A dynamic library protection method, device, equipment and medium

Abstract

The application discloses a dynamic library protection method and device, equipment and medium, and relates to the technical field of software security. The method comprises the following steps: a constructor of a dynamic library is called to obtain current operation control; after the current operation control is obtained, the constructor is used to read memory layout information corresponding to an encrypted dynamic library file from an embedded platform; position information of a target data structure of the encrypted dynamic library file in the memory of the embedded platform is determined based on the memory layout information, and the position information is used to determine a target memory position of a to-be-decrypted element in the encrypted dynamic library file on the memory of the embedded platform; the to-be-decrypted element on the target memory position is decrypted, and the decryption result is overwritten and written into the target memory position, so that a target dynamic library file used for being called and executed is obtained. The position of the to-be-decrypted element is accurately found for decryption based on the obtained memory layout information at runtime. The dynamic library file is always in an encrypted state in a static storage state.

Description

Technical Field

[0001] This invention relates to the field of software security technology, and in particular to a method, apparatus, device, and medium for protecting dynamic libraries. Background Technology

[0002] The vast majority of servers in the internet infrastructure are based on the Linux system platform. Unlike Windows (Microsoft Windows operating system), which is geared towards a wider range of ordinary users, Linux has a smaller user base and receives less attention. This has resulted in slower development and fewer solutions for software code encryption and protection on this platform, leading to higher development and usage costs. Furthermore, compared to ELF (Executable and Linkable Format) executable files on Linux, .so (Shared Object) dynamic link libraries receive even less attention and research, and related encryption and protection solutions are extremely rare.

[0003] Android's encrypted protection scheme for shared object (SO) dynamic libraries heavily relies on the system loading implementation techniques of Android, making it unusable directly on Linux. For example, "replacing the encrypted dynamic library information stored in the system" implies that the loader program can access and modify data structures maintained in the system. However, on Linux, a dynamic library reference only provides a handle variable, and this variable is not bound to any system data structures. Therefore, there is no way to directly modify or replace this data. While modifications can be made in other ways, the corresponding technical implementation difficulties are significantly greater compared to this scheme.

[0004] The open-source packer tool UPX (The Ultimate Packer for eXecutables) implements a dynamic library packing protection scheme. It primarily relies on the fixed initialization function `_init` in the dynamic library. This function is a default function used to perform some initialization operations during dynamic library loading to ensure normal operation. UPX intercepts and modifies the `_init` function, adding loader code to achieve decryption and redirection of the dynamic library during loading. Because it requires modifying the original program code and adding a new loader, while also handling dynamic library loading and redirection, UPX's dynamic library packing has certain limitations. It cannot protect some special dynamic libraries (e.g., those without a `_init` function, those using certain compilation parameters that enable special techniques, etc.). Summary of the Invention

[0005] The purpose of this invention is to provide a dynamic library protection method, apparatus, device, and medium that can encrypt and protect .so dynamic libraries on the Linux platform.

[0006] In a first aspect, embodiments of the present invention provide a dynamic library protection method, comprising:

[0007] Gain control of the current operation by calling the constructor of the dynamic library;

[0008] After gaining control of the current operation, the constructor is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform;

[0009] Based on the memory layout information, the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory is determined, and the location information is used to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory.

[0010] The element to be decrypted at the target memory location is decrypted, and the decryption result is overwritten and written to the target memory location to obtain the target dynamic library file to be called and executed.

[0011] Optionally, before obtaining current operational control by calling the constructor of the dynamic library, the process further includes:

[0012] Obtain the file protection instruction for encryption protection, and read the corresponding target dynamic library file in the dynamic library based on the file protection instruction;

[0013] The target dynamic library file is subjected to data structure analysis to determine the elements in the target dynamic library file that need to be encrypted and protected, and the elements to be encrypted are encrypted using a preset encryption algorithm to obtain the corresponding encryption result.

[0014] The encryption result is written into the target dynamic library file to overwrite the element to be encrypted in the target dynamic library file, thus obtaining the encrypted dynamic library file.

[0015] Optionally, after obtaining the encrypted dynamic library file, the process further includes:

[0016] Determine the target location of the encrypted code section from the encrypted dynamic library file;

[0017] Insert a constructor that represents the decryption function executed at runtime by the dynamic library after the target location;

[0018] The positional changes of each file part in the encrypted dynamic library file caused by the insertion of the constructor are written to the file header structure, section structure list, and segment structure list.

[0019] Optionally, reading the corresponding target dynamic library file in the dynamic library based on the file protection instruction includes:

[0020] Based on the file protection instruction, a file reading operation is performed on the dynamic library to read the target dynamic library file specified by the file protection instruction from the dynamic library, and the file reading log corresponding to the file reading operation is output.

[0021] The file read log includes the path and size of the target dynamic library file, as well as the start and end times of the file read operation.

[0022] Optionally, the step of performing data structure analysis on the target dynamic library file to determine the elements in the target dynamic library file that need to be encrypted includes:

[0023] The target dynamic library file is parsed to obtain the file header structure;

[0024] The list of section structures and the list of segment structures are determined based on the file header structure;

[0025] Based on the position information in the list of section structures and the list of segment structures, determine the elements in the target dynamic library file that need to be encrypted.

[0026] Optionally, determining the section structure list and segment structure list based on the file header structure includes:

[0027] Based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure, the corresponding section structure list and segment structure list are determined respectively.

[0028] Accordingly, determining the elements in the target dynamic library file that need to be encrypted based on the position information in the section structure list and the segment structure list includes:

[0029] Based on the string section number recorded in the file header structure, the corresponding target string is searched from the section structure list, and the target string is used as the element to be encrypted in the target dynamic library file that needs to be protected by encryption.

[0030] The string section number is the sequence number of the string containing the section and function name.

[0031] Optionally, determining the corresponding section structure list and segment structure list based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure includes:

[0032] Based on the first address offset information of the section table recorded in the file header structure, locate the first starting position of the section table;

[0033] Traverse each section structure from the first starting position to construct a list of section structures based on each section structure; each section structure includes the section name, section type, section offset in the dynamic library file, and section size;

[0034] Based on the second address offset information of the segment table recorded in the file header structure, locate the second starting position of the segment table;

[0035] Traverse each segment structure from the second starting position to construct the segment structure list based on each segment structure; the segment structure includes the starting address of the segment, the length of the segment, and the permissions of the segment.

[0036] Optionally, the step of searching for the corresponding target string from the list of section structures based on the string section number recorded in the file header structure, and using the target string as the element to be encrypted in the target dynamic library file that needs to be protected by encryption, includes:

[0037] Traverse the section structures in the list of located section structures, and search for the corresponding target string in the section structure based on the string section number recorded in the file header structure to determine the code section and data section in the target dynamic library file that need to be encrypted and protected.

[0038] Optionally, determining the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information includes:

[0039] Based on the list information in the file header structure, segment structure list, and section structure list of the encrypted dynamic library file in the memory layout information, the location information of the target section structure in the embedded platform memory is calculated.

[0040] Optionally, calculating the location information of the target section structure in the embedded platform memory based on the list information in the file header structure, segment structure list, and section structure list of the encrypted dynamic library file in the memory layout information includes:

[0041] Read the file header structure of the encrypted dynamic library file from the executable memory region of the memory layout information;

[0042] Based on the first address offset information recorded in the file header structure and the format information of the encrypted dynamic library file, the location segment structure list is positioned in the first position information of the encrypted dynamic library file.

[0043] Based on the second address offset information recorded in the file header structure and the format information of the encrypted dynamic library file, locate the second position information of the section structure list in the encrypted dynamic library file;

[0044] Obtain the file offset addresses of any two loadable segments from the segment structure list, and perform memory page operations based on the file offset addresses to obtain the base memory address;

[0045] The section memory address of the target section structure in the embedded platform memory is calculated based on the memory base address, the first location information, and the second location information.

[0046] Secondly, this application discloses a dynamic library protection device, comprising:

[0047] The control acquisition module is used to acquire control of the current operation by calling the constructor of the dynamic library;

[0048] The layout information reading module is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform using the constructor after obtaining the current operation control.

[0049] The location determination module is used to determine the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information, and to use the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory.

[0050] The decryption module is used to decrypt the element to be decrypted at the target memory location and write the decryption result to the target memory location to obtain the target dynamic library file to be called and executed.

[0051] Thirdly, this application discloses an electronic device, including:

[0052] Memory, used to store computer programs;

[0053] A processor is configured to execute the computer program to implement the steps of the aforementioned disclosed dynamic library protection method.

[0054] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed dynamic library protection method.

[0055] As can be seen, this application provides a dynamic library protection method, including: obtaining current operation control by calling the constructor of the dynamic library; after obtaining current operation control, using the constructor to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform; determining the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information, and using the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory; decrypting the element to be decrypted at the target memory location, and overwriting the decryption result to the target memory location to obtain the target dynamic library file for being called and executed.

[0056] As can be seen from the above technical solution, this invention implements its core functionality by calling the constructor of the dynamic library. It does not rely on the specific loading mechanisms or functions of any particular operating system, requires no complex external loader development and maintenance, and necessitates no extensive modifications or interactions to the system's underlying data structures. Furthermore, the encrypted dynamic library file is only decrypted after being loaded into the embedded platform's memory, and decryption is performed at runtime based on the acquired memory layout information to accurately locate the element to be decrypted. This ensures that the dynamic library file remains encrypted throughout its static storage state, significantly increasing the difficulty for attackers to obtain the original code and data, and effectively protecting sensitive information within the dynamic library. Attached Figure Description

[0057] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A flowchart of a dynamic library protection method provided in an embodiment of the present invention;

[0059] Figure 2 A component architecture diagram of a SO dynamic library protection scheme provided in an embodiment of the present invention;

[0060] Figure 3 A flowchart illustrating the encryption process of a SO dynamic library is provided in this embodiment of the invention.

[0061] Figure 4 A flowchart of runtime decryption execution for a SO dynamic library is provided as an embodiment of the present invention.

[0062] Figure 5 A simplified diagram of file-memory layout and basic address provided in an embodiment of the present invention;

[0063] Figure 6 This is a schematic diagram of a dynamic library protection device provided in an embodiment of the present invention;

[0064] Figure 7 This is a diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0066] The terms "comprising" and "having," and any variations thereof, in the specification and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may include steps or units not listed.

[0067] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] With the development of the internet, various application software have emerged in an endless stream. Furthermore, as national and public awareness of security and privacy continues to rise, the requirements for software security are also increasing. Therefore, using obfuscation and encryption technologies to protect software code, improve the security of the software itself, prevent software from being cracked, protect software intellectual property rights, and prevent information leakage has become more widespread and important.

[0069] The vast majority of servers in the internet infrastructure are based on the Linux system platform. Unlike Windows, which is geared towards a wider range of ordinary users, Linux has a smaller user base and receives less attention. This has resulted in slower development and fewer solutions for software code encryption and protection on this platform, leading to higher development and usage costs. Furthermore, compared to ELF executable files on Linux, .so dynamic link libraries receive even less attention and research, and related encryption and protection solutions are extremely rare.

[0070] Currently, the encryption protection scheme for .so dynamic libraries in Android systems relies on a core technology: after encrypting the dynamic library, a loader program is added to the file. This program executes when the dynamic library is loaded, decrypts the original dynamic library code, and then processes the decrypted dynamic library, mimicking the loading and redirection process in the original system, ensuring its normal operation. After processing, the relevant redirection addresses and parameters are used to replace the encrypted dynamic library information stored in the system (because the system loads and redirects the encrypted dynamic library, the relevant information is also incorrect and cannot be used directly), and then the normal code flow is returned for execution. However, the encryption protection scheme for .so dynamic libraries in Android heavily depends on the system loading implementation technology of Android, making it unusable on Linux. For example, "replacing the encrypted dynamic library information stored in the system" means that the loader program can obtain and modify the data structures maintained in the system. However, in Linux, a dynamic library reference only provides a handle variable, and this variable is not bound to the data structures in the system, so there is no way to directly modify and replace this data. Although modifications can be made in other ways, the corresponding technical implementation difficulty is much greater than that of this scheme.

[0071] The open-source packer UPX implements a dynamic library packer protection scheme. It primarily relies on the fixed initialization function `_init` within the dynamic library. This function is a default function used to perform initialization operations during dynamic library loading to ensure proper functioning. UPX intercepts and modifies the `_init` function, adding loader code to achieve decryption and redirection of the dynamic library during loading.

[0072] Because it requires modifying the original program code and adding new loader code, as well as handling dynamic library loading and redirection, UPX's dynamic library packing has certain limitations. It cannot protect some special dynamic libraries (such as those without a _init function, those that use certain compilation parameters to enable special technologies, etc.).

[0073] To address this, the present invention provides a dynamic library protection scheme that can be used to protect the code and data in .so dynamic libraries under Linux, prevent them from being cracked, protect software security, and prevent information leakage.

[0074] Reference Figure 1 As shown, the present invention provides a dynamic library protection method, comprising:

[0075] Step S11: Obtain control of the current operation by calling the constructor of the dynamic library.

[0076] The dynamic library protection method of this invention is applied to SO dynamic library protection scheme components, such as... Figure 2 As shown, the components include a SO dynamic library encryption and protection program and an SO dynamic library runtime decryption module. The SO dynamic library encryption and protection program is a tool provided to the user to receive user input for encrypting and protecting a specified SO dynamic library. Internally, it mainly consists of three parts: a front-end part responsible for receiving user instructions, reading and writing the specified SO dynamic library file, and outputting program execution logs; a structure analysis part responsible for analyzing the relevant data structures in the SO dynamic library file and recording them for encryption; and an encryption part responsible for encrypting the key code and data in the SO dynamic library file and injecting the SO dynamic library runtime decryption module into the SO dynamic library file after encryption. The SO dynamic library runtime decryption module is the core module of this invention. It mainly implements the function of performing structure analysis on the data in memory and decrypting the encrypted key code and data when the encrypted dynamic library is loaded. The module mainly consists of three parts: a loading and constructor part responsible for obtaining execution rights when the dynamic library is loaded and calling the analysis and decryption functions; a structure analysis part responsible for analyzing and locating the SO dynamic library data structure in memory after system redirection; and a decryption part responsible for decrypting the encrypted key code and data after obtaining the location in memory.

[0077] In this embodiment, before obtaining current operation control by calling the constructor of the dynamic library, the method further includes: obtaining a file protection instruction for encryption protection, and reading the corresponding target dynamic library file in the dynamic library based on the file protection instruction; performing data structure analysis on the target dynamic library file to determine the elements to be encrypted in the target dynamic library file that need to be encrypted, and encrypting the elements to be encrypted using a preset encryption algorithm to obtain the corresponding encryption result; writing the encryption result into the target dynamic library file to overwrite the elements to be encrypted in the target dynamic library file, thereby obtaining the encrypted dynamic library file. Figure 3 As shown, step 1: Obtain the file protection command input by the user, ". / program name, path to be encrypted .so file, and filename", and execute the program based on this file protection command. The program obtains the .so path and filename specified in the parameters and performs a file validity check on them. If the file does not exist, or if there is no permission to read or write, the relevant error log information is output, and the program exits.

[0078] In this embodiment, reading the target dynamic library file corresponding to the dynamic library based on the file protection instruction includes: performing a file reading operation on the dynamic library based on the file protection instruction to read the target dynamic library file specified by the file protection instruction from the dynamic library, and outputting a file reading log corresponding to the file reading operation; wherein, the file reading log includes the path, size, start time, and end time of the file reading operation of the target dynamic library file. It can be understood that in step 2: after the program determines the file validity, it opens the target dynamic library file of the dynamic library in read-write mode and outputs the relevant file reading log.

[0079] In this embodiment, the step of performing data structure analysis on the target dynamic library file to determine the elements to be encrypted in the target dynamic library file that need to be protected includes: parsing the target dynamic library file to obtain the file header structure; determining the section structure list and segment structure list based on the file header structure; and determining the elements to be encrypted in the target dynamic library file that need to be protected based on the position information in the section structure list and the segment structure list. It can be understood that step 3: reading the file content of the target dynamic library file and parsing and verifying the internal data structure. The main structures to be parsed are the file header structure, the section structure list, and the segment structure list. These three structures are data structures defined and contained in executable files under the Linux platform. They are used to locate the location of various types of data in the file, such as the location of code data (defined as an offset relative to the file header), the location of static data (such as strings), etc.

[0080] Specifically, determining the section structure list and segment structure list based on the file header structure includes: determining the corresponding section structure list and segment structure list based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure; correspondingly, determining the element to be encrypted in the target dynamic library file that needs to be encrypted and protected based on the position information in the section structure list and the segment structure list includes: searching for the corresponding target string in the section structure list based on the string section number recorded in the file header structure, and using the target string as the element to be encrypted and protected in the target dynamic library file; wherein, the string section number is the sequence number of the string containing the section and function names. It is understood that determining the corresponding section structure list and segment structure list based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure includes: locating the first starting position of the section table according to the first address offset information of the section table recorded in the file header structure; traversing each section structure from the first starting position to construct the section structure list based on each section structure; the section structure includes the section name, section type, section offset in the dynamic library file, and section size; locating the second starting position of the segment table according to the second address offset information of the segment table recorded in the file header structure; traversing each segment structure from the second starting position to construct the segment structure list based on each segment structure; the segment structure includes the segment's starting address, segment length, and segment permissions.

[0081] The segment structure list includes the following:

[0082] Recording information related to memory region partitioning: The segment structure list is primarily used to record the different regions in memory (or files) where a dynamic library is located. In a dynamic library file (such as ELF format), a segment is a coarse-grained division of the file content. For example, a typical segment might be a code segment containing program code, or a data segment containing initialized data. The segment structure list records information such as the starting address (offset in the file), length, and permission attributes of these segments.

[0083] Mapping memory regions and file content: This involves mapping the distribution of dynamic library content within the file to the regions in memory where it is loaded. For example, during loading, the system uses information from the segment structure list to load the code segment content from the file into the "r-xp" (executable and readable) permission region in memory, and the data segment content into the "r--p" (readable) permission region, etc. This helps the system correctly place different parts of the dynamic library in the appropriate locations in memory and set the correct access permissions.

[0084] Assisted Redirection and Access Control: The information in the segment structure list is crucial for the redirection process. It helps the system determine the actual location of each segment in memory and adjusts the addresses of functions and data within a segment based on load-time conditions (such as changes in load addresses). This information is also used to control access to different segments; for example, code segments are typically set to executable and readable permissions to prevent accidental write operations from causing program errors.

[0085] The section structure list includes the following:

[0086] Recording finer-grained code and data distribution: The section structure list provides a more granular record of the dynamic library's contents. A segment may contain multiple sections. For example, a code segment might contain different function code sections, read-only data sections, etc.; a data segment might contain initialized data sections, uninitialized data sections, etc. The section structure list records detailed information for each section, including its offset within the segment, length, and type (such as code, data, symbol table, etc.).

[0087] Precisely locating code and data elements: During the decryption process, especially when locating the code and data to be decrypted, the section structure list plays a crucial role. By traversing the section structure list, the specific code section (containing the encrypted function code) and data section (containing the encrypted key data) can be found. For example, when decrypting the code of a specific function, the section structure list can be used to find the code section containing that function, and then its encrypted byte stream can be obtained for decryption.

[0088] Association with Symbol Tables and Other Structures: The section structure list is also associated with other structures in the dynamic library, such as the symbol table. The symbol table records information such as the names, types, and locations of functions and variables within the file. The section structure list allows mapping symbols in the symbol table to actual code and data sections; for example, determining the code section location corresponding to a function symbol or the data section location corresponding to a global variable symbol. This is crucial for understanding the internal structure of the dynamic library and for correctly decrypting and restoring its functionality.

[0089] Furthermore, the step of searching for the corresponding target string from the list of section structures based on the string byte number recorded in the file header structure, and using the target string as the element to be encrypted in the target dynamic library file, includes: traversing the section structures in the located list of section structures, searching for the corresponding target string from the section structures based on the string byte number recorded in the file header structure, and determining the code section and data section in the target dynamic library file that need to be encrypted. Figure 3As shown, step 4: Based on the data recorded in the structure obtained in step 3, locate and position the sections containing code data and the sections containing static data. The positioning method is as follows: Obtain the sequence number of the string section (containing all section / function name strings) in the file header structure, and find the section in the section structure list according to the sequence number; traverse all section structures, search for the corresponding name string in the string section according to the name information stored in the structure, and compare the search target to determine whether it is the target section. The main elements to be encrypted that need to be protected are the ".text" section and the ".rodata" section.

[0090] Specifically, the comparison process is as follows:

[0091] Extracting Name Information: For each section structure in the list of section structures, the program extracts and saves its name information according to its defined format. This name information is either an index to a string or the actual string (depending on the specific implementation of the file format).

[0092] Find the match in the string section: Using the name information extracted earlier, search for the corresponding name string in the string section (the section containing all section / function name strings that was previously located by the sequence number in the file header structure).

[0093] Determining if it's a target section: If the name string found in the string section is the same as the name of the target section (i.e., the ".text" section or the ".rodata" section), then the section corresponding to the currently traversed section structure is determined to be the target section. For example, if the name information extracted from the section structure corresponds to the string ".text" in the string section, then the section corresponding to that section structure is the code section, which is one of the target sections to be located.

[0094] Next, proceed to step 5: encrypt the found code section and static data section. The main reason for encrypting these two sections is that the code section contains the most core functional code data, which must be encrypted to resist reverse engineering; while the static data section contains the static data required for code execution, mainly various strings (such as text prompts, key strings such as keys, etc.), which also need to be encrypted to prevent information leakage.

[0095] In this embodiment, after obtaining the encrypted dynamic library file, the method further includes: determining the target position of the encrypted code section from the encrypted dynamic library file; inserting a constructor representing the execution of decryption functions at runtime after the target position; and writing the positional change information of each file part in the encrypted dynamic library file caused by the insertion of the constructor into the file header structure, section structure list, and segment structure list. It is understood that, as Figure 3As shown, after obtaining the encrypted dynamic library file, step 6 is executed: Modify the encrypted SO dynamic library file by inserting a new section after the code section. This new section contains the code for the SO dynamic library's serialization function, which acts as the runtime decryption section (constructor) for the SO dynamic library. Then, the information of this section, along with any changes to other sections and segments required (or resulting from) its insertion, is modified in the file header structure, section structure, and segment structure obtained in step 3. The core of this step is that a custom function can be specified as the constructor in the dynamic library. This function runs when the dynamic library is loaded. By adding a custom constructor, control of the program can be obtained after the dynamic library is loaded and redirected, but before it is actually called and executed, thus enabling decryption of the code and data. Step 7: Write the encrypted and modified dynamic library data back to the original file for storage. Dynamic library encryption protection is complete.

[0096] In this embodiment, after the aforementioned components complete the encryption of the code section and static data section of the target dynamic library file, the encrypted dynamic library file is still stored in the dynamic library, and the storage method is static storage, such as... Figure 4 As shown, when the executable program needs to load and run the target dynamic library file, it executes step 1: automatically loading and redirecting the dynamic library; step 2: after the automatic loading of the encrypted dynamic library file on the Linux platform is completed, the constructor of the SO dynamic library is called to obtain current operation control. This constructor is the runtime decryption module of the SO dynamic library inserted by the encryption tool. It is important to note that the encrypted SO dynamic library is loaded and redirected by the system before the runtime decryption module begins to locate and decrypt the code and data. Therefore, the tool itself does not need to perform relocation and replacement / restoration of the original SO dynamic library information. In this way, the present invention reduces coding difficulty and improves ease of use.

[0097] Step S12: After obtaining the current operation control, use the constructor to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform.

[0098] In this embodiment, after gaining control of the current operation, step 3 is executed: The memory layout information of the SO dynamic library is obtained directly by reading the memory layout information from ` / proc / programPID / maps`. The most important areas are the "r-xp" permission area and the two "r--p" permission areas, where 'r' represents readable and 'x' represents executable. The former is the executable memory area storing program code (not just code), and the latter is the data memory area storing static data (not just data). Then, the module reads the dynamic library's file header structure from the header of the executable memory area and obtains the addresses of the section structure list and segment structure list (stored as offsets). It is important to note that the offset data obtained here corresponds to the offset in the file, not in memory, so conversion is required.

[0099] Step S13: Based on the memory layout information, determine the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory, and use the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory.

[0100] In this embodiment, the location information of the target section structure in the embedded platform memory is calculated based on the list information in the file header structure, segment structure list, and section structure list of the encrypted dynamic library file in the memory layout information. Specifically, the file header structure of the encrypted dynamic library file is read from the executable memory area of ​​the memory layout information; the first position information of the segment structure list in the encrypted dynamic library file is located according to the first address offset information recorded in the file header structure and the format information of the encrypted dynamic library file; the second position information of the section structure list in the encrypted dynamic library file is located according to the second address offset information recorded in the file header structure and the format information of the encrypted dynamic library file; the file offset addresses of any two loadable segments are obtained from the segment structure list, and memory page operations are performed based on the file offset addresses to obtain the memory base address; the section memory address of the target section structure in the embedded platform memory is calculated based on the memory base address, the first position information, and the second position information. The section memory address translation logic is understandable: It retrieves the file offset addresses of two loadable segments from the segment structure list. After loading and redirection, these segments correspond to the executable memory region and the data memory region, respectively. Then, it performs a memory page size alignment operation, and the resulting address becomes the base address for calculating subsequent addresses. Using the segment file offset address and the base memory address as a reference, it calculates the section memory address using the algorithm: Section memory address = Section file offset address - Segment file offset address + Segment base memory address. This is used as a reference to find the position of the section structure list in the data memory region. Then, it iterates through the section structure list to locate the code and data sections. Next, it executes step 4: After locating the relevant data structures in memory in step 3, it begins searching for the code and data sections, using the same algorithm as the data encryption part. Figure 5As shown, the left side includes a file header structure, a list of segment structures, and a list of section structures. The file header structure is the beginning of the ELF file and contains basic information describing the entire file, such as file type, target machine architecture, file version, and entry point address. From the file header structure, two arrows point to the "segment structure list" and the "section structure list," respectively. The segment structure list contains information about segments in the ELF file. A segment is a combination of file content, used for easier management during memory loading and mapping. Arrows from the segment structure list point to "loadable segments," indicating that these segments can be loaded into memory. One loadable segment contains "core code data and other executable content," which, after being loaded into memory, is mapped to the executable memory region. The section structure list contains information about sections in the ELF file. Sections are fine-grained divisions of file content. Arrows from the section structure list point to "loadable segments," indicating that the segments corresponding to these sections can be loaded into memory. One of the loadable segments contains "static data and other data types," which, after being loaded into memory, are mapped to the corresponding data memory region. The right side includes the executable memory segment (r-xp) and the data memory segment (r--p). The executable memory segment contains executable content, such as the program's machine instructions. An arrow from this segment points to the "segment memory base address," indicating that this segment has a corresponding base address in memory. The diagram notes "memory page alignment required," meaning that when loading this segment into memory, it must be aligned according to memory page boundaries to improve memory access efficiency. The data memory segment contains data content, such as the initialization data of global variables and static variables in the program. An arrow from this segment points to the "segment memory base address," indicating that this segment has a corresponding base address in memory. The diagram also notes "memory page alignment required," indicating that memory page alignment is also performed when loading the data memory segment. The entire... Figure 5 This demonstrates how the various structures (file header, segments, and sections) of an ELF file are organized and mapped into memory during the process of moving from dynamic library storage to memory loading. The structure of segments and sections is described by a list of structures. Loadable segments contain the actual code and data content, which is mapped to the corresponding memory segments (executable memory segment and data memory segment) in memory according to their attributes (executable or data). Memory page alignment is performed during loading.

[0101] Step S14: Decrypt the element to be decrypted at the target memory location, and overwrite the decryption result to the target memory location to obtain the target dynamic library file to be called and executed.

[0102] like Figure 4As shown, step 5: After obtaining the target memory addresses of the code and data sections, the encrypted data is read and decrypted. Step 6: The decrypted data is written back to the memory address. It is important to ensure that the size of the data remains unchanged to avoid overwriting other data and causing program problems. Step 7: Decryption is complete. The decryption module exits at runtime, and the dynamic library can be called and executed normally.

[0103] In this way, after the system loads the redirected .so library, the code and data are decrypted in the Linux platform's memory. The entire process is executed in Linux memory, without being written to the dynamic library's file or stored on the file system. This eliminates the need to implement a loader or interact with the system to modify or replace related data, reducing the technical implementation difficulty and improving compatibility.

[0104] As can be seen, this application provides a dynamic library protection method, including: obtaining current operation control by calling the constructor of the dynamic library; after obtaining current operation control, using the constructor to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform; determining the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information, and using the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory; decrypting the element to be decrypted at the target memory location, and overwriting the decryption result to the target memory location to obtain the target dynamic library file for execution. As can be seen from the above technical solution, this invention implements the core function by calling the constructor of the dynamic library, without relying on the specific loading mechanism or specific functions of a particular operating system, without requiring the development and maintenance of complex external loaders, and without requiring extensive modifications and interactive operations to the underlying system data structure. Furthermore, the encrypted dynamic library file is decrypted only after being loaded into the embedded platform memory, and the decryption is performed at runtime based on the obtained memory layout information to accurately locate the location of the element to be decrypted. This ensures that dynamic library files are always encrypted in a static storage state, greatly increasing the difficulty for attackers to obtain the original code and data, and effectively protecting sensitive information in the dynamic library.

[0105] Reference Figure 6 As shown, the present invention also discloses a dynamic library protection device, comprising:

[0106] The control acquisition module 11 is used to acquire current operation control by calling the constructor of the dynamic library;

[0107] The layout information reading module 12 is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform using the constructor after obtaining the current operation control.

[0108] The location determination module 13 is used to determine the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information, and to use the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory.

[0109] The decryption module 14 is used to decrypt the element to be decrypted at the target memory location and write the decryption result to the target memory location to obtain the target dynamic library file to be called and executed.

[0110] As can be seen, this application provides a method to obtain current operational control by calling the constructor of a dynamic library; after obtaining current operational control, the constructor is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform; based on the memory layout information, the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory is determined, and the location information is used to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory; the element to be decrypted at the target memory location is decrypted, and the decryption result is overwritten to the target memory location to obtain the target dynamic library file for execution. As can be seen from the above technical solution, this invention achieves core functionality by calling the constructor of a dynamic library, without relying on the specific loading mechanism or specific functions of a particular operating system, without requiring the development and maintenance of complex external loaders, and without requiring extensive modifications and interactive operations to the underlying system data structures. Furthermore, the encrypted dynamic library file is only decrypted after being loaded into the embedded platform memory, and the decryption operation is performed at runtime based on the obtained memory layout information to accurately locate the location of the element to be decrypted. This ensures that dynamic library files are always encrypted in a static storage state, greatly increasing the difficulty for attackers to obtain the original code and data, and effectively protecting sensitive information in the dynamic library.

[0111] Furthermore, embodiments of this application also disclose an electronic device, Figure 7 This is a structural diagram of an electronic device according to an exemplary embodiment. Figure 7The content herein should not be construed as limiting the scope of this application. Specifically, the electronic device may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the dynamic library protection method disclosed in any of the foregoing embodiments. Furthermore, the electronic device in this embodiment may specifically be an electronic computer.

[0112] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0113] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0114] The operating system 221 is used to manage and control the various hardware devices on the electronic device and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the dynamic library protection method executed by the electronic device as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0115] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned dynamic library protection method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0116] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0117] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0118] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0119] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0120] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for protecting dynamic libraries, characterized in that, include: Gain control of the current operation by calling the constructor of the dynamic library; After gaining control of the current operation, the constructor is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform memory; wherein, the memory layout information is the memory layout information corresponding to the executable and readable permission area and the readable permission area. Based on the memory layout information, the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory is determined, and the location information is used to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory. The element to be decrypted at the target memory location is decrypted, and the decryption result is overwritten and written to the target memory location to obtain the target dynamic library file to be called and executed; Prior to obtaining current operational control by calling the constructor of the dynamic library, the process also includes: Obtain the file protection instruction for encryption protection, and read the corresponding target dynamic library file in the dynamic library based on the file protection instruction; The target dynamic library file is subjected to data structure analysis to determine the elements in the target dynamic library file that need to be encrypted and protected. The elements to be encrypted are then encrypted using a preset encryption algorithm to obtain the corresponding encryption result. The elements to be encrypted are the .text section and the .rodata section. The encryption result is written into the target dynamic library file to overwrite the element to be encrypted in the target dynamic library file, thus obtaining the encrypted dynamic library file; The target data structure is a target section structure. Determining the location information of the target data structure of the encrypted dynamic library file in the embedded platform's memory based on the memory layout information includes: Read the file header structure of the encrypted dynamic library file from the executable memory region of the memory layout information; Based on the first address offset information recorded in the file header structure and the format information of the encrypted dynamic library file, the location segment structure list is positioned in the first position information of the encrypted dynamic library file. Based on the second address offset information recorded in the file header structure and the format information of the encrypted dynamic library file, locate the second position information of the section structure list in the encrypted dynamic library file; Obtain the file offset addresses of any two loadable segments from the segment structure list, and perform memory page operations based on the file offset addresses to obtain the base memory address; The section memory address of the target section structure in the embedded platform memory is calculated based on the memory base address, the first location information, and the second location information.

2. The dynamic library protection method according to claim 1, characterized in that, After obtaining the encrypted dynamic library file, the process also includes: Determine the target location of the encrypted code section from the encrypted dynamic library file; Insert a constructor that represents the decryption function executed at runtime by the dynamic library after the target location; The positional changes of each file part in the encrypted dynamic library file caused by the insertion of the constructor are written to the file header structure, section structure list, and segment structure list.

3. The dynamic library protection method according to claim 1, characterized in that, The step of reading the corresponding target dynamic library file in the dynamic library based on the file protection instruction includes: Based on the file protection instruction, a file reading operation is performed on the dynamic library to read the target dynamic library file specified by the file protection instruction from the dynamic library, and the file reading log corresponding to the file reading operation is output. The file read log includes the path and size of the target dynamic library file, as well as the start and end times of the file read operation.

4. The dynamic library protection method according to claim 1, characterized in that, The step of performing data structure analysis on the target dynamic library file to determine the elements in the target dynamic library file that need to be encrypted includes: The target dynamic library file is parsed to obtain the file header structure; The list of section structures and the list of segment structures are determined based on the file header structure; Based on the position information in the list of section structures and the list of segment structures, determine the elements in the target dynamic library file that need to be encrypted.

5. The dynamic library protection method according to claim 4, characterized in that, The process of determining the section structure list and segment structure list based on the file header structure includes: Based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure, the corresponding section structure list and segment structure list are determined respectively. Accordingly, determining the elements in the target dynamic library file that need to be encrypted based on the position information in the section structure list and the segment structure list includes: Based on the string section number recorded in the file header structure, the corresponding target string is searched from the section structure list, and the target string is used as the element to be encrypted in the target dynamic library file that needs to be protected by encryption. The string section number is the sequence number of the string containing the section and function name.

6. The dynamic library protection method according to claim 5, characterized in that, The determination of the corresponding section structure list and segment structure list based on the first address offset information of the section table and the second address offset information of the segment table recorded in the file header structure includes: Based on the first address offset information of the section table recorded in the file header structure, locate the first starting position of the section table; Traverse each section structure from the first starting position to construct a list of section structures based on each section structure; each section structure includes the section name, section type, section offset in the dynamic library file, and section size; Based on the second address offset information of the segment table recorded in the file header structure, locate the second starting position of the segment table; Traverse each segment structure from the second starting position to construct the segment structure list based on each segment structure; the segment structure includes the starting address of the segment, the length of the segment, and the permissions of the segment.

7. The dynamic library protection method according to claim 5, characterized in that, The step of searching for the corresponding target string from the list of section structures based on the string section number recorded in the file header structure, and using the target string as the element to be encrypted in the target dynamic library file that needs to be protected by encryption, includes: Traverse the section structures in the list of located section structures, and search for the corresponding target string in the section structure based on the string section number recorded in the file header structure to determine the code section and data section in the target dynamic library file that need to be encrypted and protected.

8. A dynamic library protection device, characterized in that, include: The control acquisition module is used to acquire control of the current operation by calling the constructor of the dynamic library; The layout information reading module is used to read the memory layout information corresponding to the encrypted dynamic library file from the embedded platform memory using the constructor after obtaining the current operation control; wherein, the memory layout information is the memory layout information corresponding to the executable and readable permission area and the readable permission area. The location determination module is used to determine the location information of the target data structure of the encrypted dynamic library file in the embedded platform memory based on the memory layout information, and to use the location information to determine the target memory location of the element to be decrypted in the encrypted dynamic library file in the embedded platform memory. The decryption module is used to decrypt the element to be decrypted at the target memory location and write the decryption result to the target memory location to obtain the target dynamic library file to be called and executed. Before acquiring current operational control by calling the constructor of the dynamic library, the device is further configured to acquire file protection instructions for encryption protection, and read the corresponding target dynamic library file in the dynamic library based on the file protection instructions; perform data structure analysis on the target dynamic library file to determine the elements to be encrypted in the target dynamic library file that need to be encrypted, and encrypt the elements to be encrypted using a preset encryption algorithm to obtain the corresponding encryption result; the elements to be encrypted are .text sections and .rodata sections; write the encryption result into the target dynamic library file to overwrite the elements to be encrypted in the target dynamic library file, thereby obtaining the encrypted dynamic library file; The target data structure is a target section structure. The position determination module is specifically used to read the file header structure of the encrypted dynamic library file from the executable memory area of ​​the memory layout information; locate the segment structure list at the first position in the encrypted dynamic library file according to the first address offset information recorded in the file header structure and the format information of the encrypted dynamic library file; locate the section structure list at the second position in the encrypted dynamic library file according to the second address offset information recorded in the file header structure and the format information of the encrypted dynamic library file; obtain the file offset addresses of any two loadable segments from the segment structure list, and perform memory page operations based on the file offset addresses to obtain the base memory address; calculate the section memory address of the target section structure in the embedded platform memory based on the base memory address, the first position information, and the second position information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the dynamic library protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the dynamic library protection method as described in any one of claims 1 to 7.

Images