Anti-cracking method, electronic device, storage medium and program product

Abstract

The present application discloses an anti-cracking method, electronic device, storage medium and program product, the method comprising: obtaining a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is the byte information of the target position of the program to be executed; based on the first byte sequence and the target byte sequence, determining whether the program to be executed is a target program to be decrypted, wherein the target program to be decrypted contains an encrypted code segment. The present application identifies programs to be protected by comparing byte sequences, implements encryption and decryption in a targeted manner, avoids operating all programs, optimizes system resource utilization, ensures the security of key parts, and maintains system performance and stability. In addition, the operating system is in a prohibited call state during decryption to prevent interference and attacks, and uses virtual memory for decryption and mapping operations to improve the security and integrity of the decryption process.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to an anti-cracking method, electronic device, storage medium, and program product. Background Art

[0002] The internet is awash with network devices, and their security and stability are crucial to overall network security. Network product manufacturers often release their products in hardware or virtualized form factors, employing customized operating systems and proprietary application software to meet these needs. Linux is favored by manufacturers due to its numerous advantages. However, storing products as files on disk presents security risks, making them vulnerable to adversaries and malicious attackers who can infiltrate and reverse engineer the programs, potentially damaging the manufacturer's business and reputation. Protecting the core code and principles of their products from theft and cracking is crucial for manufacturers. However, the commonly used ELF format lacks encryption capabilities and is therefore vulnerable to attack. Effective methods are urgently needed to protect core applications, safeguarding manufacturer rights and protecting the security and stability of the network ecosystem. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide an anti-cracking method, including:

[0004] Acquire a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target location of the program to be executed;

[0005] Determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence, wherein the target program to be decrypted includes an encrypted code segment;

[0006] When it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment;

[0007] The target operating system executes the decrypted target program to be decrypted.

[0008] As an optional embodiment, the method further includes:

[0009] Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

[0010] As an optional embodiment, the encrypting the code segment of the program to be executed by using an encryption tool includes:

[0011] determining, based on the acquired first byte sequence of the program to be executed, that the program to be executed is a program to be encrypted;

[0012] Determining a code segment based on the obtained section header table information of the program to be encrypted;

[0013] Based on the code segment, the encryption position and range of the program to be encrypted are determined.

[0014] As an optional embodiment, determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence includes:

[0015] Comparing the obtained first byte sequence with the target byte sequence;

[0016] When the comparison result is determined to be a match, the program to be executed is determined to be a target program to be decrypted.

[0017] As an optional embodiment, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including:

[0018] determining a first physical address of the code segment;

[0019] Mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address;

[0020] Based on the second physical address and the first physical address, the decrypted code segment is remapped to the first physical address.

[0021] As an optional embodiment, the method further includes:

[0022] When it is determined that the target operating system cracks the code segment, obtaining a call request to access the target operating system;

[0023] Determining first feedback information of a judgment module based on the calling request;

[0024] Based on the first feedback information, access to the target operating system is prohibited.

[0025] As an optional embodiment, the method further includes:

[0026] Obtaining modification information of the judgment module;

[0027] Determining second feedback information of the judgment module based on the change information;

[0028] Based on the second feedback information, access to the target operating system is permitted.

[0029] An embodiment of the present application aims to provide an electronic device, comprising: a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the aforementioned method.

[0030] An embodiment of the present application aims to provide a storage medium, which carries one or more computer programs / instructions, and which implements the steps of the aforementioned method when executed by a processor.

[0031] The purpose of the embodiments of the present application is to provide a computer program product, including a computer program / instruction, which implements the steps of the aforementioned method when executed by a processor.

[0032] The beneficial effects of the embodiments of the present application are:

[0033] This application identifies programs requiring protection through byte sequence comparison and implements targeted encryption and decryption, avoiding operations on all programs, optimizing system resource utilization, ensuring the security of key components, and maintaining system performance and stability. Furthermore, the operating system is in a call-disabled state during decryption to prevent interference and attacks, and utilizes virtual memory for decryption and mapping operations, enhancing the security and integrity of the decryption process.

[0034] This application protects the core code by encrypting program code segments, preventing it from being easily accessed. It also enables precise operations based on encryption policies and section header table information, avoiding resource waste and excessive performance impact. It also provides a mechanism for removing access restrictions, ensuring system manageability and availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flow chart of the anti-cracking method according to an embodiment of the present application;

[0036] Figure 2 This is a flowchart of step S20 of the anti-cracking method according to an embodiment of the present application;

[0037] Figure 3 This is a flowchart of step S30 of the anti-cracking method according to an embodiment of the present application;

[0038] Figure 4 This is a flowchart of step S50 of the anti-cracking method according to an embodiment of the present application;

[0039] Figure 5 This is a flowchart of step S60 of the anti-cracking method according to an embodiment of the present application;

[0040] Figure 6 A flowchart of encryption by the encryption tool of an embodiment of the present application. DETAILED DESCRIPTION

[0041] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0042] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but merely as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0043] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0044] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0045] It should also be understood that although the present application has been described with reference to certain specific examples, those skilled in the art will readily be able to implement many other equivalent forms of the present application.

[0046] The above and other aspects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0047] Specific embodiments of the present application will be described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments described are merely examples of the present application and may be implemented in a variety of ways. Familiar and / or repetitive functions and structures are not described in detail to avoid obscuring the present application with unnecessary or redundant details. Therefore, the specific structural and functional details described herein are not intended to be limiting, but rather serve merely as a basis and representative basis for the claims to teach those skilled in the art to variously utilize the present application with substantially any suitable detailed structure.

[0048] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may all refer to one or more of the same or different embodiments according to the present application.

[0049] An anti-cracking method according to an embodiment of the present application is as follows: Figure 1 Shown, including:

[0050] S10. Obtain a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target location of the program to be executed.

[0051] In this embodiment, the program to be executed is a program that will be run on the target operating system. For example, in a Linux system, a user-developed network service program may include various functional codes and data, waiting to be scheduled for execution by the operating system. For example, the program to be executed is an application program whose file format is ELF format.

[0052] The first byte sequence is the byte information of the program to be executed at the target location. For example, for an executable file, some bytes at the beginning may contain information such as the file type and program entry.

[0053] The target location is a specific location selected in the program, which may be a file header, a specific section or segment, etc., and is used to identify whether the program is the target program to be decrypted.

[0054] The target operating system is a Linux system, and the protected application (ie, the program to be executed) is bundled with the kernel of the Linux system, so that the protected application cannot run independently.

[0055] This bundling mechanism sets a higher threshold for program operation. Malicious attackers cannot easily separate the program from the kernel environment it depends on for attack or analysis, which significantly improves the security of the program.

[0056] For example, in server programs of critical business systems, the bundling of applications and kernels ensures that the programs must run in a specific kernel environment, preventing the programs from being illegally copied and run in other unsafe environments, and preventing the leakage and abuse of core functions.

[0057] S20. Determine whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence, wherein the target program to be decrypted includes an encrypted code segment.

[0058] In this embodiment, the target byte sequence is a preset byte sequence used for comparison with the first byte sequence to determine whether the program to be executed is a program that requires special processing (decryption).

[0059] The target programs to be decrypted are those to-be-executed programs that contain encrypted code segments, that is, programs that need to be decrypted.

[0060] The code segment is the part of the program that stores executable instructions, including the program's core logic and algorithms. This part is encrypted to prevent reverse engineering.

[0061] S30. When it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment.

[0062] In this embodiment, the call-forbidden state is a state in which the operating system is in when performing a decryption operation. In this state, other programs or users are not allowed to call certain functions of the system to prevent the decryption process from being interfered with or attacked.

[0063] Here, assuming that the target operating system is a Linux system, the kernel of the Linux system is used to control whether the product can be debugged. On the one hand, this reduces the risk of the code segment of the protected program being leaked, and on the other hand, it increases the convenience for program development and debugging.

[0064] During normal use, limiting the debugging function can prevent malicious attackers from viewing and tampering with program code through debugging means, thereby ensuring the security of the program.

[0065] During the development phase, developers can flexibly adjust the state of the Linux system kernel as needed to facilitate program debugging, ensuring a smooth development process and improved program quality.

[0066] For example, when developing a complex image editing software, developers can adjust the Linux system kernel in the development environment to allow debugging. After release, the Linux system kernel restricts debugging to prevent program code from being stolen by users or malicious persons through debugging.

[0067] In addition, assuming that the target operating system is a Linux system, the Linux kernel image is used to save the key, and the code segment of the ELF format application is temporarily decrypted when the product runs the protected program. This mechanism greatly increases the difficulty of cracking.

[0068] Since the key is stored in the relatively secure Linux kernel image, it is difficult for attackers to obtain it easily, and it is only temporarily decrypted when the program is running, which greatly reduces the risk of password exposure and provides more reliable protection for the core code.

[0069] For example, in network security software or financial system software, the code segments containing the core algorithms and business logic are encrypted when stored and at rest, and are only decrypted in a secure kernel environment at runtime, effectively preventing competitors and malicious attackers from obtaining key information by cracking the program.

[0070] S40: The target operating system executes the decrypted target program to be decrypted.

[0071] In this embodiment, the byte sequence of the program to be executed at the target location (the first byte sequence) is first obtained, and then compared with the target byte sequence to determine whether the program to be executed is the program to be decrypted (the target program to be decrypted). If it is determined to be the target program to be decrypted, the target operating system will use the stored key to decrypt the program's code segment, map the decrypted code segment back to the original program, and finally execute the decrypted program.

[0072] Specifically, when a program is ready to run on a target operating system, the system retrieves the first byte sequence of the program to be executed, located at the target location of the program. The system compares the first byte sequence with a pre-set target byte sequence. If the two match, the program is the target to be decrypted. The system then decrypts the program's code segment using the stored key. The operating system then remaps the decrypted code segment back to the corresponding location of the original program. Finally, the operating system executes the decrypted program.

[0073] For example, a network security software is a program to be executed, and its code segment is encrypted using an encryption tool during the development process and then stored on a disk.

[0074] When the user wants to start the software, the operating system will read a part of the program's byte sequence (such as the first few bytes of the program header) as the first byte sequence and compare it with the stored target byte sequence. If they match, the operating system uses the stored key to decrypt the encrypted code segment, and then maps the decrypted code segment back to the program and executes it. At the same time, during the decryption process, the operating system is in a prohibited call state to prevent interference from other programs.

[0075] Furthermore, compared to existing obfuscation or encryption methods, this application does not modify the code content of the protected program. Once the program is started, it operates with the same efficiency as if it were not encrypted. This approach avoids the performance loss that traditional encryption or obfuscation methods may bring, ensuring that the program provides high security without affecting the user experience or overall system performance.

[0076] For example, in real-time processing systems with high performance requirements, such as video processing software or data processing software, the program operation will not be stuck or delayed due to encryption, ensuring the smoothness and efficiency of the system.

[0077] This application protects the core code segments of the program, preventing unauthorized access and reverse engineering, and enhancing the security of the program. It only decrypts specific programs (target programs to be decrypted), improving the operating efficiency of the system and avoiding the waste of resources that would be wasted by decrypting all programs.

[0078] In one embodiment, the method further comprises:

[0079] Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

[0080] In this embodiment, the encryption policy refers to pre-set rules and methods on how to perform encryption, such as the encryption algorithm used, the length of the encryption key, etc.

[0081] A cryptographic tool is software or a program used to encrypt program code segments. It uses the same key as the one stored by the target operating system to ensure consistency in subsequent decryption operations. This includes, for example, an initialization vector (IV).

[0082] Before the program is executed, the code segment of the program to be executed is encrypted using an encryption tool containing the same key as that stored in the target operating system according to a preset encryption strategy.

[0083] For example, after developing data encryption software, an encryption tool is used to encrypt the code segment according to a specific encryption strategy (such as the AES algorithm with a 256-bit key length). The key used by the encryption tool is stored within the tool, as is the key used by the target operating system. When the program is executed, subsequent decryption operations can use the same key.

[0084] This application enhances the security of the program from the source, encrypts it from the program storage stage, and improves the anti-cracking capability.

[0085] In one embodiment, if Figure 4 As shown, the encryption tool is used to encrypt the code segment of the program to be executed, including:

[0086] S51: Determine, based on the acquired first byte sequence of the program to be executed, that the program to be executed is a program to be encrypted.

[0087] In this embodiment, the program to be encrypted is similar to the program to be executed, but here more emphasis is placed on its property of being encrypted, that is, the program that needs to be encrypted.

[0088] S52: Determine a code segment based on the obtained section header table information of the program to be encrypted.

[0089] In this embodiment, the section header table information is a data structure of the program, and generally includes information such as the location and size of each section (such as a code segment, a data section, etc.) of the program.

[0090] S53: Based on the code segment, determine the encryption position and range of the program to be encrypted.

[0091] In this embodiment, when using an encryption tool to encrypt a program code segment, the program is first determined to be the program to be encrypted based on the first byte sequence of the program to be executed, then the code segment is found based on its section header table information, and finally the location and range of the program to be encrypted are determined.

[0092] For example, for a file processing program, during the encryption process, it is first determined that it is the program that needs to be encrypted by reading some bytes of the program, and then the starting address and length of the code segment are found by analyzing the section header table, and then the scope of encryption of the code segment is determined to ensure that only the core code part is encrypted without affecting other data parts.

[0093] This application accurately determines the location and range of the code segment, avoids encryption operations on non-code parts, and improves the pertinence and efficiency of encryption. Using the section header table information, the code segment can be accurately found, ensuring the accuracy of encryption operations and preventing misoperations.

[0094] In one embodiment, if Figure 2 As shown, the determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence includes:

[0095] S21. Compare the obtained first byte sequence with the target byte sequence;

[0096] S22: If the comparison result is a match, determine that the program to be executed is a target program to be decrypted.

[0097] In this embodiment, the comparison result refers to the result obtained by comparing the first byte sequence with the target byte sequence, and is used to determine whether the program to be executed is the target program to be decrypted.

[0098] Specifically, when determining whether a program is a target program to be decrypted, the system compares the first byte sequence of the program with a pre-stored target byte sequence. If the comparison result shows that the two are consistent, the program is identified as the target program to be decrypted.

[0099] For example, there are many programs in an operating system. For a video player program, the system will read the byte sequence at its specific location and compare it with the stored target byte sequence. If the video player program is a program that the developer has set to be protected, its byte sequence may be set to the target byte sequence. When the two are consistent, it is determined that it is the target program to be decrypted.

[0100] This application provides a simple and effective program identification method, which facilitates the system to screen out programs that require special processing (decryption). It improves the accuracy of judgment and ensures that only programs that meet the requirements will enter the decryption process.

[0101] In one embodiment, if Figure 3 As shown, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including:

[0102] S31, determining a first physical address of the code segment;

[0103] In this embodiment, the first physical address is the original physical address of the code segment when the program is stored or executed, that is, the actual address of the code segment in the memory or storage device.

[0104] S32, mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address;

[0105] In this embodiment, virtual memory is a type of memory provided by the operating system to programs, which maps physical memory and logical address space. Programs see virtual memory addresses, which the operating system maps to physical memory.

[0106] The second physical address is the physical address after the code segment is mapped to the virtual memory, which is different from the first physical address because of the mapping mechanism of the virtual memory.

[0107] S33. Based on the second physical address and the first physical address, remap the decrypted code segment to the first physical address.

[0108] In this embodiment, the first physical address of the code segment is found. The code segment is mapped to virtual memory space and decrypted in the virtual memory. At this point, the code segment is at the second physical address. Using the mapping relationship between the first physical address and the second physical address, the decrypted code segment is remapped back to the first physical address.

[0109] For example, for an image editing program, its code segment is stored at the address 0x1000 (the first physical address) of the physical memory. During decryption, it is mapped to the virtual memory. Assuming that the physical address corresponding to the virtual memory is 0x2000 (the second physical address), after the decryption operation is completed at 0x2000, the decrypted code segment is remapped back to the address 0x1000.

[0110] This application uses virtual memory for decryption operations, avoiding the security risks that may arise from direct operations on the original physical address. It ensures that the decrypted code segment can be correctly mapped back to the original location to ensure the normal operation of the program.

[0111] In one embodiment, if Figure 5 As shown, the method further includes:

[0112] S61. When it is determined that the target operating system cracks the code segment, a call request for accessing the target operating system is obtained.

[0113] In this embodiment, the call request is a request issued when a user or other program attempts to access the target operating system, and specifically refers to an access request when the target operating system performs a code segment cracking (decryption) operation.

[0114] S62: Determine first feedback information of the judgment module based on the calling request.

[0115] In this embodiment, the judgment module is responsible for judging whether access to the target operating system is allowed, and will provide feedback information according to different situations.

[0116] The first feedback information is information provided by the judgment module when the target operating system is in a code segment cracking (decryption) state and receives an access request, and is used to prohibit access.

[0117] S63: Based on the first feedback information, prohibit access to the target operating system.

[0118] In this embodiment, when the target operating system begins to crack (decrypt) the code segment, if an access request is received, the judgment module generates first feedback information based on this situation and denies access to the operating system based on the first feedback information.

[0119] Specifically, the ptrace system call in the Linux kernel source code is modified to achieve access denial. Ptrace is a powerful system call used primarily for process tracing and debugging. It allows one process (usually a debugger) to observe and control the execution of another process (the debugged process). For example, developers can use ptrace to view the register state and memory contents of another process, or to modify its execution flow.

[0120] Add a conditional variable to the ptrace system, find the kernel code segment related to the ptrace system call, and add a check for the conditional variable at the appropriate location. Set the initial value of the variable to false in the appropriate kernel initialization function (ptrace is not allowed by default).

[0121] A conditional variable can be understood as a flag or condition set in the kernel to determine whether the ptrace system call is allowed to execute successfully. For example, you can set a Boolean variable. When this variable is false, the ptrace system call returns an error by default; when this variable is true, the ptrace system call is allowed to execute.

[0122] This application enhances system security during the decryption process, preventing interference and attacks from external programs. It ensures the independence and security of the operating system during critical decryption operations, avoiding potential security risks.

[0123] In one embodiment, if Figure 5 As shown, the method further includes:

[0124] S64: Acquire modification information of the judgment module.

[0125] In this embodiment, the modification information is information for modifying the judgment module, and may come from the operation of a user or a system administrator.

[0126] S65: Determine second feedback information of the judgment module based on the change information.

[0127] In this embodiment, the second feedback information is information generated by the judgment module after receiving the modification information, and is used to allow access to the target operating system.

[0128] S66: Based on the second feedback information, allow access to the target operating system.

[0129] In this embodiment, the system receives modification information to the judgment module, generates second feedback information based on the modification information, and allows access to the target operating system based on the second feedback information.

[0130] Specifically, a function is provided in the kernel module of the target operating system to modify the value of the judgment condition variable. For example, a function can be defined that, when called, can set the judgment condition variable to true or false.

[0131] Assume a simple scenario where there is a security-sensitive application running in the system and you do not want ordinary users to be able to debug this application through ptrace.

[0132] When a process attempts to call ptrace, the kernel first checks the condition variable allow_ptrace. If allow_ptrace is false, an error is returned immediately and debugging is not allowed.

[0133] For example, a malicious user might try to use ptrace to trace the progress of a security-sensitive application. This attempt would fail because allow_ptrace is false by default.

[0134] If the system developer needs to debug a process, he can load the ptrace.ko module. This module provides a function, such as enable_ptrace(), which sets allow_ptrace to true when called.

[0135] Now, you can use ptrace to debug a specific process. After debugging, you can call another function (such as disable_ptrace()) to set allow_ptrace to false again to restore the safe state. In addition, the ptrace.ko module is not released with the product and is only used in the debugging stage.

[0136] This application provides a flexible access control mechanism that ensures system security while allowing system administrators to lift access restrictions when necessary, facilitating system maintenance and management. This ensures the controllability of the system in different states and improves system availability and manageability.

[0137] For example, a product uses the Linux-4.19.90 kernel. In this product, there is a program in ELF (Executable and Linkable Format) binary form. This program is the program that provides core services in the product, so it needs to be protected.

[0138] Applications in the ELF format refer to executable and linkable format programs, which are commonly found in Unix-like operating systems, such as various applications and system tools in Linux. Commands such as ls and cp are executable programs in the ELF format.

[0139] The anti-cracking method of this application is as follows when protecting ELF format applications:

[0140] The code segment of the ELF format application that needs to be protected is encrypted using an encryption tool. The code segment is the part of the program that stores executable instructions, such as the area where the code for image processing algorithms in an image editing software is located.

[0141] The encryption tool will encrypt the code segment based on a specific encryption algorithm, key and initialization vector, thereby encrypting and protecting the core logic of the program. Specifically, Figure 6 As shown, the encryption tool reads the ELF header of the executable program to confirm that the file is in ELF format. It then reads the section table of the executable program's ELF and searches for the code segment. If the search fails, the encryption process ends. Once the code segment is found, the file offset and size of the code segment are obtained. Finally, the encryption tool reads the offset and size of the code segment file in the executable program and, using a predetermined encryption algorithm and key, encrypts the content and writes it back to its original location.

[0142] AES256-CBC mode encryption can be used, with the encryption key as key and the initial iv as iv. The encryption tool encrypts the code segment (.text section) of the protected program. CBC mode requires data to be 16-byte aligned. If the tail data is less than 16 bytes, it will not be encrypted.

[0143] Next, through the Linux kernel, in the ELF loading module callback interface load_elf_binary, if the loaded application is detected as an ELF format application that requires protection, the system will perform a series of key operations. For example, the system will compare the file name pointed to by the structfile pointer of the currently loaded file. If it happens to be a core service program that requires protection, the system will perform subsequent operations.

[0144] The Linux kernel is the core of the Linux operating system, responsible for managing system resources, scheduling processes, and other operations. load_elf_binary is a key interface in the Linux kernel for loading ELF binary files. When the system starts an ELF-formatted application or dynamic link library, it calls this interface to complete the relevant loading operations.

[0145] When the system performs a series of key operations, it first maps the PT_LOAD type part pointed to by the ELF program header to virtual memory. Then, it decrypts the code segment mapped to virtual memory using the same encryption algorithm and key as the encryption tool and remaps it back to its original location.

[0146] The ELF program header is the portion of the ELF file that describes the overall structure and properties of the program, including important information such as the program entry address and segment table. The ELFPT_LOAD type section contains key information when the program is loaded into memory, such as the layout and permissions of the code and data segments. Virtual memory is the independent, abstract memory space provided by the operating system to each process.

[0147] This ensures the security of protected ELF-formatted applications throughout their entire runtime. When the program is not running, the code segment is encrypted, making it difficult for attackers to obtain the core code even if the program file is illegally obtained. While the program is running, decryption is performed only within a secure kernel environment and when specific conditions are met. The mapping of the decrypted code segment in memory is also strictly controlled, significantly reducing the risk of illegal access and tampering.

[0148] Based on the same inventive concept, an embodiment of the present application further provides an electronic device, which includes: a memory and a processor, wherein the memory stores executable programs / instructions, and the processor executes the executable programs / instructions to implement the steps of the method described above.

[0149] The processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or any combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0150] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0151] An embodiment of the present application further provides a storage medium, which carries one or more computer programs, and when the one or more computer programs are executed by a processor, the steps of the above method are implemented.

[0152] The storage medium in the embodiments may be included in an electronic device / system, or may exist independently without being incorporated into the electronic device / system. The storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of the present application is implemented.

[0153] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0154] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, including a computer program / instruction, which implements any of the methods described in the above embodiments when executed by a processor.

[0155] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, electronic equipment, computer-readable storage media or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0156] The above embodiments are merely exemplary embodiments of the present application and are not intended to limit the scope of the present application. The scope of protection of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and scope of protection of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the scope of protection of the present application.

Claims

1. A method for preventing cracking, characterized in that: include: Acquire a first byte sequence of a program to be executed, wherein the program to be executed is executed by a target operating system, and the first byte sequence is byte information of a target location of the program to be executed; Determining whether the program to be executed is a target program to be decrypted based on the first byte sequence and the target byte sequence, wherein the target program to be decrypted includes an encrypted code segment; When it is determined that the program to be executed is the target program to be decrypted, the target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, wherein the target operating system stores a key and is in a call-prohibited state when decrypting the code segment; The target operating system executes the decrypted target program to be decrypted.

2. The anti-cracking method according to claim 1, wherein: The method further comprises: Based on a preset encryption strategy, an encryption tool is used to encrypt the code segment of the program to be executed, wherein the encryption tool contains a key that is the same as a key stored in the target operating system.

3. The anti-cracking method according to claim 2, wherein: The step of encrypting the code segment of the program to be executed by using an encryption tool includes: determining, based on the acquired first byte sequence of the program to be executed, that the program to be executed is a program to be encrypted; Determining a code segment based on the obtained section header table information of the program to be encrypted; Based on the code segment, the encryption position and range of the program to be encrypted are determined.

4. The anti-cracking method according to claim 1, wherein: The determining, based on the first byte sequence and the target byte sequence, whether the program to be executed is a target program to be decrypted includes: Comparing the obtained first byte sequence with the target byte sequence; When the comparison result is determined to be a match, the program to be executed is determined to be a target program to be decrypted.

5. The anti-cracking method according to claim 1, wherein: The target operating system decrypts the code segment and maps the decrypted code segment back to the target program to be decrypted, including: determining a first physical address of the code segment; Mapping the code segment to a virtual memory and then decrypting the code segment, wherein the virtual memory has a second physical address; Based on the second physical address and the first physical address, the decrypted code segment is remapped to the first physical address.

6. The anti-cracking method according to claim 1, wherein: The method further comprises: When it is determined that the target operating system cracks the code segment, obtaining a call request to access the target operating system; Determining first feedback information of a judgment module based on the calling request; Based on the first feedback information, access to the target operating system is prohibited.

7. The anti-cracking method according to claim 6, wherein: The method further comprises: Obtaining modification information of the judgment module; Determining second feedback information of the judgment module based on the change information; Based on the second feedback information, access to the target operating system is permitted.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the method according to any one of claims 1 to 7.

9. A storage medium, characterized in that: The storage medium carries one or more computer programs / instructions, and when the one or more computer programs / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images