IDA microcode-based digital multimeter customized code obfuscator construction method and system

Abstract

The invention relates to the technical field of software security, and discloses an IDA microcode-based digital multimeter customized code obfuscator construction method and system, and the method comprises the steps: carrying out the obfuscation replacement of a measurement algorithm and a data processing method in a digital multimeter code based on an instruction replacement technology; confusing a control flow of the digital multimeter based on a false control flow technology, namely obtaining a calling relation of basic blocks to reconstruct an original program, and avoiding generation of an endless loop in a symbolic execution process through a method of assigning a value to an opaque predicate in advance; randomly modifying variable names, identifiers and function names of the sensitive data information of the digital multimeter based on a variable name confusion algorithm; and carrying out decompilation and code conversion on the obfuscation algorithm based on the IDA microcode, and constructing the digital multimeter customized code obfuscator based on the IDA microcode. The method can be integrated into the development environment of the digital multimeter, the safety protection level of the digital multimeter is improved, and the measurement data is prevented from being illegally stolen.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, and particularly relates to a digital multimeter customized code obfuscator construction method and system based on IDA microcode. BACKGROUND

[0002] With the deepening application of digital and intelligent technology in the construction process of new power systems, the introduction of a large number of multifunctional standard sources, digital multimeters and other intelligent devices makes the power monitoring network more complex. Many terminal devices are connected to the power system through various communication protocols, forming a complex network topology. In particular, as a precise electronic measuring instrument, the digital multimeter is often used to process sensitive data such as high-precision measurement values, calibration parameters or user settings during the measurement process. If these information is obtained by malicious analysts, it will be used for improper purposes, such as manufacturing counterfeit products, tampering with measurement results or other forms of attacks. In this context, the promotion and use of digital multimeters in the power grid face the dual challenges of intellectual property protection and prevention of malicious analysis.

[0003] Therefore, the present application is proposed. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a digital multimeter customized code obfuscator construction method based on IDA microcode, which can increase the difficulty of reverse analysis by converting the target program into a more complex but semantically equivalent obfuscated program.

[0006] To solve the above technical problems, the present application provides the following technical solutions. The digital multimeter customized code obfuscator construction method based on IDA microcode includes: customizing the obfuscation of measurement algorithms, data processing methods, sensitive data and control flow in the digital multimeter code; implementing the obfuscation of the key code of the digital multimeter based on instruction replacement, control flow obfuscation and data obfuscation; and based on IDA microcode, the obfuscation algorithm is decompiled and converted to construct a digital multimeter customized code obfuscator based on IDA microcode.

[0007] As a preferred scheme of the digital multimeter customized code obfuscator construction method based on IDA microcode, the instruction replacement includes replacing the specified instructions of the obfuscation technology for the measurement algorithms and data processing methods in the digital multimeter code.

[0008] The control flow obfuscation method adds false control flow in the control flow of the digital multimeter based on false control flow technology.

[0009] As a preferred scheme of the IDA microcode-based digital multimeter customization code obfuscator construction method, the rule for replacing the instruction is to replace the instruction MOV EAX, EBX with a stack operation to perform data transfer.

[0010] The equal jump is replaced with an unequal skip plus unconditional jump to change the control flow and replace the conditional branch instruction.

[0011] For specific constant multiplication, it is replaced with an address calculation instruction to realize the MULEBX instruction through addition and shift combination.

[0012] As a preferred scheme of the IDA microcode-based digital multimeter customization code obfuscator construction method, the data obfuscation includes uniform identification and modification of program variables, function names, and identifiers of sensitive data of the digital multimeter based on variable name obfuscation technology.

[0013] As a preferred scheme of the IDA microcode-based digital multimeter customization code obfuscator construction method, the false control flow includes parameter initialization of the loop times ObfTimes and the obfuscation probability ObfProbRate through the runOnFunction function, parameter judgment based on the actual control flow of the digital multimeter, and storage of all basic blocks in the flow into a set list container.

[0014] The addBogusFlow function is used to perform obfuscation operation on the basic blocks in the list container, add false control flow, clear the call relationship between the original block and the entry block and the additional block, and increase the jump relationship among the three.

[0015] The doF function is introduced to maintain the effective control flow, and the doF function cooperates with the compiler to optimize the opaque predicate.

[0016] As a preferred scheme of the IDA microcode-based digital multimeter customization code obfuscator construction method, the variable name obfuscation includes setting the original variable name as V original , the original function name as F original , the obfuscated variable name as V obfuscated , and the obfuscated function name as F obfuscated , and the algorithm can be expressed as,

[0017] Generate obfuscated variable name:

[0018] V obfuscated = generateRandomString(n)

[0019] Wherein generateRandomString(n) represents a function of generating a random string of length n;

[0020] Generate obfuscated function name:

[0021] F obfuscated = generateRandomString(n)

[0022] Define obfuscated function, initialize obfuscated variable and call obfuscated function.

[0023] As a preferred scheme of the IDA microcode-based digital multimeter customized code obfuscator construction method, after the decompilation and conversion operation is completed, the instruction replacement technology, the false control flow and the variable name obfuscation algorithm are integrated into the development environment of the digital multimeter, the obfuscator of the customized code is constructed, and the code obfuscation process is completed.

[0024] Another object of the present application is to provide an IDA microcode-based digital multimeter customized code obfuscator construction system.

[0025] As a preferred scheme of the IDA microcode-based digital multimeter customized code obfuscator construction system, the system comprises a conversion and analysis module, an obfuscation execution module and a generation and adaptation module.

[0026] The conversion and analysis module converts the original binary code into an IDA microcode intermediate representation and extracts key information.

[0027] The obfuscation execution module implements obfuscation operations according to preset rules, including variable / function name randomization, control flow obfuscation and hardware compatibility adaptation.

[0028] The generation and adaptation module restores the obfuscated microcode into executable code and ensures compatibility with the hardware functions of the digital multimeter.

[0029] The present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the IDA microcode-based digital multimeter customized code obfuscator construction method when executing the computer program.

[0030] The application provides a computer readable storage medium, which stores a computer program, and the computer program realizes steps of an IDA microcode-based digital multimeter customization code obfuscator construction method when executed by a processor.

[0031] The application has the following beneficial effects: in software development of a digital multimeter, a code obfuscation technique can be used to protect intellectual property rights and prevent malicious analysis. The application provides an innovative digital multimeter customization code obfuscator construction method, which combines an instruction replacement technique, a false control flow and a variable name obfuscation algorithm to customize and obfuscate a measurement algorithm, a data processing method, sensitive data and a control flow and other key parts in digital multimeter code, and uses IDA to perform reverse compilation to convert binary code of the digital multimeter into microcode, thereby constructing an IDA microcode-based digital multimeter customization code obfuscator, improving security of the digital multimeter, protecting intellectual property rights and preventing leakage of sensitive data in a measurement process. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0033] Figure 1 The application provides an IDA microcode-based digital multimeter customization code obfuscator construction method flowchart and a digital multimeter customization code obfuscation flowchart for an embodiment of the application.

[0034] Figure 2 The application provides a digital multimeter false control flow obfuscation schematic diagram of the IDA microcode-based digital multimeter customization code obfuscator construction method for an embodiment of the application. DETAILED DESCRIPTION

[0035] In order to make the above objectives, features and advantages of the application more apparent and understandable, the specific embodiments of the application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative effort should be within the protection scope of the application.

[0036] Embodiment 1, refer to Figure 1 and Figure 2For the first embodiment of the present application, the embodiment provides a digital multimeter customization code obfuscator construction method based on IDA microcode, comprising:

[0037] S1: based on instruction replacement technology, the measurement algorithm and data processing method in the digital multimeter code are replaced.

[0038] Further, the instruction replacement obfuscation technology replaces part of the instructions of the measurement algorithm and data processing method in the digital multimeter code, such as PUSH, SUB, OR, NOT, ROL, etc.

[0039] The control flow obfuscation method is based on the false control flow technology to add false control flow in the control flow of the digital multimeter.

[0040] The data obfuscation method is based on the variable name obfuscation technology to uniformly identify and modify the program variables, function names and identifiers of the sensitive data of the digital multimeter.

[0041] It should be noted that the rule of the instruction replacement technology when replacing is:

[0042] The effect of using stack operation to perform data transfer is replaced by instructions such as MOV EAX, EBX, etc.

[0043] The equal jump is replaced by the method of unequal jump and unconditional jump, which changes the control flow while keeping the logic consistent, and can replace conditional branch instructions such as JE label.

[0044] In a feasible embodiment, changing the control flow can be achieved by combining unequal jump and forced jump, specifically, all JE label (equal jump) instructions in the code are identified and replaced by unequal jump, JE label is replaced by JNE label_false (jump to new label if not equal); unconditional jump JMP label is added after the JNE instruction to ensure that the original logic does not change, and a new label label_false is added, which points to the code after the original label, ensuring that the program execution path is consistent with the original logic, but the control flow structure is more complex.

[0045] In another feasible embodiment, changing the control flow can also be achieved by multi-condition composite jump, specifically, a redundant condition judgment is inserted before the original conditional jump, and an irrelevant comparison instruction (such as CMP ECX, 0) is added, the original condition is combined with the redundant condition, for example, using logical AND (AND) or logical OR (OR); JE label is replaced by a jump based on composite conditions (such as JZ combined_label), and a new label combined_label is added, which contains branch processing of the original logic and the redundant condition.

[0046] For specific constant multiplication, replace with more complex address calculation instructions, such as MUL EBX instruction by combination of addition and shift. The specific process of calculating A x B by combination of addition and shift is as follows:

[0047] (1) initialize the result register: initialize the result register (such as EAX) to 0;

[0048] (2) decompose the multiplier bit by bit: start from the lowest bit (LSB) of the multiplier B, check each bit whether it is 1 or not. If the current bit is 1, add the value of the current multiplicand A to the result register;

[0049] (3) shift operation: after processing each bit, left shift the multiplicand A by 1 bit (equivalent to multiplying by 2) to process the next bit weight. At the same time, right shift the multiplier B by 1 bit (equivalent to dividing by 2) to check the next bit;

[0050] (4) loop until the multiplier is 0: repeat (2) and (3) until all bits of the multiplier B are processed (i.e. B = 0).

[0051] S2: reconstruct the call relationship of the basic block, and avoid the generation of dead loop in the symbolic execution process by assigning values to opaque predicates in advance.

[0052] Further, the runOnFunction function is used to initialize the parameters of the loop count ObfTimes and the confusion probability ObfProbRate (i.e. the value of ObfTimes is initialized to 1, and the value of ObfProbRate is initialized to 30%), and the actual control flow of the digital multiplex table is used to judge the parameters (the condition for setting the validity check to pass is that the loop count is greater than 0, and the confusion probability is between 0-100, otherwise it is reset to the initial value), and all the basic blocks in the flow are stored in the set list container;

[0053] The addBogusFlow function is used to perform confusion operation on the basic blocks in the list container, and the virtual control flow is added by adding an entry block, modifying the operation instruction (i.e. modifying the operation instruction by instruction substitution, constant substitution and using opaque predicates), and then clearing the call relationship between the original block and the entry block and the additional block, and adding the jump relationship among the three, wherein the way to add the jump relationship includes: inserting a basic block that will never be executed, interfering with the attacker's control flow analysis; constructing a conditional expression that cannot be identified by static analysis tools, preserving the false jump; copying the basic block and adding a random jump to increase the complexity of the control flow;

[0054] In one possible embodiment, the jump relationship can be added by inserting a static unreachable block, specifically, by static analysis to determine the frequently executed basic block in the function (such as the loop body), a basic block containing invalid operations (such as NOP or redundant calculation) is created, a conditional jump to the false block (such as JMP fake_block) is added before the original block, the condition is always false (such as JMP if1==0); Ensure that the false block does not modify the key register or memory, and finally jump back to the original flow.

[0055] In another possible embodiment, the jump relationship can also be added by dynamic random jump insertion, specifically, multiple copies of the original basic block (such as BlockB1, BlockB2) are generated, a random number generation instruction (such as RDRAND EAX) is added after the original block, and different copies are jumped to according to the random number result (such as JNZ BlockB1 or JZ BlockB2); All copies jump to the same subsequent block (such as Block C), ensuring logical consistency.

[0056] Introducing the doF function ensures that the obfuscated function still maintains an effective control flow after compilation, while the doF function can cooperate with the compiler to optimize opaque predicates, the specific process is:

[0057] Identify the conditional jump relationship constructed by opaque predicates in the false control flow; optimize the unreachable basic block and false jump to ensure the correctness of the program logic while improving the code execution efficiency; Adjust the jump relationship in the false control flow to eliminate redundant jumps and unreachable code and reduce runtime overhead.

[0058] S3: The sensitive data information of the digital multiplexer is randomly modified by the variable name obfuscation algorithm.

[0059] Further, the core formulaic expression of the variable name obfuscation algorithm is as follows:

[0060] Let the original variable name be V original , the original function name be F original , the obfuscated variable name be V obfuscated , and the obfuscated function name be F obfuscated , then the algorithm can be expressed as:

[0061] Generate an obfuscated variable name:

[0062] V obfuscated = generateRandomString(n)

[0063] Where generateRandomString(n) represents a function that generates a random string of length n;

[0064] Generate obfuscated function name:

[0065] F obfuscated = generateRandomString(n)

[0066] Define obfuscated function:

[0067] window[F obfuscated ] = function() { console.log("Hello," + window[V obfuscated1 ]

[0068] + "You are " + window[V obfuscated2 ] + " years old.")} Initialize obfuscated variable:

[0069] window[V obfuscated1 ] = "Alice"

[0070] window[V obfuscated2 ] = 30

[0071] Call obfuscated function:

[0072] window[F obfuscated ]()

[0073] The partial pseudo code of the variable name obfuscation algorithm is as follows:

[0074] / / Suppose the source code is

[0075]

[0076]

[0077] S4: Based on the IDA microcode, the obfuscation algorithm is decompiled and converted, and a digital multiplex table customized code obfuscator based on the IDA microcode is constructed.

[0078] Further, after the decompilation and conversion operation is completed, the instruction replacement technology, the false control flow and the variable name obfuscation algorithm are integrated into the development environment of the digital multiplex table, a customized code obfuscator is constructed, and the code obfuscation process is completed.

[0079] Embodiment 2, which is an embodiment of the present application, provides an IDA microcode-based digital multiplex table customized code obfuscator construction method, in order to verify the beneficial effects of the present application, scientific demonstration is carried out through experiments.

[0080] Based on the 5 calling functions in the public data set C / C++ obfuscation benchmark, the obfuscator and the obfuscation method thereof are experimented, and the performance of the obfuscation method is evaluated from the pseudo code similarity, semantic equivalence, and control flow chart similarity, and the experimental results are shown in Table 1.

[0081] Table 1: Obfuscation method performance evaluation table

[0082]

[0083]

[0084] From the experimental results, it can be seen that the code modules of the 5 functions after obfuscation have particularly low pseudo code similarity with the original structure, and the semantic equivalence is all 1.000, and the control flow chart similarity is also high, which shows that the obfuscation method of the present application can hide the original code of the original function module while not changing the function performance and control flow of the initial code after operations such as instruction replacement, false flow control, and variable name obfuscation, which proves that the present application can effectively resist attack threats in the environment in the application of digital multimeter.

[0085] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and they should be covered in the scope of the claims of the present application.

[0086] Embodiment 3, which is different from the first two embodiments, is a third embodiment of the present application.

[0087] If the function is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0088] The logic and / or steps represented in flow diagrams or otherwise described herein, for example, can be considered as a sequence of executable instructions, and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber (optical), and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example via an optical scanner, then compiled, interpreted, or otherwise processed, and stored in a computer memory in a form that can be later executed by a computer. In this context, a "computer-readable medium" can be any means that can store the program for use by or in connection with the instruction execution system, apparatus, or device.

[0089] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber (optical), and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example via an optical scanner, then compiled, interpreted, or otherwise processed, and stored in a computer memory in a form that can be later executed by a computer.

[0090] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, various steps or methods can be implemented, for example, using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following techniques, which are well known in the art of making integrated circuits, can be used alone or in combination to implement the application: discrete logic circuitry having logic gates for implementing logic functions upon an application of data signals; application specific integrated circuits having appropriate combinational logic gates; programmable gate arrays (PGA), field programmable gate arrays (FPGA), and so forth.

[0091] Embodiment 4, as an embodiment of the present application, provides an IDA microcode-based digital multimeter customization code obfuscator construction system, including a conversion and analysis module, an obfuscation execution module, a generation and adaptation module;

[0092] The conversion and analysis module converts the original binary code into an IDA microcode intermediate representation and extracts key information;

[0093] The obfuscation execution module implements obfuscation operations according to preset rules, including variable / function name randomization, control flow obfuscation, and hardware compatibility adaptation;

[0094] A generation and adaptation module restores the obfuscated microcode to executable code and ensures compatibility with the digital multimeter hardware functionality.

[0095] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for constructing a customized code obfuscator for a digital multi-table based on IDA microcode, characterized by: include, Customized obfuscation is performed on the measurement algorithms, data processing methods, sensitive data, and control flow in the code of digital multimeters; Obfuscate the critical code of the digital multimeter using instruction substitution, control flow obfuscation, and data obfuscation. Based on IDA microcode, we decompile and convert obfuscation algorithms to build a customized code obfuscator for digital multi-tables.

2. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 1, characterized in that: The instruction replacement includes replacing obfuscation techniques with instructions for defining measurement algorithms and data processing methods in the code of a digital multimeter. The control flow obfuscation method adds a false control flow to the control flow of a digital multimeter based on the technique of creating a false control flow.

3. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 2, characterized in that: The rule for instruction replacement is to use stack operations to perform data transfer and replace the instruction MOVEAX,EBX; Replace the equality jump with the inequality jump followed by an unconditional jump, thereby changing the control flow and replacing the conditional branch instruction. For specific constant multiplications, the address calculation instruction is replaced, and the MUL EBX instruction is implemented by combining addition and shifting.

4. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 3, characterized in that: The data obfuscation includes uniformly identifying and modifying program variables, function names, and identifiers of sensitive data in a digital multi-function table based on variable name obfuscation technology.

5. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 4, characterized in that: The spoof control flow includes initializing the loop count ObfTimes and confusion probability ObfProbRate through the runOnFunction function, judging the parameters based on the actual control flow of the digital multimeter, and storing all basic blocks in the flow into a set list container. The addBogusFlow function is used to perform obfuscation on the basic blocks in the list container, adding fake control flow, clearing the call relationship between the original block and the entry block and the extra block, and then adding the jump relationship between the three. The doF function is introduced to maintain efficient control flow, and at the same time, the doF function works with the compiler to optimize opaque predicates.

6. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 5, characterized in that: The variable name obfuscation includes, for example, assuming the original variable name is V. original The original function name is F original The obfuscated variable name is V obfuscated The obfuscated function name is F obfuscated The algorithm can then be expressed as follows: Generate obfuscated variable names: V obfuscated =generateRandomString(n) The function generateRandomString(n) generates a random string of length n. Generate obfuscation function name: F obfuscated =generateRandomString(n) Define an obfuscation function, initialize obfuscation variables, and call the obfuscation function.

7. The method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in claim 6, characterized in that: After the decompilation and conversion operations are completed, instruction substitution technology, fake control flow and variable name obfuscation algorithms are integrated into the development environment of the digital multimeter to build a custom code obfuscator and complete the code obfuscation process.

8. A system employing the method for constructing a customized code obfuscator for a digital multitable based on IDA microcode as described in any one of claims 1 to 7, characterized in that: It includes a conversion and analysis module, an obfuscation execution module, and a generation and adaptation module; The conversion and analysis module converts the original binary code into an IDA microcode intermediate representation and extracts key information; The obfuscation execution module performs obfuscation operations according to preset rules, including variable / function name randomization, control flow obfuscation, and hardware compatibility adaptation. The generation and adaptation module restores the obfuscated microcode to executable code and ensures compatibility with the hardware functions of the digital multimeter.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method for constructing a digital multisheet-based custom code obfuscator based on any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for constructing a digital multisheet custom code obfuscator based on IDA microcode as described in any one of claims 1 to 7.

Images