Executable file generation method and device, electronic equipment and storage medium

Abstract

The invention provides an executable file generation method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the safety processing of a to-be-protected shell script, obtaining a safety text, and determining an execution code corresponding to the safety text; generating a source file according to the security text and the execution code, and compiling the source file into an executable file; wherein when the executable file is executed, the execution code is used for reversely processing the safe text into the shell script, and the shell script is executed.

Description

Technical Field

[0001] This specification relates to the technical field of software development, and particularly to a method, apparatus, electronic device, and storage medium for generating an executable file. Background Art

[0002] As the native language environment in the GNU / Linux operating system, Shell is often used by operation and maintenance personnel to maintain the operating system due to its simplicity, convenience, and portability. A Shell script is a script program written in the Shell language, mainly used to automatically execute a series of commands. Shell scripts are usually used in the GNU / Linux operating system. Through Shell scripts, automated operation and maintenance tasks can be achieved, such as log cleaning, software update, system backup, etc. Batch operations can be performed on files, such as batch renaming, copying, moving, etc. The environment of the system or application can also be automatically configured through Shell scripts, such as installing dependencies, configuring databases, etc.

[0003] However, since Shell scripts are readable and writable and stored in plain text, there are significant security risks. For example, the readable and writable feature may allow attackers to maliciously modify the content of Shell scripts to change their original purpose. For example, an attacker can tamper with a Shell script, and after the Shell script is tampered with, it may cause the system to crash or exhibit unpredictable behavior, affecting the normal operation of the system. The plain text storage method of Shell scripts can also leak sensitive information, such as usernames, passwords, paths, IPs, etc. Summary of the Invention

[0004] To overcome the problems existing in the related art, this specification provides a method, apparatus, electronic device, and storage medium for generating an executable file.

[0005] According to the first aspect of the embodiments of this specification, a method for generating an executable file is provided, and the method includes:

[0006] Performing security processing on the Shell script to be protected to obtain a secure text, and determining the execution code corresponding to the secure text;

[0007] Generating a source file according to the secure text and the execution code, and compiling the source file into an executable file; wherein, when the executable file is executed, the execution code is used to reverse-process the secure text into the Shell script and execute the Shell script.

[0008] According to the second aspect of the embodiments of this specification, a method for executing an executable file is provided, and the method includes:

[0009] In response to the execution of the executable file, an execution code is called to reverse process the security text in the executable file into a shell script and execute the shell script;

[0010] Wherein, the executable file is obtained by compiling a source file, the source file includes the execution code and the security text, and the security text is obtained after the shell script is security processed.

[0011] According to the third aspect of the embodiments of the present specification, a generating device for an executable file is provided, and the device includes:

[0012] A security processing module, configured to perform security processing on the shell script to be protected to obtain a security text, and determine an execution code corresponding to the security text;

[0013] An executable file generating module, configured to generate a source file according to the security text and the execution code, and compile the source file into an executable file; wherein, when the executable file is executed, the execution code is used to reverse process the security text into the shell script and execute the shell script.

[0014] According to the fourth aspect of the embodiments of the present specification, an electronic device is provided, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, the steps of the method described in the first aspect or the second aspect are implemented.

[0015] According to the fifth aspect of the embodiments of the present specification, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.

[0016] The technical solutions provided by the embodiments of the present specification may include the following beneficial effects:

[0017] In the embodiments of this specification, the method of this embodiment protects the shell script by converting it into an executable file. First, after the shell script content recorded in the executable file undergoes security processing, it is very difficult to be restored through reverse engineering, thereby protecting the sensitive information in the shell script from being leaked and the execution logic of the shell script from being tampered with at will. Second, this embodiment generates a source file based on the security text and the execution code, and compiles the source file into an executable file. When the executable file is executed, the execution code is used to reverse process the security text into a shell script and execute the shell script. On the one hand, the executable file encapsulates the logic for processing the shell script inside. When the executable file is executed, its execution effect is the same as that of directly executing the original shell script from the perspective of external use, and the user's operation experience remains unchanged. On the other hand, the executable file generated in this embodiment is generated by compiling the source file and does not need to depend on a specific operating environment, which can simplify the security maintenance of the shell script.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit this specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with this specification, and are used together with the specification to explain the principles of this specification.

[0020] Figure 1 is a flowchart of a method for generating an executable file according to an exemplary embodiment of this specification.

[0021] Figure 2 is a flowchart of a method for executing an executable file according to an exemplary embodiment of this specification.

[0022] Figure 3 is a schematic diagram of a process for generating an executable file according to an exemplary embodiment of this specification.

[0023] Figure 4 is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of this specification.

[0024] Figure 5 is a block diagram of a device for generating an executable file according to an exemplary embodiment of this specification.

[0025] Figure 6 is a block diagram of a device for executing an executable file according to an exemplary embodiment of this specification. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0026] Since shell scripts are readable and writable and stored in plain text, there are significant security risks. For example, their readable and writable nature may allow attackers to maliciously modify the content of shell scripts to change their original intended purpose. For instance, an attacker could tamper with a shell script, and after the tampering, it might cause the system to crash or exhibit unpredictable behavior, affecting the normal operation of the system. The plain text storage method of shell scripts can also leak sensitive information such as usernames, passwords, paths, IP addresses, etc.

[0027] To address the above issues, this specification provides a method for generating an executable file and a method for executing the executable file to achieve the purpose of protecting shell scripts.

[0028] Next, the embodiments of this specification will be described in detail.

[0029] Figure 1 is a flowchart of a method for generating an executable file shown according to an exemplary embodiment of this specification, as Figure 1 shown, including steps 101 - 102:

[0030] Step 101: Perform security processing on the shell script to be protected to obtain a secure text, and determine the execution code corresponding to the secure text.

[0031] Step 102: Generate a source file based on the secure text and the execution code, and compile the source file into an executable file; wherein, when the executable file is executed, the execution code is used to reverse - process the secure text into the shell script and execute the shell script.

[0032] The shell script to be protected can be a shell script file generated by integrating any system commands. For example, it can be a bash script in the Linux system, or a shell script in other systems such as the Mac system, etc. This specification does not limit the type of shell script. The content presentation of the shell script to be protected can be in plain text and contains sensitive information and / or critical instructions for operating the operating system. For example, the shell script to be protected contains sensitive information such as database passwords, API keys, user credentials, etc. If this information is leaked, it may lead to security vulnerabilities or misuse. Critical instructions include, for example, file deletion, user privilege management, system configuration changes, backup and recovery instructions, etc. If the script is tampered with or misused, it may cause the system to crash or data loss.

[0033] To protect the privacy and security of the shell script content and prevent the attacked party from arbitrarily tampering with and understanding the data, the shell script to be protected can be converted into an incomprehensible and tamper-proof secure text through security processing. Among them, the security processing can specifically be the encryption processing of the shell script content, such as converting the original shell script content into ciphertext that is difficult to crack; the confusion of the content order of the shell script, such as adjusting the order of different parts of the shell script to increase the cracking difficulty; the content confusion of the sensitive information of the shell script, such as replacing the key sensitive information with meaningless and difficult-to-understand information. It should be noted that this specification does not limit the specific manner of security processing, as long as it can achieve the purpose of preventing the attacker from arbitrarily tampering with and understanding.

[0034] In one embodiment, performing security processing on the shell script to be protected to obtain a secure text can specifically be encrypting the shell script using a key to obtain an encrypted script, and then performing encoding processing on the encrypted script to obtain an encoded text. After performing segmentation processing on the encoded text and the key, a secure text is obtained, and the segmentation processing can include adjusting the positional relationship of different parts of the encoded text and the key.

[0035] Exemplarily, the key can be a key obtained based on an existing encryption algorithm. Generate a key based on the encryption algorithm, and use the key to encrypt the shell script to obtain an encrypted script. The existing encryption algorithm can be the AES (Advanced Encryption Standard) algorithm. However, using the existing encryption algorithm requires preparing an encryption and decryption library interface environment related to the encryption algorithm in the operating system where the shell script to be protected is located, which undoubtedly increases the operation cost of the user.

[0036] To address the above problems, this specification provides a private encryption method that does not require preparing an encryption and decryption interface environment related to the encryption algorithm in the operating system, thereby reducing the operation cost of the user. Exemplarily, after obtaining at least part of the characters in the shell script, perform encoding processing on the at least part of the characters to obtain a key, and use the key to perform XOR encryption processing on the shell script to obtain an encrypted script. Specifically, the file character length of the shell script to be protected can be obtained, the first 1 / 4 characters and the last 1 / 4 characters of the shell script can be obtained, and after merging the two, perform encoding processing to obtain a key. Use the key to perform XOR encryption processing on the shell script to obtain an encrypted script. Among them, the XOR encryption processing can include an encryption processing method based on the XOR (Exclusive OR Encryption) encryption method.

[0037] Exemplarily, the encoding process can be an encoding method for converting binary data into printable characters to facilitate the storage of binary data in a text environment. The encoding process can specifically be base64 encoding. By converting the key and the encryption script into the base64 encoding format, the key and the encryption script can be converted into a character format that is easy to store and split. Then, by performing a splitting process on the encoded text and the key, the positional relationship of different parts of the encoded text and the key can be adjusted. In this embodiment, by scrambling the text order of the key and the encrypted text, the reverse difficulty can be further increased, which is beneficial to improving the protection strength of the shell script.

[0038] In one embodiment, the execution code corresponding to the secure text can be determined, a source file can be generated based on the secure text and the execution code, and the source file can be compiled into an executable file. Among them, when the executable file is executed, the execution code is used to reverse process the secure text into a shell script and execute the shell script. The code logic of the execution code can be divided into two parts. The first part of the code logic is used to implement the reverse process of the secure text into the original shell script, and the second part of the code logic is used to execute the shell script. The specific code logic can be to call the shell interpreter to execute the shell script. It should be noted that different programming languages can be used to implement the code logic of the execution code, such as programming languages like C, C++, etc. This specification does not impose any restrictions on the programming languages for implementing the code logic.

[0039] Exemplarily, when performing security processing on the shell script to be protected to obtain the secure text, determining the execution code corresponding to the secure text, and generating a source file based on the secure text and the execution code, specifically, a predefined template code can be obtained. The template code includes security processing code, reverse processing code, and interpreter call code. The security processing code is used to securely process the shell script to be protected into the secure text, the reverse processing code is used to reverse process the secure text into a shell script, and the interpreter call code is used to execute the shell script. Execute the security processing code to securely process the shell script to be protected into the secure text, obtain the reverse processing code and the interpreter call code, and merge the reverse processing code, the interpreter call code, and the secure text to obtain the source file.

[0040] It should be noted that the security processing code and the reverse processing code are in a reverse relationship. The reverse processing code is the reverse processing process of the security processing code. The security processing code is used to securely process the shell script to be protected into a secure text, and the reverse processing code is used to reverse process the secure text into the shell script to be protected. For example, the processing logic of the security processing code may include generating a key, encrypting the shell script, and splitting the encrypted shell script and the key; while the processing logic of the reverse processing code may include merging the split shell script and the key to obtain the restored encrypted script and the key respectively, and decrypting the restored encrypted script with the key to obtain the decrypted shell script.

[0041] In one embodiment, when there is an input parameter list in the shell script, in order to ensure that the executable file can receive the input parameters passed by the user when it is executed, just like the shell script when it is executed. When there is an input parameter list in the shell script, the input parameter list can be obtained, and when the shell script is executed, the input parameter list can be passed to the interpreter that executes the shell script, and the return value after the interpreter executes the shell script can be received and output. The executable file in this embodiment is compatible with the input parameter list of the shell script to be protected. From the perspective of external users, the execution effect is the same as that of the original shell script. Both can input parameters in the command line and output the return value after the shell script is executed to the user in the command line.

[0042] In one embodiment, after the source file is compiled into an executable file, the symbol table and debug information in the executable file can be cleared. The symbol table and debug information usually contain information about the source code structure and variable names. Clearing the symbol table and debug information is beneficial to enhancing security and preventing the execution code from being analyzed by reverse engineering. Similar to the purpose of securely processing the shell script to be protected, this embodiment can also perform security processing on the execution code to prevent the execution code from being analyzed by reverse engineering.

[0043] Figure 2 is a flowchart of an execution method of an executable file shown in this specification according to an exemplary embodiment, as Figure 2 shown, including steps 201-202:

[0044] Step 201: In response to the execution of the executable file, call the execution code to reverse process the secure text in the executable file into a shell script.

[0045] Step 202: Execute the shell script, where the executable file is compiled from a source file, and the source file includes the execution code and the security text, and the security text is obtained after the shell script is securely processed.

[0046] In this embodiment, on the one hand, the content of the executable file is the binary security text and the execution code. It is difficult for an attacker to tamper with or understand the security text (the securely processed shell script), thus effectively protecting the content of the shell script. On the other hand, the executable file can seamlessly replace the original shell script. When the executable file is executed, its execution effect is the same as that of directly executing the original shell script from the perspective of external use, and the user's operation experience remains unchanged. Moreover, the executable file generated in this embodiment is compiled from the source file, and the internal execution reverse processing and the logic of calling the shell interpreter are implemented without relying on a specific running environment, which can simplify the security maintenance of the shell script.

[0047] In one embodiment, in response to the execution of the executable file, the execution code is called in the main process to reverse process the security text in the executable file into a shell script, and the shell interpreter is called in the derived subprocess to execute the shell script, and the execution result returned by the shell interpreter is passed to the main process, so that the main process can output the execution result to the command line. Optionally, in response to the execution of the executable file, the status of the main process can be monitored, and when it is detected that the main process is in the debug state, the main process can be exited to prevent the operation logic from being snooped. Specifically, a tracing detection tool can be used to trace the debug state.

[0048] Figure 3 This is a schematic diagram of the generation process of an executable file shown in this specification according to an exemplary embodiment. As Figure 3 shown, the generation device 31 of the executable file can be encapsulated with Figure 1The execution logic of the method for generating an executable file. The executable file generation device 31 can be developed into a Web application. Users can upload the shell script 30 to be protected to the Web application and download the executable file 32 generated by the Web application. Of course, the executable file generation device 31 can be developed into services such as an APP, a command-line tool, an API interface, etc. for users to use. This specification does not limit the application method of the executable file generation device 31. This specification does not limit the type of shell script. The executable file generation device 31 can process shell scripts of any system. For example, it can be a bash script in the linux system or a shell script in the macos (Macintosh Operating System) system.

[0049] In an exemplary application scenario, the content presentation form of the shell script 30 to be protected can be plain text, and other users can easily open and tamper with the script content therein. The user can input the shell script 30 to be protected into the executable file generation device 31, and the executable file 32 can be generated through the executable file generation device 31. Since the content of the shell script recorded in the executable file 32 cannot be easily tampered with, the shell script 30 can be effectively protected. For example, the file name of the shell script 30 to be protected is hello, and it stores plain text shell commands and sensitive data internally. After the shell script 30 to be protected is converted through the executable file generation device 31 to obtain the executable file 32, the shell script 30 can be replaced with the executable file 32. The file name of the executable file 32 can be the same as that of the shell script to be protected, both being hello, so as to facilitate seamless replacement with the shell script 30 to be protected. When the user runs the executable file 32 and the shell script 30 to be protected, the file name "hello" is input in the command line. However, the execution effect of running the executable file 32 is the same as that of running the shell script 30 to be protected. Therefore, for the user, the operation method does not change, and the shell script can be effectively protected without changing the user's original operation habits.

[0050] Corresponding to the foregoing method embodiments, this specification also provides embodiments of a device and the terminal to which it is applied.

[0051] Figure 4 It is a schematic structural diagram of an electronic device shown according to an exemplary embodiment of this specification. As Figure 4As shown, at the hardware level, the electronic device 400 includes a processor 402, an internal bus 404, a network interface 406, a memory 408, and a non-volatile memory 410. Of course, it may also include other hardware required for other services. One or more embodiments of this specification can be implemented in software. For example, the processor 402 reads the corresponding computer program from the non-volatile memory 410 into the memory 408 and then runs it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic module, but can also be hardware or a logic device.

[0052] Figure 5 is a block diagram of a generating device for an executable file shown in accordance with an exemplary embodiment of this specification. As Figure 5 shown, the device can be applied to an electronic device 400 as shown in Figure 4 to implement the technical solution of this specification. The device includes:

[0053] A security processing module 502, configured to perform security processing on the shell script to be protected to obtain a security text, and determine an execution code corresponding to the security text;

[0054] An executable file generating module 504, configured to generate a source file according to the security text and the execution code, and compile the source file into an executable file; wherein, when the executable file is executed, the execution code is used to reverse process the security text into the shell script and execute the shell script.

[0055] Optionally, the security processing module 502 is specifically configured to encrypt the shell script with a key to obtain an encrypted script, and perform encoding processing on the encrypted script to obtain an encoded text; perform splitting processing on the encoded text and the key to obtain a security text, and the splitting processing includes adjusting the positional relationship of different parts of the encoded text and the key.

[0056] Optionally, the security processing module 502 is specifically configured to obtain at least some characters in the shell script, perform encoding processing on the at least some characters to obtain a key, and perform exclusive-or encryption processing on the shell script with the key to obtain an encrypted script.

[0057] Optionally, the device further includes a template code acquisition module 508, configured to acquire predefined template codes, where the template codes include security processing codes, reverse processing codes, and interpreter call codes. The security processing codes are used to securely process a shell script to be protected into a secure text, the reverse processing codes are used to reverse process the secure text into the shell script, and the interpreter call codes are used to execute the shell script. The security processing module 502 is specifically configured to securely process the shell script to be protected to obtain a secure text. The executable file generation module 504 is specifically configured to acquire execution codes, and merge the execution codes with the secure text to obtain a source file; the execution codes include reverse processing codes and interpreter call codes.

[0058] Optionally, the device further includes an input parameter list extraction module 506, configured to, when there is an input parameter list in the shell script, acquire the input parameter list, and pass the input parameter list to an interpreter that executes the shell script when the shell script is executed.

[0059] Figure 6 is a block diagram of an execution device for an executable file shown in this specification according to an exemplary embodiment. As Figure 6 shown, the device can be applied to an electronic device 400 as Figure 4 shown to implement the technical solution of this specification. The device includes:

[0060] A reverse processing module 602, configured to, in response to the execution of the executable file, call execution codes to reverse process the secure text in the executable file into a shell script.

[0061] An execution module 604, configured to execute the shell script; where the executable file is obtained by compiling a source file, the source file includes the execution codes and the secure text, and the secure text is obtained after the shell script is securely processed.

[0062] Optionally, the reverse processing module 602 is specifically configured to, in response to the execution of the executable file, call execution codes in the main process to reverse process the secure text in the executable file into a shell script, and the execution module 604 is specifically configured to, in response to the execution of the executable file, call an interpreter in a derived child process to execute the shell script, and pass the execution result returned by the interpreter to the main process.

[0063] For the specific implementation processes of the functions and effects of each module in the above device, please refer to the implementation processes of the corresponding steps in the above method for details, which will not be elaborated here.

[0064] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the descriptions of the method embodiments. The device embodiments described above are only illustrative. The modules described as separate components may or may not be physically separated. The components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution in this specification. A person of ordinary skill in the art can understand and implement it without creative efforts.

[0065] This specification also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of any of the foregoing executable file generation methods or executable file execution methods provided by this application are implemented.

[0066] Specifically, computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (such as EPROM, EEPROM, and flash memory devices), magnetic disks (such as internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks.

Claims

1. A method for generating an executable file, characterized in that: The method comprises: Perform security processing on the shell script to be protected to obtain a security text, and determine the execution code corresponding to the security text; A source file is generated according to the security text and the execution code, and the source file is compiled into an executable file; wherein, when the executable file is executed, the execution code is used to reverse process the security text into the shell script and execute the shell script.

2. The method according to claim 1, characterized in that The step of performing security processing on the shell script to be protected to obtain a secure text includes: The shell script is encrypted using a key to obtain an encrypted script, and the encrypted script is encoded to obtain an encoded text; The secure text is obtained after segmentation processing of the encoded text and the key, and the segmentation processing includes adjusting the positional relationship between different parts of the encoded text and the key.

3. The method according to claim 2, characterized in that The method of encrypting the shell script using a key to obtain an encrypted script includes: After obtaining at least part of the characters in the shell script, encoding processing is performed on the at least part of the characters to obtain a key, and the shell script is XOR-encrypted using the key to obtain an encrypted script.

4. The method according to claim 1, characterized in that: The method further comprises: Obtain a predefined template code, wherein the template code includes a security processing code, a reverse processing code, and an interpreter calling code, wherein the security processing code is used to securely process the shell script to be protected into a secure text, the reverse processing code is used to reversely process the secure text into the shell script, and the interpreter calling code is used to execute the shell script; The step of performing security processing on the shell script to be protected to obtain a security text comprises: executing the security processing code to securely process the shell script to be protected into a security text; The generating of the source file according to the security text and the execution code includes: obtaining the execution code, and merging the execution code with the security text to obtain the source file; the execution code includes a reverse processing code and an interpreter calling code.

5. The method according to claim 1, characterized in that The method further comprises: In the case where there is an input parameter list in the shell script, the input parameter list is acquired, and when the shell script is executed, the input parameter list is passed to an interpreter that executes the shell script.

6. A method for executing an executable file, characterized in that: The method comprises: In response to the executable file being executed, calling the execution code to reverse process the security text in the executable file into a shell script, and executing the shell script; The executable file is compiled from a source file, the source file includes the execution code and a security text, and the security text is obtained after a shell script is securely processed.

7. The method according to claim 6, characterized in that In response to the executable file being executed, calling the execution code to reverse process the security text in the executable file into a shell script, and executing the shell script, including: In response to the executable file being executed, the execution code is called in the main process to reverse the security text in the executable file into a shell script, and the interpreter is called in the derived child process to execute the shell script, and the execution result returned by the interpreter is passed to the main process.

8. A device for generating an executable file, characterized in that: The device comprises: A security processing module is used to perform security processing on the shell script to be protected to obtain a security text, and determine the execution code corresponding to the security text; An executable file generation module is used to generate a source file based on the security text and the execution code, and compile the source file into an executable file; wherein, when the executable file is executed, the execution code is used to reverse process the security text into the shell script and execute the shell script.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images