Confusion encryption protection method and device for executable file

Abstract

The invention discloses a confusion encryption protection method and device for an executable file. The method comprises the following steps: confusing an executable program file, carrying out self-defined key and algorithm encryption on the confused file, carrying out key verification and algorithm decryption on the confused and encrypted executable file, and de-confusing a decrypted result file. The device comprises a file selection module, an executable file confusion encryption module, an executable file decryption and de-confusion module, a user-defined key module, an execution module and a result file output module. Compared with the prior art, the compiled executable file is subjected to confusion encryption processing and de-confusion decryption processing, confusion and encryption double guarantees are provided for the executable file, and multiple safety guarantees of the executable file are achieved.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular to an obfuscation encryption protection method and device for executable files. Background Art

[0002] With the development of information technology, code programs are facing increasing threats and challenges, among which reverse engineering analysis poses a major threat to program security. In order to cope with this challenge, code file obfuscation encryption and other methods are usually used to enhance program security.

[0003] File obfuscation encryption is usually achieved by modifying the program code itself. It usually performs operations such as renaming variables, deleting useless code, adding useless code, modifying control flow, etc., and performing obfuscated encryption processing on the data, such as encryption, encoding, and scrambling the order, so as to make the program code difficult to be decompiled and parsed.

[0004] However, the current file obfuscation mainly processes the program source code itself, and the security level depends largely on the complexity of the obfuscation of the source code itself. The obfuscation and encryption of the compiled program is rarely considered. In addition, the processing of the free space in the executable program code (hereinafter referred to as "code hole") is also extremely rare, which gives malicious code an opportunity to take advantage of it, and also faces the threat of reverse analysis of the program. Therefore, how to achieve obfuscation and encryption protection of executable programs is particularly important, which is of great significance for protecting software intellectual property rights and improving software security. Summary of the invention

[0005] The present invention proposes an obfuscation encryption protection method and device for executable files, which performs obfuscation encryption processing on compiled executable files. The invention scans, acquires, merges and processes scattered free spaces in the program (hereinafter referred to as "code holes"), overcomes the limitation of only processing adjacent code segments in the traditional method, and can also solve the problem that obfuscation encryption protection cannot be achieved when the code holes are too small. At the same time, the customized key and key encryption and verification method are combined with the symmetric encryption algorithm to increase the difficulty and security of reverse analysis of the code.

[0006] The technical solution to achieve the purpose of the present invention is: an obfuscation encryption protection method for executable files performs obfuscation encryption processing on the compiled executable files for deobfuscation and decryption processing, specifically including: obfuscating the executable program file; encrypting the obfuscated file with a custom key and algorithm; performing key verification and algorithm decryption on the obfuscated encrypted executable file; and deobfuscating the decrypted result file.

[0007] Furthermore, the method for obfuscating an executable program file in the present invention is mainly applied to a compiled executable program. After obtaining the executable program, it is scanned and parsed, and the positional relationship between each code segment and the size of each code segment are obtained by analyzing the section table information therein, and then the position and size of the code hole therebetween are obtained through code static analysis; after recording the position, size and mutual relationship of all code segments and code holes and other information, the code holes are merged, and all recorded information (hereinafter referred to as "effective obfuscation information") is stored in the merged code holes; at this time, it is necessary to judge the size of the merged code hole to judge whether the code hole space needs to be expanded or invalid obfuscation information is randomly generated, and finally the newly generated executable file is reconstructed and redirected, and a boot information file is generated, and a result file is output.

[0008] Furthermore, the method for deobfuscating the decrypted result file is mainly applied to the obfuscated executable file. After obtaining the obfuscated executable program, it is scanned and parsed to obtain the program boot information, and the code hole position, size and obfuscation information are obtained from the boot information. The effective obfuscation information is extracted according to the obtained obfuscation information to obtain the initial position, size and mutual relationship of each program segment and code hole. After processing whether the code hole is expanded and whether there is invalid obfuscated code, the executable file is reconstructed and redirected to output the result file.

[0009] Furthermore, the method of encrypting the obfuscated file with a custom key and algorithm is to implement the encryption function of the executable program mainly through key customization and current time, combined with a symmetric encryption algorithm. Among them, the key encryption is in the file encryption stage, according to the received user-defined key input, combined with the current system time millisecond value and converted into hexadecimal, and reorganized according to the custom bit operation function; the symmetric encryption algorithm adopts the mature AES (Advanced Encryption Standard) encryption algorithm.

[0010] Furthermore, the method for key verification and algorithm decryption of the obfuscated encrypted executable file is mainly to realize the decryption function of the encrypted file by restoring and verifying the key and time, combined with the symmetric decryption algorithm. Among them, the key verification is in the file decryption stage. After the decryption module receives the encrypted key, it restores it according to the custom bit operation function to obtain the time value and custom key therein; by verifying the custom key, the correctness of the key is judged; then, after the time value is restored by base conversion, it is judged whether the difference between the time value and the current time of the system meets the set time difference threshold range. If it meets, the key validity verification is successful, otherwise, the key validity verification fails; and the symmetric decryption algorithm adopts the mature AES decryption algorithm.

[0011] The executable file obfuscation encryption device mainly includes a file selection module, an executable file obfuscation encryption module, an executable file decryption and deobfuscation module, a custom key module, and an execution and result file output module.

[0012] Compared with the prior art, the present invention has the following significant advantages:

[0013] (1) The present invention obfuscates the executable program file and merges the scattered code holes in the executable program, thus overcoming the limitation of only processing adjacent code segments in the traditional method. At the same time, valid and invalid obfuscated codes can be mixed and inserted according to the actual situation, thereby increasing the difficulty of reverse analysis of the program.

[0014] (2) The present invention uses a custom key and algorithm to encrypt the executable file after obfuscation encryption, and can reorganize the custom key and the current time value after hexadecimal conversion through a custom bit operation function, thereby enhancing the multiple complexity of the key and improving the security of the file;

[0015] (3) The present invention performs key verification and algorithm decryption on the obfuscated and encrypted executable file, and can restore and extract the time and the custom key through a custom bit operation function, and verify the custom key and time respectively, thereby achieving dual verification of the correctness and validity of the key;

[0016] (4) The device disclosed in the present invention provides multiple functions of executable file obfuscation, deobfuscation, key and algorithm encryption, key verification and algorithm decryption, thereby realizing multiple security protections for executable files.

[0017] (5) The present invention combines obfuscation and encryption for compiled executable files, thereby increasing the difficulty of illegal acquisition and cracking of executable programs and improving their security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a workflow diagram of the executable file obfuscation encryption protection method.

[0019] Figure 2 It is a diagram of the composition of the executable file obfuscation encryption device.

[0020] Figure 3 This is a workflow diagram of the executable file obfuscation method.

[0021] Figure 4 It is a workflow diagram of the custom key and algorithm encryption method.

[0022] Figure 5 It is a workflow diagram of key verification and algorithm decryption method.

[0023] Figure 6This is a workflow diagram of the executable file deobfuscation method. DETAILED DESCRIPTION

[0024] The following is combined with Figure 1-6 The present invention is further described in the following specific examples. If no specific techniques or conditions are specified in the examples, the techniques or conditions described in the literature in the art or in the product manual shall be followed.

[0025] The invention discloses an obfuscation encryption protection method for executable files, which performs obfuscation encryption processing and deobfuscation and decryption on compiled executable files, thereby providing obfuscation and encryption dual protection for the executable files.

[0026] like Figure 1 As shown, a method for obfuscating and encrypting executable files is provided, and the specific steps are as follows:

[0027] Step 1: The specific steps of using the executable file obfuscation method to obfuscate the executable program file are as follows:

[0028] S1.1: combining the executable file obfuscation encryption device to obtain the executable file selected by the user;

[0029] S1.2: Scan, analyze and parse the obtained executable file, analyze the information of each section table in the program and perform static analysis on the code;

[0030] S1.3: Based on the analysis results of step 1.2, obtain and record the starting position, segment size, and jump relationship between segments of each program segment; at the same time, based on the information of each code segment, obtain and record the position and size of each code hole;

[0031] S1.4: Merge the code holes obtained by traversing the code;

[0032] S1.5: Determine whether the merged code hole can accommodate all the valid obfuscation information in step 1.3, that is, the valid obfuscation information;

[0033] If the merged code hole cannot accommodate valid obfuscation information, a new space is created to store all valid obfuscation information, and then the next step is entered; if the merged code hole can accommodate valid obfuscation information, the next step is entered directly;

[0034] S1.6: Insert obfuscation information into the merged code hole;

[0035] S1.7: Determine whether there is still free space in the code hole after the effective obfuscation information is inserted into the code hole;

[0036] If there is free space, randomly generate invalid obfuscation information and insert it into the code hole until the code hole is filled, and then proceed to the next step; if there is no free space, directly proceed to the next step;

[0037] S1.8: Recompile the file, reconstruct the redirection, and generate the executable file startup boot information.

[0038] S1.9: Output the obfuscated result file.

[0039] Step 2: Encrypt the obfuscated file using a custom key and algorithm;

[0040] S2.1: Combined with the executable file obfuscation encryption device, obtain the custom key input by the user;

[0041] S2.2: Get the millisecond value of the current time and convert it into hexadecimal format;

[0042] S2.3: According to the custom bit operation function, the custom key and the time value after the base conversion are converted and reorganized; the bit operation in the custom bit operation function refers to shifting the value left or right by a certain amount.

[0043] S2.4: Combine the traditional AES symmetric encryption algorithm to encrypt executable files;

[0044] S2.5: Output the result file to obtain the obfuscated and encrypted executable file.

[0045] Step 3, perform key verification and algorithm decryption on the obfuscated and encrypted executable file;

[0046] S3.1: Combined with the executable file obfuscation encryption device, obtain the comprehensive key after the custom key and the current time value are converted into hexadecimal;

[0047] S3.2: Restore the key according to the custom algorithm function;

[0048] S3.3: Extract the time value and custom key according to the set format;

[0049] S3.4 determines whether the custom key verification is correct;

[0050] If it is incorrect, the key verification fails and the program ends;

[0051] If the custom key is verified correctly, the time value is converted to the standard format;

[0052] S3.5: Analyze the time difference with the current time to determine whether it meets the set time difference threshold range;

[0053] If not, the key is considered invalid, key verification fails, and the program ends;

[0054] If satisfied, decrypted using AES symmetric encryption algorithm;

[0055] S3.6: Output the decrypted result file (i.e. the obfuscated executable file in step 1).

[0056] Step 4, deobfuscate the decrypted result file;

[0057] S4.1: In combination with the executable file obfuscation encryption device, obtain the obfuscated executable file selected by the user;

[0058] S4.2: Scan and analyze the obtained obfuscated executable file, perform static analysis, and identify program running boot information;

[0059] S4.3: Obtain code hole location, size and obfuscation information based on program guidance information;

[0060] S4.4: Determine whether there is invalid obfuscation information based on the obfuscation information in the code hole. If yes, remove the invalid obfuscation information; if no, proceed to the next step;

[0061] S4.5: Restore the location, size, and jump relationship of each original program segment and original code hole based on the records in the effective obfuscation information;

[0062] S4.6: After the segment program and code hole are restored, determine whether a new space is opened during the executable file obfuscation stage. If yes, delete the newly opened space; if no, proceed to the next step;

[0063] S4.7: Compile file refactoring redirection;

[0064] S4.8: Output the deobfuscated result file (the original executable file).

[0065] like Figure 2 As shown, the executable file obfuscation encryption device mainly includes a file selection module, an executable file obfuscation encryption module, an executable file decryption and deobfuscation module, a custom key module, an execution and result file output module, etc., wherein:

[0066] The file selection module provides the function of selecting executable files, obfuscated executable files and obfuscated encrypted executable files. After the selection is completed, the device interface displays the selected file path and file name.

[0067] The executable file obfuscation encryption module provides obfuscation encryption functions for executable files, realizes the parsing and processing of executable files, obtains and records the information of code segments and code holes, and inserts the obfuscated information into the merged code holes; on the basis of obfuscating executable files, it combines custom key encryption and AES symmetric encryption algorithm to realize its encryption function.

[0068] The executable file decryption and deobfuscation module provides the function of decrypting and deobfuscating the executable files after obfuscation and encryption. Among them, the key verification realizes the double verification of the correctness and validity of the key, and combines the AES decryption algorithm to realize the decryption function of the executable files after obfuscation and encryption; through the scanning, analysis and processing of the decrypted obfuscated executable files, the effective obfuscation information is obtained, and a series of information about the mid-program and code holes in the executable files is restored, so as to realize the deobfuscation function of the executable files.

[0069] The custom key module provides a custom key input function, that is, it is used to receive the custom key output by the user during the encryption and decryption stages.

[0070] The execution module provides trigger functions for executable file obfuscation encryption and executable file decryption and deobfuscation.

[0071] The result file output module provides the result file output address selection function. After the selection is completed, the device interface displays the output file path and output file name.

[0072] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principles and intent of the present invention.

Claims

1. A method for obfuscating and encrypting executable files, characterized in that: The compiled executable file is encrypted and obfuscated to decrypt it, including: Obfuscate executable program files; Encrypt the obfuscated files using custom keys and algorithms; Perform key verification and algorithm decryption on the obfuscated and encrypted executable files; Deobfuscate the decrypted result file.

2. The obfuscation encryption protection method for executable files according to claim 1, characterized in that: The method to confuse executable program files is: (1) Obtain the executable file selected by the user; (2) Scan, analyze and parse the obtained executable file, analyze the section table information in the program and perform static analysis on the code process; (3) Based on the results of the analysis in the previous step, obtain and record the starting position, segment size, and jump relationship information between segments of each degree segment; at the same time, based on the information of each code segment, obtain and record the position and size information of each code hole; (4) Merge the code holes obtained by traversing the code; (5) Determine whether the merged code hole can accommodate all valid obfuscation information and effectively obfuscate the information; If the merged code hole cannot accommodate valid obfuscation information, a new space is created to store all valid obfuscation information, and then proceed to the next step; If the merged code hole can accommodate effective obfuscation information, go directly to the next step; (6) inserting obfuscation information into the merged code hole; (7) Determine whether there is still free space in the code hole after the effective obfuscation information is inserted into the code hole; If there is free space, randomly generate invalid obfuscation information and insert it into the code hole until the code hole is filled, and then proceed to the next step; if there is no free space, directly proceed to the next step; (8) Recompile the file to reconstruct the redirection and generate the executable file startup boot information; (9) Output the obfuscated result file.

3. The obfuscated encryption protection method for executable files according to claim 1, characterized in that: The method to encrypt the obfuscated file with a custom key and algorithm is as follows: (1) Obtain the custom key entered by the user; (2) Get the millisecond value of the current time and convert it into hexadecimal format; (3) converting and reorganizing the custom key and the time value after base conversion according to the custom bit operation function; (4) Combine the traditional AES symmetric encryption algorithm to encrypt executable files; (5) Output the result file to obtain the obfuscated and encrypted executable file.

4. The obfuscated encryption protection method for executable files according to claim 1, characterized in that: The method for key verification and algorithm decryption of the obfuscated and encrypted executable file is as follows: (1) Get the custom key and the current time value in hexadecimal format The converted comprehensive key is generated; (2) Restore the key based on the custom algorithm function; (3) Extract the time value and custom key according to the set format; (4) Determine whether the custom key verification is correct; if not, the key verification fails and the program ends; if the custom key verification is correct, the time value is converted to the standard format; (5) The difference between the parsed time and the current time is determined to determine whether the time difference meets the set time difference threshold range; If not, the key is considered invalid, key verification fails, and the program ends; If satisfied, decrypted using AES symmetric encryption algorithm; (6) Output the decrypted result file.

5. The obfuscated encryption protection method for executable files according to claim 1, characterized in that: The method to deobfuscate the decrypted result file is: (1) Obtain the decrypted result file selected by the user, i.e., the obfuscated executable file; (2) Scanning, analyzing, and statically analyzing the obtained obfuscated executable file to identify program running boot information; (3) Obtain the code hole location, size, and obfuscation information based on the program guidance information; (4) Determine whether there is invalid obfuscation information based on the obfuscation information in the code hole. If so, remove the invalid obfuscation information; If not, proceed to the next step; (5) Restore the location, size, and jump relationship of each original program segment and original code hole based on the records in the effective obfuscation information; (6) After the segment program and code hole are restored, determine whether new space is opened during the executable file obfuscation stage. If so, delete the newly opened space; If not, proceed to the next step; (7) Compile file refactoring redirection; (8) Output the deobfuscated result file.

6. An executable file obfuscation encryption device, comprising: A file selection module, used to provide the functions of selecting executable files, obfuscated executable files and obfuscated encrypted executable files; An executable file obfuscation encryption module is used to provide an obfuscation encryption function for executable files; The executable file decryption and deobfuscation module is used to provide the decryption and deobfuscation function of the obfuscated and encrypted executable file; A custom key module is used to provide a custom key input function; An execution module, used to provide triggering functions for executable file obfuscation encryption and executable file decryption and deobfuscation; The result file output module is used to provide the result file output address selection function.

Images