field types, method parameters, and return types, replace the corresponding types, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types;

[0014] S5: Re-traverse the members of each instance class, replace the access method of the instance field, and complete the field hiding of the instance member.

[0015] Preferably, members include methods and fields;

[0016] The data structure of a class contains a method list, a field list, and a subclass list.

[0017] Furthermore, in S1, the specific steps for initializing the metadata table are as follows:

[0018] S101: Parse the metadata of the input .NET assembly to obtain the metadata table stream, string heap, and Blob heap;

[0019] S102: The relationship between classes and members is organized into a tree structure; the data structure of the class includes a method list, a field list, and a subclass list;

[0020] S103: Initialization is completed, and the instance method is converted to a static method.

[0021] Furthermore, in S2, the specific steps of converting non-static members into static members are as follows:

[0022] S201: Determine whether a member of an instance class is a static member; if it is an instance member, proceed to S202; if it is a static member, proceed to S204;

[0023] S202: Filter out instance fields and virtual methods in instance members, and retain non-virtual instance methods;

[0024] S203: adding the this parameter of the non-virtual instance method to the parameter list and converting it to a static method; modifying the reference operation code of the converted static method; completing the conversion of the static member;

[0025] S204: Move static members to randomly created classes.

[0026] Furthermore, in S3, the specific steps of forwarding generic parameters are as follows:

[0027] S301: If it is a static field, move it to a randomly created class; if the type of the static field contains generic parameters, forward the generic parameters;

[0028] S302: If it is a static method, move it to a randomly created class; if the parameter type of the static method contains generic parameters or the return type of the static method contains generic parameters, forward the generic parameters;

[0029] S303: Complete the transfer of static members. This randomly created class is a static class.

[0030] Furthermore, in S4, the method for replacing the corresponding type is as follows:

[0031] If the type is a reference type, replace it with System.Object; if the type is an enumeration type, replace it with the corresponding primitive type; other types are not processed.

[0032] Furthermore, the method for replacing the access method of instance fields is as follows:

[0033] Extract instance fields, create a random structure, embed the instance field in the random structure, and replace access to the instance field with access to a field in the random structure.

[0034] Furthermore, the method for modifying the reference opcode of the converted static method is as follows:

[0035] The callvirt opcode is used to call the instance method. Since it is converted into a static method, the reference is changed to the call opcode.

[0036] Furthermore, generics do not represent specific types, but represent any type that meets the constraints;

[0037] The generic parameter represents this arbitrary type. When the generic parameter is instantiated, the generic parameter is replaced by the specific type used in the instantiation.

[0038] On the other hand, the present invention discloses a .NET platform code protection system based on member structure obfuscation, which is applied to the .NET platform code protection method based on member structure obfuscation, and includes: an initialization module, a member relationship rearrangement module, a static member transfer module, a member type hiding module, and an instance member field hiding module;

[0039] The initialization module is used to initialize the metadata table;

[0040] The member relationship rearrangement module is used to traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement;

[0041] The static member transfer module is used to re-traverse the members of each class. During the transfer of static members, the generic parameters are forwarded, and the static fields and static methods in the static members are moved to the randomly created class to complete the transfer of static members.

[0042] The member type hiding module is used to re-traverse the members of each class, uniformly process the types of fields, method parameters, and return types, replace the corresponding types, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types;

[0043] The instance member field hiding module is used to re-traverse the members of each instance class, replace the access mode of the instance field, and complete the field hiding of the instance member.

[0044] Beneficial effects of the present invention:

[0045] 1. By moving static members to randomly created classes, it is impossible to use decompilation tools to see the members and functions of a class, thus preventing analysis.

[0046] 2. Replace the type so that it does not affect the operation and cannot be analyzed.

[0047] 3. By replacing the access method of instance fields, the analyst can see a layer of structures instead of a simple and clear class with clear field definitions, thus achieving the purpose of protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flowchart of a .NET platform code protection method based on member structure obfuscation is provided in an embodiment.

[0049] Figure 2 A block diagram of a .NET platform code protection system based on member structure obfuscation is provided in an embodiment. DETAILED DESCRIPTION

[0050] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Example 1

[0052] In this embodiment, if Figure 1 As shown, a .NET platform code protection method based on member structure obfuscation includes the following steps:

[0053] S1: Initialize the metadata table;

[0054] S2: traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement;

[0055] S3: Re-traverse the members of each class. During the transfer of static members, forward the generic parameters, move the static fields and static methods to the randomly created classes, and complete the transfer of static members.

[0056] S4: Re-traverse the members of each class, unify the field types, method parameters, and return types, replace the corresponding types, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types;

[0057] S5: Re-traverse the members of each instance class, replace the access method of the instance field, and complete the field hiding of the instance member.

[0058] In this embodiment, if a class is declared in another class, this class is a nested class. If the class is static, it is static, otherwise it is an instance class.

[0059] In this embodiment, members include methods and fields;

[0060] The data structure of a class contains a method list, a field list, and a subclass list.

[0061] More specifically, in S1, the specific steps for initializing the metadata table are as follows:

[0062] S101: Parse the metadata of the input .NET assembly to obtain the metadata table stream, string heap, and Blob heap;

[0063] S102: The relationship between classes and members is organized into a tree structure; the data structure of the class includes a method list, a field list, and a subclass list;

[0064] S103: Initialization is completed, and the instance method is converted to a static method.

[0065] More specifically, in S2, the specific steps for converting non-static members into static members are as follows:

[0066] S201: Determine whether a member of an instance class is a static member; if it is an instance member, proceed to S202; if it is a static member, proceed to S204;

[0067] S202: Filter out instance fields and virtual methods in instance members, and retain non-virtual instance methods;

[0068] S203: adding the this parameter of the non-virtual instance method to the parameter list and converting it to a static method; modifying the reference operation code of the converted static method; completing the conversion of the static member;

[0069] S204: Move static members to randomly created classes.

[0070] More specifically, in S3, the specific steps for forwarding generic parameters are as follows:

[0071] S301: If it is a static field, move it to a randomly created class; if the type of the static field contains generic parameters, forward the generic parameters;

[0072] S302: If it is a static method, move it to a randomly created class; if the parameter type of the static method contains generic parameters or the return type of the static method contains generic parameters, forward the generic parameters;

[0073] S303: Complete the transfer of static members. This randomly created class is a static class.

[0074] More specifically, in S4, the method for replacing the corresponding types is as follows:

[0075] If the type is a reference type, replace it with System.Object; if the type is an enumeration type, replace it with the corresponding primitive type; other types are not processed.

[0076] More specifically, the method for replacing the access method of instance fields is as follows:

[0077] Extract instance fields, create a random structure, embed the instance field in the random structure, and replace access to the instance field with access to a field in the random structure.

[0078] More specifically, the method for modifying the reference opcode of the converted static method is as follows:

[0079] The callvirt opcode is used to call the instance method. Since it is converted into a static method, the reference is changed to the call opcode.

[0080] Notes on the reference: callvirt is used to call instance methods, and call is used to call static methods. After the conversion is completed, the place where this static method (the original instance method) is called needs to update the opcode from callvirt to call.

[0081] More specifically, generics do not represent specific types, but any type that meets the constraints;

[0082] The generic parameter represents this arbitrary type. When the generic parameter is instantiated, the generic parameter is replaced by the specific type used in the instantiation.

[0083] Example 2

[0084] In this embodiment, a .NET platform code protection system based on member structure obfuscation is applied to the .NET platform code protection method based on member structure obfuscation described in Embodiment 1, including: an initialization module, a member relationship rearrangement module, a static member transfer module, a member type hiding module, and an instance member field hiding module;

[0085] The initialization module is used to initialize the metadata table;

[0086] The member relationship rearrangement module is used to traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement;

[0087] The static member transfer module is used to re-traverse the members of each class. During the transfer of static members, the generic parameters are forwarded, and the static fields and static methods in the static members are moved to the randomly created class to complete the transfer of static members.

[0088] The member type hiding module is used to re-traverse the members of each class, uniformly process the types of fields, method parameters, and return types, replace the corresponding types, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types;

[0089] The instance member field hiding module is used to re-traverse the members of each instance class, replace the access mode of the instance field, and complete the field hiding of the instance member.

[0090] Example 3

[0091] In this embodiment, a .NET platform code protection method based on member structure obfuscation is described in Example 1; static methods are methods with static tags, and instance methods are methods without static tags. Members (Method), fields (Field), properties (Property), and events (Event). Static classes are classes marked with static, and instance classes are classes without static tags. In object-oriented programming, static methods, static fields, and static classes can be directly called without constructing instance objects. Instance members are associated with the instance class in which they are located, and the data structure relationship of the class can be manually derived, etc. After being converted to static, they are no longer associated with the class in which they are located, and can be moved to other classes at will, and the relationship between them cannot be analyzed.

[0092] Virtual method is a concept in object-oriented programming, which means that the method can be overridden and the method of the subclass can be called through the pointer of the base class object.

[0093] A nested class is a class defined within a class, rather than a class defined directly in a namespace.

[0094] This parameter is required to reference instance members, which represents the current instance. The data of instance members is in the associated this parameter.

[0095] Calling an instance method means calling a method with the instance flag and requires the this parameter.

[0096] The Callvirt opcode is a type of opcode in MSIL code, usually used to call instance methods. This ensures that when an instance method has an inheritance relationship, the implementation in the subclass is called.

[0097] The Call opcode is a type of opcode in MSIL code that directly calls the specified method. It is usually used to call static methods because there is no need to worry about whether there is an inheritance relationship.

[0098] Table streams, string heaps, and blob heaps are all metadata streams, which are collections of specific data types.

[0099] Generics do not represent specific types, but can represent any type that meets the constraints. The generic parameter represents this arbitrary type. When the generic parameter is instantiated, the generic parameter will be replaced by the specific type used in the instantiation.

[0100] Enumeration type, referring to the Enum type, is a constant integer with a specified type name.

[0101] A reference type is a type allocated on the heap, which is equal to the type name plus a pointer in C++.

[0102] A value type (structure) refers to a type allocated on the stack, which is equivalent to directly using the type name in C++. An enumeration type is a special value type.

[0103] Primitive types are types that are built into the .NET runtime.

[0104] System.Object is the base class for all types.

[0105] The role of S1 is to parse metadata into a suitable data structure for subsequent processing.

[0106] The role of S2 is to convert instance methods to static methods, so that the instance methods can be stripped from the class and moved to other classes.

[0107] The function of S3 is to move static members (including static methods and static fields) to a new randomly created static class, so that the members and functions of a class cannot be seen through decompilation tools, thereby preventing analysis.

[0108] The function of S4 is that when writing code, methods and fields are all given specific types, so that through the decompilation tool, you can see what parameters a method needs and what types a class field is. Because .NET programs do not need specific type information (for reference types) in most cases, these types can be set to System.Object, which is the base class of reference types. This can achieve the purpose of not affecting the operation but failing to analyze.

[0109] The role of S5 is to create a new structure while there are instance fields in the final instance class that are not confused. Then the fields are moved to the new structure and the structure is embedded back into the previous class. In this way, the analyst will see layers of structures instead of a simple and clear class with clear field definitions.

[0110] Obviously, the above embodiments of the present invention are only examples for clearly explaining the present invention, and are not intended to limit the implementation methods of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A .NET platform code protection method based on member structure obfuscation, characterized in that: The following steps are involved: S1: Initialize the metadata table; S101: Parse the metadata of the input .NET assembly to obtain the metadata table stream, string heap, and Blob heap; S102: The relationship between classes and members is organized into a tree structure; the data structure of the class includes a method list, a field list, and a subclass list; S103: Initialization is completed, and the instance method is converted to a static method; S2: traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement; S3: Re-traverse the members of each class. During the transfer of static members, forward the generic parameters, move the static fields and static methods to the randomly created classes, and complete the transfer of static members. S4: Re-traverse the members of each class, unify the field types, method parameters, and return member types, replace the types of the corresponding fields, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types; S5: Re-traverse the members of each instance class, replace the access method of the instance field, and complete the field hiding of the instance member.

2. A .NET platform code protection method based on member structure obfuscation according to claim 1, characterized in that: Members include methods and fields; The data structure of a class contains a method list, a field list, and a subclass list.

3. A .NET platform code protection method based on member structure obfuscation according to claim 2, characterized in that: In S2, the specific steps for converting non-static members into static members are as follows: S201: Determine whether a member of an instance class is a static member; if it is an instance member, proceed to S202; if it is a static member, proceed to S204; S202: Filter out instance fields and virtual methods in instance members, and retain non-virtual instance methods; S203: Add the this parameter of the non-virtual instance method to the parameter list and convert it into a static method; Modify the reference operation code of the converted static method; complete the conversion of the static member; S204: Move static members to randomly created classes.

4. A .NET platform code protection method based on member structure obfuscation according to claim 2, characterized in that: In S3, the specific steps for forwarding generic parameters are as follows: S301: If it is a static field, move it to a randomly created class; if the type of the static field contains generic parameters, forward the generic parameters; S302: If it is a static method, move it to a randomly created class; if the parameter type of the static method contains generic parameters or the return type of the static method contains generic parameters, forward the generic parameters; S303: Complete the transfer of static members. This randomly created class is a static class.

5. A .NET platform code protection method based on member structure obfuscation according to claim 2, characterized in that: In S4, the method for replacing the corresponding type is as follows: If the type is a reference type, replace it with System.Object; if the type is an enumeration type, replace it with the corresponding primitive type; other types are not processed.

6. A .NET platform code protection method based on member structure obfuscation according to claim 2, characterized in that: The method to replace the access method of instance fields is as follows: Extract instance fields, create a random structure, embed the instance field in the random structure, and replace access to the instance field with access to a field in the random structure.

7. A .NET platform code protection method based on member structure obfuscation according to claim 3, characterized in that: The method to modify the reference opcode of the converted static method is as follows: The callvirt opcode is used to call the instance method. Since it is converted into a static method, the reference is changed to the call opcode.

8. A .NET platform code protection method based on member structure obfuscation according to claim 4, characterized in that: Generic means that it does not represent a specific type, but represents any type that meets the constraints; The generic parameter represents this arbitrary type. When the generic parameter is instantiated, the generic parameter is replaced by the specific type used in the instantiation.

9. A .NET platform code protection system based on member structure obfuscation, applied to the .NET platform code protection method based on member structure obfuscation according to any one of claims 1 to 8, characterized in that: include: Initialization module, member relationship rearrangement module, static member transfer module, member type hiding module, instance member field hiding module; The initialization module is used to initialize the metadata table; The member relationship rearrangement module is used to traverse the members of each instance class, convert non-static members into static members, and start moving all static members to the randomly created class to complete the member relationship rearrangement; The static member transfer module is used to re-traverse the members of each class. During the transfer of static members, the generic parameters are forwarded, and the static fields and static methods in the static members are moved to the randomly created class to complete the transfer of static members. The member type hiding module is used to re-traverse the members of each class, uniformly process the types of fields, method parameters, and return types, replace the corresponding types, randomize the order of method parameters, repair references to method parameters, and complete the hiding of member types; The instance member field hiding module is used to re-traverse the members of each instance class, replace the access mode of the instance field, and complete the field hiding of the instance member.

Images