Firmware anti-divulging method and device, control equipment and storage medium

Abstract

The embodiment of the invention provides a firmware anti-leakage method and device, control equipment and a storage medium, and the method comprises the steps: encrypting a compilation file of a core code in a firmware code, and obtaining an encrypted compilation file of the core code; splicing the encrypted compiled file with a compiled file of a non-core code in the firmware code to obtain a spliced file; generating a scattered loading table of the spliced file based on a preset rule; encrypting the dispersed loading table to obtain an encrypted dispersed loading table; and splicing the encrypted dispersed loading table with the splicing file to obtain the encrypted firmware. According to the method and the device, the firmware code can be subjected to scattered fragmentation encryption according to requirements, the encryption mode is flexible, meanwhile, the security of the encrypted firmware is high through scattered fragmentation encryption, and the security problem that the firmware is easy to read out to be disassembled is solved.

Description

Technical Field

[0001] The present application relates to the field of data technology, and in particular to a firmware anti-leakage method, apparatus, control device and storage medium. Background Art

[0002] In order to ensure the security of the firmware, it is often necessary to encrypt the firmware, save it in the memory, and then decrypt the encrypted firmware when it is used. In the process of realizing the invention, the inventor found that there are at least the following problems in the prior art: the prior art generally uses a full encryption method to encrypt the firmware, but the fully encrypted firmware is downloaded to the Flash and still has the risk of being read out for disassembly. In addition, the fully encrypted firmware needs to encrypt all firmware codes, but cannot encrypt part of the code according to the needs, and the encryption method is not flexible enough.

[0003] Therefore, how to provide a firmware encryption method with high security and flexible encryption mode is a technical problem that technical personnel in this field currently need to solve. Summary of the invention

[0004] In view of this, the present application provides a firmware leakage prevention method, apparatus, control device and storage medium to solve the problems in the prior art that firmware encryption is insecure and the encryption method is inflexible.

[0005] In a first aspect, an embodiment of the present application provides a firmware anti-leakage method, the method comprising:

[0006] Encrypting the compiled file of the core code in the firmware code to obtain the encrypted compiled file of the core code;

[0007] Splicing the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file;

[0008] Generate a scatter loading table of the spliced ​​file based on a preset rule;

[0009] Encrypting the scatter loading table to obtain an encrypted scatter loading table;

[0010] The encrypted scatter-loading table is spliced ​​with the splicing file to obtain the encrypted firmware.

[0011] In a possible implementation, before encrypting the compiled file of the core code in the firmware code, the method further includes:

[0012] Acquire a firmware code, wherein the firmware code includes a core code and a non-core code;

[0013] The core code and the non-core code are compiled respectively to obtain a compiled file of the core code and a compiled file of the non-core code.

[0014] In a possible implementation, the step of splicing the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain the spliced ​​file includes:

[0015] Obtaining a directory file of the firmware code;

[0016] The encrypted compiled file is spliced ​​with the compiled file of the non-core code in the firmware code according to the directory file to obtain a spliced ​​file.

[0017] In a possible implementation, the generating the scatter-loading table of the spliced ​​file based on a preset rule includes:

[0018] Obtain the storage location, file size and loading location of the encrypted compiled file and the compiled file of the non-core code in the spliced ​​file;

[0019] A scatter loading table for the spliced ​​file is generated based on the storage location, file size and loading location according to preset rules.

[0020] In a possible implementation manner, the compiling the core code and the non-core code separately includes:

[0021] The core code and the non-core code are compiled respectively by means of multi-segment ROM compilation.

[0022] In a possible implementation, before respectively compiling the core code and the non-core code by means of multi-segment ROM compilation, the method further includes:

[0023] Modify the scatter-loading file according to the firmware code to obtain a ROM segment;

[0024] The ROM segment is segmented according to the size of each compiled file to obtain multiple ROM segments.

[0025] In a possible implementation, compiling the firmware code to obtain a compiled file of the core code and a compiled file of the non-core code includes:

[0026] Compiling the core code in the firmware code by using a relative address compilation tool to obtain a compilation file of the core code;

[0027] The non-core code in the firmware code is compiled by using a relative address compilation tool or an absolute address compilation tool to obtain a compilation file of the non-core code.

[0028] In a possible implementation, the method further includes:

[0029] Verifying the encrypted firmware through a trusted root;

[0030] When the verification is passed, decrypting the encrypted scatter-loading table;

[0031] The encrypted compiled file is decrypted according to the decrypted scatter-loading table, and the compiled file of the core code and the compiled file of the non-core code are loaded to corresponding loading positions.

[0032] In a possible implementation, the scatter loading table also includes a directory file of the firmware code;

[0033] The step of decrypting the encrypted compiled file according to the decrypted scatter-loading table, and loading the compiled file of the core code and the compiled file of the non-core code to corresponding loading locations, comprises:

[0034] The encrypted compiled file is decrypted according to the decrypted directory file in the scatter-loading table, and the compiled file of the core code and the compiled file of the non-core code are loaded to corresponding loading positions.

[0035] In a second aspect, an embodiment of the present application provides a firmware anti-leakage device, including:

[0036] A first encryption unit is used to encrypt a compiled file of a core code in the firmware code to obtain an encrypted compiled file of the core code;

[0037] A first splicing unit, configured to splice the encrypted compiled file with a compiled file of a non-core code in the firmware code to obtain a spliced ​​file;

[0038] A generating unit, used for generating a scatter loading table of the splicing file based on a preset rule;

[0039] A second encryption unit is used to encrypt the scatter loading table to obtain an encrypted scatter loading table;

[0040] The second splicing unit is used to splice the encrypted scatter loading table with the splicing file to obtain the encrypted firmware.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0042] processor;

[0043] Memory;

[0044] A computer program is stored in the memory, and when the computer program is executed, the processor executes any one of the methods described in the first aspect.

[0045] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any method described in the first aspect.

[0046] Compared with the prior art, the present application encrypts the compiled file of the core code in the firmware code to obtain the encrypted compiled file of the core code; splices the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file; generates a scattered loading table of the spliced ​​file based on preset rules; encrypts the scattered loading table to obtain an encrypted scattered loading table; splices the encrypted scattered loading table with the spliced ​​file to obtain an encrypted firmware. The present application can encrypt only the core code of the firmware code according to the demand, that is, the firmware code is encrypted in a scattered and fragmented manner, and the encryption method is flexible. At the same time, the scattered and fragmented encryption makes the encrypted firmware highly secure, and solves the security problem that the firmware is easily read out for disassembly. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A flowchart of a firmware anti-leakage method provided in an embodiment of the present application;

[0049] Figure 2 A schematic diagram of an encrypted firmware structure provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of a process for decrypting firmware provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the structure of a firmware anti-leakage device provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to better understand the technical solution of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0054] It should be clear that the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0055] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0056] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0057] In order to ensure the security of the firmware, it is often necessary to encrypt the firmware, save it in the memory, and then decrypt the encrypted firmware when it is used. In the prior art, the firmware is generally encrypted in a full encryption manner. However, the following problems may occur after the firmware is fully encrypted:

[0058] After the fully encrypted firmware is downloaded to Flash, there is still a risk of being read out and disassembled. In addition, the fully encrypted firmware needs to encrypt all codes, rather than encrypting part of the code according to needs, and the encryption method is not flexible enough.

[0059] In response to the above problems, the embodiments of the present application provide a firmware leakage prevention method, apparatus, control device and storage medium. The embodiments of the present application can encrypt only the core code in the firmware code according to needs, that is, the firmware code is encrypted in a dispersed and fragmented manner. The encryption method is flexible. At the same time, the dispersed and fragmented encryption can make the encrypted firmware highly secure, solving the security problem that the firmware can be easily read out for disassembly.

[0060] The following is a detailed description in conjunction with the specific implementation method.

[0061] See also Figure 1 , is a flowchart of a firmware anti-leakage method provided by an embodiment of the present application. The method can be applied to various occasions where firmware encryption is required, such as Figure 1 As shown, the method includes:

[0062] S101: Encrypting a compiled file of a core code in a firmware code to obtain an encrypted compiled file of the core code;

[0063] Firmware is software that performs the most basic and lowest-level work of a system, and generally includes core code and non-core code, wherein core code refers to code used for system startup, and the confidentiality requirements of the code are relatively high, and non-core code refers to other supporting code such as interfaces, and the confidentiality requirements of the code are relatively low. Therefore, in order to ensure the speed of encryption and decryption and reduce the memory occupied by the encryption and decryption process, after obtaining the firmware code, the embodiment of the present application can only encrypt the code with relatively high confidentiality requirements, that is, the core code, and the code with relatively low confidentiality requirements, that is, the non-core code, is not encrypted. Specifically, after obtaining the firmware code, the firmware code can be selected according to the confidentiality of the code, and the selected core code can be marked, and then the compilation tool can be started to compile the core code and the non-core code to obtain the compiled file of the core code and the compiled file of the non-core code.

[0064] In the specific implementation, the compilation tool will identify the core code according to the tag before compilation, and compile the core code and non-core code separately. For example, the core code can be compiled into one or more binary (bin) files, and the file name is named with the _SECURITY suffix, and the non-core code can be compiled into one or more other bin files, and the file name is named with other suffixes, thereby obtaining the compiled files of the core code and the compiled files of the non-core code.

[0065] After the compilation is completed, the compiled files of the core code can be identified according to the file name suffix, such as identifying all bin files with the _SECURITY suffix, and the compiled files of the core code are encrypted using an encryption tool to obtain an encrypted compiled file of the core code. Specifically, the encryption tool can use a symmetric encryption algorithm, such as the AES (Advanced Encryption Standard) encryption algorithm, and an asymmetric encryption algorithm, such as the RSA encryption algorithm, to encrypt the compiled files of the core code, and the embodiment of the present application does not make specific requirements for this.

[0066] In a possible implementation, the compilation tool can compile the core code and non-core code separately through multi-segment ROM compilation, where ROM refers to read-only memory (Read-Only Memory), and multi-segment ROM means dividing the ROM into multiple segments, each ROM segment is used to store a firmware code and is compiled into a bin file.

[0067] In a possible implementation, in order to ensure that each segment of the firmware code can be stored in the corresponding ROM segment, the scatter loading file (sct file) can be modified according to the firmware code, the required ROM segment can be added, and the ROM segment can be segmented according to the size of each compiled file to obtain a multi-segment ROM, wherein the ROM segment used to store the core code can be named with the _SECURITY suffix. After obtaining the multi-segment ROM, the corresponding firmware code can be placed, such as placing the core code responsible for system startup into the _SECURITY segment. It should be noted that in each ROM segment of the embodiment of the present application, firmware code that can be placed independently is stored.

[0068] In a possible manner, the compilation tool may adopt a Keil compilation system, that is, Keil compilation is performed on the core code and the non-core code to obtain corresponding compilation files.

[0069] S102: splicing the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file;

[0070] In an embodiment of the present application, after obtaining the encrypted compiled file of the core code, it is necessary to splice the encrypted compiled file of the core code with the compiled file of the non-core code to obtain a spliced ​​file. Specifically, the directory file CRC (Cyclic Redundancy Check) of the firmware code can be obtained, and the encrypted compiled file and the compiled file of the non-core code in the firmware code are spliced ​​according to the directory file of the firmware code to obtain a spliced ​​file, wherein the directory file of the firmware code includes the splicing requirements of the encrypted compiled file of the core code and the compiled file of the non-core code. Exemplarily, the encrypted compiled file of the core code and the compiled file of the non-core code can be spliced ​​in the order of the bin file, such as Figure 2 shown.

[0071] S103: Generate a scatter loading table for splicing files based on preset rules;

[0072] In the embodiment of the present application, after the spliced ​​file is obtained, a scatter loading table needs to be spliced ​​on the spliced ​​file to record the information of each bin file in the spliced ​​file for subsequent firmware operation. Specifically, after the spliced ​​file is obtained, a scatter loading table of the spliced ​​file can be generated based on a preset rule.

[0073] In a possible implementation, the information of each bin file may include the storage location, file size and loading location of each bin file, wherein the storage location refers to the location in the firmware, and the loading location refers to the decrypted running address. Therefore, after obtaining the spliced ​​file, the storage location, file size and loading location of the encrypted compiled file of the core code and the compiled file of the non-core code in the spliced ​​file can be obtained first, and then a scattered loading table of the spliced ​​file can be generated based on preset rules and the obtained storage location, file size and loading location of each bin file.

[0074] In a possible implementation, in order to further ensure the security of the firmware code and to facilitate the replacement of the core code in the firmware code, the loading position of the encrypted compiled file of the core code can be a relative address, that is, when compiling the core code, a relative address compilation tool can be used to dynamically change the loading position of the encrypted compiled file. Specifically, the core code area can be identified through the defined multi-segment ROM before compilation, and relative address compilation can be performed on the core code area, that is, the loading position is randomly assigned to the core code area. After the compilation is completed, the compiled file of the core code is encrypted and spliced, and then a scattered loading table of the spliced ​​file is generated based on the random address information generated during the compilation process and based on the preset rules.

[0075] It should be noted that in this process, for the non-core code in the firmware code, you can use a relative address compilation tool to compile and obtain the corresponding compilation file, or you can use an absolute address compilation tool to compile and obtain the corresponding compilation file. The embodiment of the present application does not make specific requirements for this.

[0076] S104: Encrypt the scatter-loading table to obtain an encrypted scatter-loading table;

[0077] In the embodiment of the present application, in order to further ensure the security of the firmware code, the obtained scatter loading table can be encrypted to obtain an encrypted scatter loading table. In the specific implementation, a symmetric encryption algorithm, such as AES (Advanced Encryption Standard) encryption algorithm, and an asymmetric encryption algorithm, such as RSA encryption algorithm, can be used to encrypt the compiled file of the core code, and the embodiment of the present application does not make specific requirements for this.

[0078] S105: splicing the encrypted scatter-loading table with the splicing file to obtain the encrypted firmware.

[0079] In the embodiment of the present application, the encrypted scatter loading table can be spliced ​​at the end of the spliced ​​file to obtain the encrypted firmware, which can be directly used for flashing, such as Figure 2As shown. The encrypted scatter loading table includes multiple sub-areas, sub-area 1, sub-area 2, ..., sub-area n, each sub-area corresponds to a bin file of a firmware, that is, each sub-area records the storage location, file size and loading location of a bin file, and the scatter loading table also includes a directory file of the firmware code, which can be used to guide the operation and loading of each bin file (detailed introduction below).

[0080] The embodiment of the present application can encrypt the specified code according to the demand, thereby improving the flexibility of encryption. At the same time, only part of the code is encrypted, thereby reducing the encryption time.

[0081] The embodiment of the present application is also compatible with absolute address and relative address compilation tools, further ensuring the security of the firmware code.

[0082] In addition, the embodiment of the present application can also flexibly adjust the ROM segments and set the corresponding scatter loading table according to the number and size of the bin files, so that the content space can be used more effectively.

[0083] In the embodiment of the present application, the firmware leakage prevention method not only encrypts the firmware in a distributed manner to generate distributed encrypted firmware, that is, the above-mentioned S101-S105, but also includes decrypting the distributed encrypted firmware and then running the firmware.

[0084] See also Figure 3 , is a flowchart of a firmware decryption operation provided by an embodiment of the present application. Figure 3 As shown, the process specifically includes the following steps:

[0085] S301: Trusted boot;

[0086] In an embodiment of the present application, the distributed encrypted firmware can be packaged and burned / flashed into the memory, and the distributed encrypted firmware after burning / flashing can only be started through a trusted root, that is, when the distributed encrypted firmware needs to be decrypted, a trusted startup is performed.

[0087] S302: Verify the encrypted firmware through a trusted root;

[0088] After trusted boot, the encrypted firmware must first be verified through the trusted root.

[0089] S303: When the verification passes, decrypt the encrypted scatter-loading table;

[0090] When the data verification passes, the trusted root can decrypt the encrypted scatter-loading table to obtain the decrypted scatter-loading table. When the data verification fails, the process proceeds to S306.

[0091] S304: decrypting the encrypted compiled file according to the decrypted scatter-loading table, and loading the compiled file of the core code and the compiled file of the non-core code to the corresponding loading positions;

[0092] The trusted root can process the spliced ​​files according to the decrypted scatter loading table, such as decrypting the encrypted compiled files, loading the compiled files of the core code to the corresponding loading positions, and loading the compiled files of the non-core code to the corresponding loading positions. Specifically, since the decrypted scatter loading table includes a directory file, and the directory file includes the splicing requirements of the encrypted compiled files of the core code and the compiled files of the non-core code, the trusted root can confirm the encrypted compiled files according to the directory file in the decrypted scatter loading table, decrypt the encrypted compiled files one by one, and load the compiled files of the core code and the compiled files of the non-core code to the corresponding loading positions.

[0093] S305: Jump to run;

[0094] After completing the loading of the compiled files of the core code and the compiled files of the non-core code in the splicing file, the trusted root can jump to the loading location to run the firmware.

[0095] S306: Refuse to execute.

[0096] When the data verification fails, the trusted root directly refuses to perform decryption and loading operations.

[0097] It should be noted that for the decentralized encrypted firmware of the embodiment of the present application, if there is no supporting trusted root for decryption and loading, directly jumping to the firmware operation will not be able to execute, and for the supporting trusted root, since the trusted root has been protected by RDP, even if the firmware is read out, it cannot be used directly. That is, the core code of the embodiment of the present application is stored in an encrypted form, and decentralized decryption requires a trusted root, which can prevent the disassembly of the code and ensure the controllability of the firmware execution environment, thereby realizing a safe and controllable firmware management. And since the embodiment of the present application does not need to rely on the flashing tool to perform decryption, the firmware flashing can be performed by any flashing method, ensuring high compatibility (compatible with the customer flashing protocol), which is more optimized for embedded products.

[0098] In general, compared with the prior art, the embodiments of the present application have the following technical effects: only the core code in the firmware code can be encrypted according to needs, that is, the firmware code is encrypted in a dispersed and fragmented manner, and the encryption method is flexible. At the same time, the dispersed and fragmented encryption makes the encrypted firmware highly secure, solving the security problem that the firmware can be easily read out for disassembly.

[0099] Corresponding to the above embodiment, the embodiment of the present application also provides a firmware anti-leakage device.

[0100] See also Figure 4 , is a schematic diagram of the structure of a firmware anti-leakage device provided in an embodiment of the present application. Figure 4 As shown, the device 400 includes: a first encryption unit 401, used to encrypt the compiled file of the core code in the firmware code to obtain the encrypted compiled file of the core code; a first splicing unit 402, used to splice the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file; a generation unit 403, used to generate a scattered loading table of the spliced ​​file based on a preset rule; a second encryption unit 404, used to encrypt the scattered loading table to obtain an encrypted scattered loading table; a second splicing unit 405, used to splice the encrypted scattered loading table with the splicing file to obtain the encrypted firmware.

[0101] The specific contents of the embodiments of the present application can be found in the description of the above method embodiments, which will not be repeated here for the sake of brevity.

[0102] Corresponding to the above embodiments, the present application also provides an electronic device.

[0103] See also Figure 5 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, and the electronic device 500 may include: a processor 510, a memory 520, and a communication unit 530. These components communicate through one or more buses. Those skilled in the art can understand that the structure of the electronic device shown in the figure does not constitute a limitation on the embodiment of the present application. It can be a bus structure or a star structure, and can also include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0104] The communication unit 530 is used to establish a communication channel so that the electronic device can communicate with other devices, receive user data sent by other devices or send user data to other devices.

[0105] The processor 510 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It runs or executes software programs, instructions, and / or modules stored in the memory 520, and calls data stored in the memory to perform various functions of the electronic device and / or process data. The processor can be composed of an integrated circuit (IC), for example, it can be composed of a single packaged IC, or it can be composed of a plurality of packaged ICs with the same or different functions. For example, the processor 510 can include only a central processing unit (CPU). In the embodiment of the present application, the CPU can be a single computing core or multiple computing cores.

[0106] The memory 520 is used to store the execution instructions of the processor 510. The memory 520 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0107] When the execution instructions in the memory 520 are executed by the processor 510, the electronic device 500 can execute Figure 1 and Figure 3 Some or all of the steps in the illustrated embodiments.

[0108] Corresponding to the above embodiment, the embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium may store a program, wherein when the program is running, the device where the computer-readable storage medium is located may be controlled to execute some or all of the steps in the above method embodiment. In a specific implementation, the computer-readable storage medium may be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0109] Corresponding to the above-mentioned embodiment, the embodiment of the present application further provides a computer program product, which includes executable instructions. When the executable instructions are executed on a computer, the computer executes some or all of the steps in the above-mentioned method embodiment.

[0110] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0111] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0114] The above is only a specific implementation of the present application. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. The protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A firmware anti-leakage method, characterized in that: The method comprises: Encrypting the compiled file of the core code in the firmware code to obtain the encrypted compiled file of the core code; Splicing the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file; Generate a scatter loading table of the spliced ​​file based on a preset rule; Encrypting the scatter loading table to obtain an encrypted scatter loading table; The encrypted scatter-loading table is spliced ​​with the splicing file to obtain the encrypted firmware.

2. The method according to claim 1, characterized in that Before encrypting the compiled file of the core code in the firmware code, the method further includes: Acquire a firmware code, wherein the firmware code includes a core code and a non-core code; The core code and the non-core code are compiled respectively to obtain a compiled file of the core code and a compiled file of the non-core code.

3. The method according to claim 1, characterized in that The step of splicing the encrypted compiled file with the compiled file of the non-core code in the firmware code to obtain a spliced ​​file includes: Obtaining a directory file of the firmware code; The encrypted compiled file is spliced ​​with the compiled file of the non-core code in the firmware code according to the directory file to obtain a spliced ​​file.

4. The method according to claim 1, characterized in that: The generating the scatter loading table of the spliced ​​file based on the preset rule comprises: Obtain the storage location, file size and loading location of the encrypted compiled file and the compiled file of the non-core code in the spliced ​​file; A scatter loading table for the spliced ​​file is generated based on the storage location, file size and loading location according to preset rules.

5. The method according to claim 2, characterized in that: The compiling the core code and the non-core code respectively includes: The core code and the non-core code are compiled respectively by means of multi-segment ROM compilation.

6. The method according to claim 5, characterized in that Before respectively compiling the core code and the non-core code by means of multi-segment ROM compilation, the method further comprises: Modify the scatter-loading file according to the firmware code to obtain a ROM segment; The ROM segment is segmented according to the size of each compiled file to obtain multiple ROM segments.

7. The method according to claim 1, characterized in that The step of compiling the firmware code to obtain a compiled file of the core code and a compiled file of the non-core code includes: Compiling the core code in the firmware code by using a relative address compilation tool to obtain a compilation file of the core code; The non-core code in the firmware code is compiled by using a relative address compilation tool or an absolute address compilation tool to obtain a compilation file of the non-core code.

8. The method according to claim 1, characterized in that The method further comprises: Verifying the encrypted firmware through a trusted root; When the verification is passed, decrypting the encrypted scatter-loading table; The encrypted compiled file is decrypted according to the decrypted scatter-loading table, and the compiled file of the core code and the compiled file of the non-core code are loaded to corresponding loading positions.

9. The method according to claim 8, characterized in that The scatter loading table also includes a directory file of the firmware code; The step of decrypting the encrypted compiled file according to the decrypted scatter-loading table, and loading the compiled file of the core code and the compiled file of the non-core code to corresponding loading locations, comprises: The encrypted compiled file is decrypted according to the decrypted directory file in the scatter-loading table, and the compiled file of the core code and the compiled file of the non-core code are loaded to corresponding loading positions.

10. A firmware anti-leakage device, characterized in that: include: A first encryption unit is used to encrypt the compiled file of the core code in the firmware code to obtain the encrypted compiled file of the core code; A first splicing unit, configured to splice the encrypted compiled file with a compiled file of a non-core code in the firmware code to obtain a spliced ​​file; A generating unit, configured to generate a scatter loading table of the spliced ​​file based on a preset rule; A second encryption unit is used to encrypt the scatter loading table to obtain an encrypted scatter loading table; The second splicing unit is used to splice the encrypted scatter loading table with the splicing file to obtain the encrypted firmware.

11. An electronic device, characterized in that: include: processor; Memory; A computer program is stored in the memory, and when the computer program is executed, the processor executes the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 9.

Images