Anti-cracking method, electronic equipment, storage medium and program product

Abstract

The invention discloses an anti-cracking method, electronic equipment, a storage medium and a program product, and the method comprises the steps: obtaining a first byte sequence of a to-be-executed program, the to-be-executed program being executed by a target operating system, and the first byte sequence being byte information of a target position of the to-be-executed program; based on the first byte sequence and a target byte sequence, whether the program to be executed is a target program to be decrypted or not is determined, and the target program to be decrypted comprises an encrypted code segment. The program needing to be protected is recognized through byte sequence comparison, encryption and decryption are implemented in a targeted mode, operation on all the programs is avoided, system resource utilization is optimized, safety of key parts is guaranteed, and system performance and stability are maintained. Moreover, the operating system is in a call forbidding state during decryption, interference and attacks are prevented, decryption and mapping operations are performed by using the virtual memory, and the security and integrity of the decryption process are improved.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to an anti-cracking method, electronic equipment, storage medium and program product. Background Art

[0002] There are many network devices in the Internet environment, and their security and stability are critical to the overall network security. Network product manufacturers often release products in hardware or virtualized form and use customized operating systems and their own application software to meet demand. Linux is favored by manufacturers due to its many advantages. However, there are security risks in the form of files stored on disks. It is easy for opponents and malicious attackers to intrude and obtain programs and then reverse crack them, which makes manufacturers face the consequences of damaged commercial interests and reduced reputation. For manufacturers, it is important to protect the core code and principles of products from being plagiarized and cracked. The commonly used ELF format code segments have no encryption capabilities and are vulnerable to attacks. At present, there is an urgent need for effective ways to protect core applications and safeguard the rights and interests of manufacturers and the security and stability of the network ecosystem. Summary of the invention

[0003] The purpose of the embodiment of the present application is to provide an anti-cracking method, including:

[0004] Acquire a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target position of the program to be executed;

[0005] Based on the first byte sequence and the target byte sequence, determining whether the program to be executed is a target program to be decrypted, wherein the target program to be decrypted includes an encrypted code segment;

[0006] In the case where it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment;

[0007] The target operating system executes the decrypted target program to be decrypted.

[0008] As an optional embodiment, the method further includes:

[0009] Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

[0010] As an optional embodiment, the step of encrypting the code segment of the program to be executed by using an encryption tool includes:

[0011] Based on the acquired first byte sequence of the program to be executed, determining that the program to be executed is a program to be encrypted;

[0012] Determine a code segment based on the obtained section header table information of the program to be encrypted;

[0013] Based on the code segment, the location and range of encryption of the program to be encrypted are determined.

[0014] As an optional embodiment, determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence includes:

[0015] Comparing the first byte sequence obtained with the target byte sequence;

[0016] When it is determined that the comparison result is a match, the program to be executed is determined to be a target program to be decrypted.

[0017] As an optional embodiment, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including:

[0018] determining a first physical address of the code segment;

[0019] Mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address;

[0020] Based on the second physical address and the first physical address, the decrypted code segment is remapped to the first physical address.

[0021] As an optional embodiment, the method further includes:

[0022] When it is determined that the target operating system cracks the code segment, obtaining a call request to access the target operating system;

[0023] Based on the calling request, determining first feedback information of the judgment module;

[0024] Based on the first feedback information, access to the target operating system is prohibited.

[0025] As an optional embodiment, the method further includes:

[0026] Obtaining modification information of the judgment module;

[0027] Based on the change information, determining second feedback information of the judgment module;

[0028] Based on the second feedback information, access to the target operating system is permitted.

[0029] An embodiment of the present application aims to provide an electronic device, comprising: a memory and a processor, wherein an executable program is stored in the memory, and the processor executes the executable program to implement the steps of the aforementioned method.

[0030] An embodiment of the present application aims to provide a storage medium, wherein the storage medium carries one or more computer programs / instructions, and when the one or more computer programs / instructions are executed by a processor, the steps of the aforementioned method are implemented.

[0031] The purpose of the embodiments of the present application is to provide a computer program product, including a computer program / instruction, which implements the steps of the aforementioned method when executed by a processor.

[0032] The beneficial effects of the embodiments of the present application are:

[0033] This application identifies the programs to be protected by comparing byte sequences, implements encryption and decryption in a targeted manner, avoids operating all programs, optimizes system resource utilization, ensures the security of key parts, and maintains system performance and stability. In addition, the operating system is in a prohibited call state during decryption to prevent interference and attacks, and uses virtual memory for decryption and mapping operations to improve the security and integrity of the decryption process.

[0034] This application can protect the core code by encrypting the program code segment, preventing the core code from being easily obtained, and can accurately operate according to the encryption strategy and section header table information to avoid resource waste and excessive performance impact. At the same time, it provides a mechanism to remove access restrictions to ensure the manageability and availability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of the anti-cracking method according to an embodiment of the present application;

[0036] Figure 2 This is a flowchart of step S20 of the anti-cracking method of an embodiment of the present application;

[0037] Figure 3 This is a flowchart of step S30 of the anti-cracking method of an embodiment of the present application;

[0038] Figure 4 This is a flow chart of step S50 of the anti-cracking method according to an embodiment of the present application;

[0039] Figure 5 This is a flowchart of step S60 of the anti-cracking method of an embodiment of the present application;

[0040] Figure 6 A flowchart of encryption performed by the encryption tool according to an embodiment of the present application. DETAILED DESCRIPTION

[0041] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0042] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0043] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0044] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0045] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0046] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0047] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0048] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0049] An anti-cracking method according to an embodiment of the present application is as follows: Figure 1 As shown, including:

[0050] S10. Acquire a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target location of the program to be executed.

[0051] In this embodiment, the program to be executed is a program to be run on the target operating system. For example, in a Linux system, a network service program developed by a user may include various function codes and data, waiting for the operating system to schedule execution. For example, the program to be executed is an application program whose file format is ELF format.

[0052] The first byte sequence is the byte information of the program to be executed at the target location. For example, for an executable file, some bytes at the beginning may contain information such as the file type and program entry.

[0053] The target location is a specific location selected in the program, which may be a file header, a specific section or segment, etc., and is used to identify whether the program is a target program to be decrypted.

[0054] The target operating system is a Linux system, and the protected application program (ie, the program to be executed) is bundled with the kernel of the Linux system, so that the protected application program cannot run independently.

[0055] This bundling mechanism sets a higher threshold for program operation. Malicious attackers cannot easily separate the program from the kernel environment it depends on for attack or analysis, which significantly improves the security of the program.

[0056] For example, in server programs of critical business systems, the bundling of applications and kernels ensures that the programs must run in a specific kernel environment, preventing the programs from being illegally copied and run in other unsafe environments, and preventing the leakage and abuse of core functions.

[0057] S20. Determine whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence, wherein the target program to be decrypted includes an encrypted code segment.

[0058] In this embodiment, the target byte sequence is a preset byte sequence used for comparison with the first byte sequence to determine whether the program to be executed is a program that requires special processing (decryption).

[0059] The target programs to be decrypted refer to those programs to be executed that contain encrypted code segments, that is, programs that need to be decrypted.

[0060] The code segment is the part of the program that stores executable instructions, including the core logic and algorithms of the program. This part is encrypted to prevent reverse engineering.

[0061] S30. When it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment.

[0062] In this embodiment, the call-forbidden state is a state in which the operating system is in when performing a decryption operation. In this state, other programs or users are not allowed to call certain functions of the system to prevent the decryption process from being interfered with or attacked.

[0063] Here, assuming that the target operating system is a Linux system, the kernel of the Linux system is used to control whether the product can be debugged. On the one hand, this reduces the risk of the code segment of the protected program being leaked, and on the other hand, it increases the convenience for program development and debugging.

[0064] During normal use, limiting the debugging function can prevent malicious attackers from viewing and tampering with program code through debugging means, thereby ensuring the security of the program.

[0065] During the development phase, developers can flexibly adjust the state of the Linux system kernel as needed to facilitate program debugging, ensuring a smooth development process and improved program quality.

[0066] For example, when developing a complex image editing software, developers can adjust the Linux system kernel in the development environment to allow debugging. After release, the Linux system kernel restricts debugging to prevent program code from being stolen by users or malicious persons through debugging.

[0067] In addition, assuming that the target operating system is a Linux system, the Linux kernel image is used to save the key, and the code segment of the ELF format application is temporarily decrypted when the product runs the protected program. This mechanism greatly increases the difficulty of cracking.

[0068] Since the key is stored in the relatively secure Linux kernel image, it is difficult for attackers to obtain it easily, and it is only temporarily decrypted when the program is running, which greatly reduces the risk of password exposure and provides more reliable protection for the core code.

[0069] For example, in network security software or financial system software, the code segments where the core algorithms and business logic are located are encrypted when stored and static, and are only decrypted in a secure kernel environment at runtime, effectively preventing competitors and malicious attackers from obtaining key information by cracking the program.

[0070] S40: The target operating system executes the decrypted target program to be decrypted.

[0071] In this embodiment, the byte sequence of the program to be executed at the target location (the first byte sequence) is first obtained, and then compared with the target byte sequence to determine whether the program to be executed is a program that needs to be decrypted (the target program to be decrypted). If it is determined to be the target program to be decrypted, the target operating system will use the stored key to decrypt the code segment of the program, map the decrypted code segment back to the original program, and finally execute the decrypted program.

[0072] Specifically, when a program is ready to run on the target operating system, the system will obtain the first byte sequence of the program to be executed, which is located at the target location of the program. The system compares the first byte sequence with the preset target byte sequence. If the two match, it indicates that this program is the target program to be decrypted, and the system uses the stored key to decrypt the code segment of the program. The operating system remaps the decrypted code segment back to the corresponding location of the original program. Finally, the operating system executes the decrypted program.

[0073] For example, a network security software is a program to be executed, and its code segment is encrypted using an encryption tool during the development process and then stored on a disk.

[0074] When the user wants to start the software, the operating system will read a part of the program's byte sequence (such as the first few bytes of the program header) as the first byte sequence, and compare it with the stored target byte sequence. If they match, the operating system uses the stored key to decrypt the encrypted code segment, and then maps the decrypted code segment back to the program and executes it. During the decryption process, the operating system is in a prohibited call state to prevent interference from other programs.

[0075] Moreover, compared with existing obfuscation or encryption methods, this application does not change the code segment content of the protected program. After the program is started, the operating efficiency is the same as without encryption. This method avoids the performance loss that may be caused by traditional encryption or obfuscation methods, ensuring that the program will not affect the user experience and the overall performance of the system while providing high security.

[0076] For example, in real-time processing systems with high performance requirements, such as video processing software or data processing software, the program operation will not be stuck or delayed due to encryption, ensuring the smoothness and efficiency of the system.

[0077] This application protects the core code segment of the program, prevents unauthorized access and reverse engineering, and enhances the security of the program. It only decrypts specific programs (target programs to be decrypted), improves the operating efficiency of the system, and avoids the waste of resources of decrypting all programs.

[0078] In one embodiment, the method further comprises:

[0079] Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

[0080] In this embodiment, the encryption policy refers to pre-set rules and methods on how to perform encryption, such as the encryption algorithm used, the length of the encryption key, etc.

[0081] The encryption tool is a software or program used to encrypt program code segments. It has the same key as the key stored in the target operating system to ensure the consistency of subsequent decryption operations. The encryption tool also includes initialization vectors, etc.

[0082] Before the program is executed, the code segment of the program to be executed is encrypted using an encryption tool containing the same key as that stored in the target operating system according to a preset encryption strategy.

[0083] For example, for a data encryption software, after development, an encryption tool is used to encrypt the code segment according to a specific encryption strategy (such as the AES algorithm with a key length of 256 bits). The key used by the encryption tool is stored in it, and the key used by the target operating system is stored in it. When the program is executed, subsequent decryption operations can use the same key.

[0084] This application enhances the security of the program from the source, encrypts it from the program storage stage, and improves the anti-cracking capability.

[0085] In one embodiment, if Figure 4 As shown, the encryption tool is used to encrypt the code segment of the program to be executed, including:

[0086] S51. Determine, based on the acquired first byte sequence of the program to be executed, that the program to be executed is a program to be encrypted.

[0087] In this embodiment, the program to be encrypted is similar to the program to be executed, but here more emphasis is placed on its property of being encrypted, that is, the program that needs to be encrypted.

[0088] S52: Determine a code segment based on the acquired section header table information of the program to be encrypted.

[0089] In this embodiment, the section header table information is a data structure of the program, and generally includes information such as the location and size of each section (such as a code segment, a data section, etc.) of the program.

[0090] S53: Based on the code segment, determine the location and range of encryption of the program to be encrypted.

[0091] In this embodiment, when using an encryption tool to encrypt a program code segment, first determine that the program is a program to be encrypted based on the first byte sequence of the program to be executed, then find the code segment based on its section header table information, and finally determine the location and range of the program to be encrypted.

[0092] For example, for a file processing program, during the encryption process, it is first determined that it is a program that needs to be encrypted by reading some bytes of the program, and then the starting address and length of the code segment are found by analyzing the section header table, and then the scope of encryption of the code segment is determined to ensure that only the core code part is encrypted without affecting other data parts.

[0093] This application accurately determines the location and range of the code segment, avoids encryption operations on non-code parts, and improves the pertinence and efficiency of encryption. Using the section header table information, the code segment can be accurately found, ensuring the accuracy of encryption operations and preventing misoperation.

[0094] In one embodiment, if Figure 2 As shown, the determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence includes:

[0095] S21. Compare the obtained first byte sequence with the target byte sequence;

[0096] S22: When it is determined that the comparison result is a match, determine that the program to be executed is a target program to be decrypted.

[0097] In this embodiment, the comparison result refers to the result obtained by comparing the first byte sequence with the target byte sequence, and is used to determine whether the program to be executed is the target program to be decrypted.

[0098] Specifically, when determining whether a program is a target program to be decrypted, the system compares the first byte sequence of the program with a pre-stored target byte sequence. If the comparison result shows that the two are consistent, the program is identified as the target program to be decrypted.

[0099] For example, there are many programs in an operating system. For a video player program, the system will read the byte sequence at its specific location and compare it with the stored target byte sequence. If the video player program is a program that the developer sets to be protected, its byte sequence may be set to the target byte sequence. When the two are consistent, it is determined that it is the target program to be decrypted.

[0100] This application provides a simple and effective program identification method, which is convenient for the system to screen out programs that need special processing (decryption), improve the accuracy of judgment, and ensure that only programs that meet the requirements will enter the decryption process.

[0101] In one embodiment, if Figure 3 As shown, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including:

[0102] S31, determining a first physical address of the code segment;

[0103] In this embodiment, the first physical address is the original physical address of the code segment when the program is stored or executed, that is, the actual address of the code segment in the memory or storage device.

[0104] S32, mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address;

[0105] In this embodiment, virtual memory is a type of memory provided by the operating system for programs, which maps physical memory and logical address space. What the program sees is the virtual memory address, and the operating system maps it to the physical memory.

[0106] The second physical address is the physical address after the code segment is mapped to the virtual memory, which is different from the first physical address because of the mapping mechanism of the virtual memory.

[0107] S33. Based on the second physical address and the first physical address, remap the decrypted code segment to the first physical address.

[0108] In this embodiment, the first physical address of the code segment is found, the code segment is mapped to the virtual memory space, and the code segment is decrypted in the virtual memory. At this time, the code segment is at the second physical address. The decrypted code segment is remapped back to the first physical address using the mapping relationship between the first physical address and the second physical address.

[0109] For example, for an image editing program, its code segment is stored at the address 0x1000 (the first physical address) of the physical memory. During decryption, it is mapped to the virtual memory. Assuming that the physical address corresponding to the virtual memory is 0x2000 (the second physical address), after the decryption operation is completed at 0x2000, the decrypted code segment is remapped back to the address 0x1000.

[0110] This application uses virtual memory for decryption operations, avoiding the security risks that may be caused by direct operations on the original physical address. It ensures that the decrypted code segment can be correctly mapped back to the original location to ensure the normal operation of the program.

[0111] In one embodiment, if Figure 5 As shown, the method also includes:

[0112] S61. When it is determined that the target operating system cracks the code segment, a call request for accessing the target operating system is obtained.

[0113] In this embodiment, the call request is a request issued when a user or other program attempts to access the target operating system, and specifically refers to an access request when the target operating system performs a code segment cracking (decryption) operation.

[0114] S62: Determine first feedback information of a judgment module based on the calling request.

[0115] In this embodiment, the judgment module is responsible for judging whether to allow access to the target operating system, and will give feedback information according to different situations.

[0116] The first feedback information is information given by the judgment module when the target operating system is in a code segment cracking (decryption) state and receives an access request, and is used to prohibit access.

[0117] S63: Based on the first feedback information, prohibit access to the target operating system.

[0118] In this embodiment, when the target operating system starts to crack (decrypt) the code segment, if an access request is received, the judgment module generates first feedback information according to this situation, and denies access to the operating system according to the first feedback information.

[0119] Specifically, the ptrace system call of the Linux kernel source code is modified to achieve the purpose of prohibiting access. Ptrace is a powerful system call, mainly used for process tracking and debugging. It allows a process (usually a debugger) to observe and control the execution of another process (the debugged process). For example, developers can use ptrace to view the register status, memory content, or modify the execution flow of another process.

[0120] Add a conditional variable to the ptrace system, find the kernel code segment related to the ptrace system call, and add a check for the conditional variable at the appropriate location. Set the initial value of the variable to false in the appropriate kernel initialization function (ptrace is not allowed by default).

[0121] The judgment condition variable can be understood as a flag or condition set in the kernel to determine whether the ptrace system call is allowed to execute successfully. For example, a Boolean variable can be set. When this variable is false, the ptrace system call returns an error by default; when this variable is true, the ptrace system call is allowed to execute.

[0122] This application enhances the system security during the decryption process, prevents interference and attacks from external programs, ensures the independence and security of the operating system during key decryption operations, and avoids potential security risks.

[0123] In one embodiment, if Figure 5 As shown, the method also includes:

[0124] S64: Obtain modification information of the judgment module.

[0125] In this embodiment, the modification information is information for modifying the judgment module, and may come from the operation of a user or a system administrator.

[0126] S65. Determine second feedback information of the judgment module based on the change information.

[0127] In this embodiment, the second feedback information is information generated by the judgment module after receiving the modification information, and is used to allow access to the target operating system.

[0128] S66: Based on the second feedback information, allow access to the target operating system.

[0129] In this embodiment, the system receives the modification information of the judgment module, the judgment module generates the second feedback information according to the modification information, and allows access to the target operating system according to the second feedback information.

[0130] Specifically, a function is provided in the kernel module of the target operating system to modify the value of the judgment condition variable. For example, a function may be defined, and when the function is called, the judgment condition variable may be set to true or false.

[0131] Assume a simple scenario where there is a security-sensitive application running in the system and you do not want ordinary users to be able to debug this application via ptrace.

[0132] When a process attempts to call ptrace, the kernel first checks the condition variable allow_ptrace. If allow_ptrace is false, an error is returned immediately and debugging is not allowed.

[0133] For example, a malicious user attempts to use ptrace to trace the process of a security-sensitive application. Since allow_ptrace is false by default, this attempt will fail.

[0134] Assuming that the system developer needs to debug a process, he can load the ptrace.ko module. This module provides a function, such as enable_ptrace(), which sets allow_ptrace to true when called.

[0135] Now, you can use ptrace to debug a specific process. After debugging, you can call another function (such as disable_ptrace()) to set allow_ptrace to false again to restore the safe state. In addition, the ptrace.ko module is not released with the product and is only used in the debugging stage.

[0136] This application provides a flexible access control mechanism, which allows system administrators to remove access restrictions when necessary while ensuring system security, facilitating system maintenance and management. It ensures the controllability of the system in different states and improves the availability and manageability of the system.

[0137] For example, a certain product uses the linux-4.19.90 version of the kernel. In the product, there is a program in ELF (executable and linkable format) binary form. This program is the program that provides core services in the product, so it needs to be protected.

[0138] Applications in the ELF format refer to executable and linkable format programs, which are commonly found in Unix-like operating systems, such as various applications and system tools in Linux. Commands such as ls and cp are executable programs in the ELF format.

[0139] The anti-cracking method of this application is as follows when protecting an application in ELF format:

[0140] The code segment of the ELF format application that needs to be protected is encrypted by an encryption tool. The code segment is the part of the program that stores executable instructions, such as the area where the code for image processing algorithms in an image editing software is located.

[0141] The encryption tool will encrypt the code segment based on a specific encryption algorithm, key, and initialization vector, thereby encrypting and protecting the core logic of the program. Figure 6 As shown, the encryption tool reads the ELF header of the executable program and confirms that the file is in ELF format. Then read the section table of the ELF of the executable program to find the code segment. If it fails, the process ends. After finding the code segment, the file offset and size of the code segment are obtained. Finally, the encryption tool reads the offset and size of the code segment file in the executable program, and uses a predetermined encryption algorithm and key to encrypt the content and write it back to the original location.

[0142] Among them, AES256-CBC mode encryption can be used, the encryption key is key, the initial iv is IV, and the encryption tool encrypts the code segment (.text section) of the protected program. CBC mode requires data to be 16-byte aligned. When the tail data is less than 16 bytes, it will not be encrypted.

[0143] Then, with the help of the Linux kernel, in the elf loading module callback interface load_elf_binary, when it is detected that the loaded application is an ELF format application that needs to be protected in advance, the system will perform a series of key operations. For example, the system will compare the file name pointed to by the structfile pointer of the currently loaded file, and only perform subsequent operations if it happens to be a pre-set core service program that needs to be protected.

[0144] The Linux kernel is the core part of the Linux operating system, responsible for managing system resources, scheduling processes, etc. load_elf_binary is a key interface in the Linux kernel for loading ELF binary files. When the system starts an ELF format application or dynamic link library, this interface will be called to complete the related loading operations.

[0145] When the system performs a series of key operations, it first maps the PT_LOAD type part pointed to by the ELF program header to the virtual memory. After that, it uses the same encryption algorithm and key as the encryption tool to decrypt the code segment mapped to the virtual memory and remap it back to the original location.

[0146] Among them, the ELF program header is the part of the ELF file used to describe the overall structure and attributes of the program, including important information such as the program entry address and segment table. The ELFPT_LOAD type part contains key information when the program is loaded into the memory, such as the layout and permissions of the code segment and data segment in the memory. Virtual memory is an independent, abstract memory space provided by the operating system for each process.

[0147] In this way, the security of the protected ELF format application is ensured throughout the running process. When the program is not running, the code segment is in an encrypted state. Even if the program file is illegally obtained, it is difficult for the attacker to obtain its core code; when the program is running, the decryption operation is only performed in a secure kernel environment and when specific conditions are met, and the mapping of the decrypted code segment in the memory is also strictly controlled, which greatly reduces the risk of illegal acquisition and tampering of the code segment.

[0148] Based on the same inventive concept, an embodiment of the present application further provides an electronic device, the electronic device comprising: a memory and a processor, the memory storing executable programs / instructions, the processor executing the executable programs / instructions to implement the steps of the method described above.

[0149] The processor may be a general purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The general purpose processor may be a microprocessor or any conventional processor.

[0150] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0151] An embodiment of the present application further provides a storage medium, wherein the storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor, the steps of the above method are implemented.

[0152] The storage medium in the embodiment may be included in the electronic device / system; or it may exist independently without being assembled into the electronic device / system. The above storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present application is implemented.

[0153] According to an embodiment of the present application, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0154] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, including a computer program / instruction, which implements any of the methods described in the above embodiments when executed by a processor.

[0155] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, electronic equipment, computer-readable storage media or computer program products. Therefore, the present application may adopt the form of complete hardware embodiments, complete software embodiments or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code. When implemented by software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0156] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for preventing cracking, characterized in that: include: Acquire a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target position of the program to be executed; Based on the first byte sequence and the target byte sequence, determining whether the program to be executed is a target program to be decrypted, wherein the target program to be decrypted includes an encrypted code segment; In the case where it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment; The target operating system executes the decrypted target program to be decrypted.

2. The anti-cracking method according to claim 1, characterized in that: The method further comprises: Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

3. The anti-cracking method according to claim 2, characterized in that: The step of encrypting the code segment of the program to be executed by using an encryption tool includes: Based on the acquired first byte sequence of the program to be executed, determining that the program to be executed is a program to be encrypted; Determine a code segment based on the obtained section header table information of the program to be encrypted; Based on the code segment, the location and range of encryption of the program to be encrypted are determined.

4. The anti-cracking method according to claim 1, characterized in that: The determining, based on the first byte sequence and the target byte sequence, whether the program to be executed is a target program to be decrypted includes: Comparing the first byte sequence obtained with the target byte sequence; When it is determined that the comparison result is a match, the program to be executed is determined to be a target program to be decrypted.

5. The anti-cracking method according to claim 1, characterized in that: The target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including: determining a first physical address of the code segment; Mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address; Based on the second physical address and the first physical address, the decrypted code segment is remapped to the first physical address.

6. The anti-cracking method according to claim 1, characterized in that: The method further comprises: When it is determined that the target operating system cracks the code segment, obtaining a call request to access the target operating system; Based on the calling request, determining first feedback information of the judgment module; Based on the first feedback information, access to the target operating system is prohibited.

7. The anti-cracking method according to claim 6, characterized in that: The method further comprises: Obtaining modification information of the judgment module; Based on the change information, determining second feedback information of the judgment module; Based on the second feedback information, access to the target operating system is permitted.

8. An electronic device, characterized in that: include: A memory and a processor, wherein an executable program is stored in the memory, and the processor executes the executable program to implement the steps of the method according to any one of claims 1 to 7.

9. A storage medium, characterized in that: The storage medium carries one or more computer programs / instructions, and when the one or more computer programs / instructions are executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

Images