Obfuscation and anti-reversing protection method and device based on rop chain and opaque predicate

Abstract

The embodiment of the application provides a kind of based on ROP chain and the method and device of obfuscation and anti-reverse protection of opaque predicate, this scheme proposes a kind of three-order obfuscation protection framework of combining ROP instruction dynamic reconstruction, opaque predicate protection, instruction semantic hiding, after the ordinary C / C++ source code is compiled into LLVM intermediate representation IR, dynamic extraction Gadget and opaque predicate combination based on user input state are used, the deep level semantic disturbance of key logic block, jump structure, constant field of program is realized. To completely break the control flow restoration chain, it is difficult for reverse personnel to analyze the obfuscation result, realize the controllable, verifiable, high-stability obfuscation protection of program, while maximizing resistance to symbolic execution and static analysis and other advanced analysis techniques.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a method and apparatus for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates. Background Technology

[0002] For a long time, with the intelligent evolution of static reverse engineering tools, symbolic execution engines, and fuzzing frameworks in security analysis and vulnerability discovery, traditional protection mechanisms (such as string encryption, variable name obfuscation, and basic Black-Browser (BB) jump disruption) have become increasingly difficult to defend against reverse engineers with semantic reconstruction or path discovery capabilities. Advanced obfuscation frameworks have become necessary to effectively resist automated analysis techniques such as Dynamic Symbolic Execution (DSE), Control-Flow Recovery, and Symbolic Constant Folding.

[0003] Specifically, attackers can leverage symbolic execution to enforce design constraints, restore jump logic, use stack traces to locate sensitive information, or bypass control protection mechanisms through algorithm replacement. Therefore, source code or binary-level protection needs to encompass the following aspects:

[0004] 1. Irreversibility of the path: The program control flow path is irreversible for the analysis engine;

[0005] 2. Constants and data cannot be materialized: The addresses, registers, and constants involved in instruction operations cannot be easily decrypted or replaced;

[0006] 3. Context-sensitive: Hides the control path from depending on the input context state, breaking the single-path exhaustive approach;

[0007] 4. Maintain semantic consistency while obfuscating: Any obfuscation transformation cannot change the actual semantics between input and output.

[0008] However, with the development of reverse engineering tools, binary programs output by standard compilers are almost powerless against automated reverse engineering tools. Tools such as IDAPro and BinaryNinja, combined with symbolic execution engines (such as KLEE and angr) and path crawling tools (such as Driller and Mayhem), can easily reconstruct the program's execution flow and core variables, far exceeding the capabilities of analysis tasks previously relying solely on manual effort. Therefore, program obfuscation techniques have been proposed as a reverse engineering countermeasure and are widely studied.

[0009] Traditional obfuscation methods can be broadly categorized into three types:

[0010] The first category is based on syntax-level structural transformations. This type of obfuscation uses methods such as variable name substitution, dead code insertion, and conditional transformations (e.g., rewriting `if(a)` as `if((a&&true)||false))` to alter the readability of the code at the source code level. Representative tools include the source code manipulation module in Obfuscator-LLVM and the Java class obfuscator ProGuard. While these methods can increase readability to some extent, they are easily restored by AST abstraction tools and offer no help for dynamic analysis.

[0011] The second category is based on methods that disrupt the control flow graph (CFG). These include reordering basic blocks, inserting pseudo-logic for conditional jumps, and distorting return address calculations. These methods attempt to make the control flow graph appear disjointed in the target binary, thus compromising the flow recovery capabilities of static analysis. Common techniques include OLLVM's Bogus Control Flow and Flattening. While effective against simple directed lookups, they have limited effectiveness against control flow inference engines with path recovery capabilities (such as CFG Rebuilder).

[0012] The third category is dynamic obfuscation mechanisms based on path conditions. These methods actively design program logic to ensure different execution paths are taken under different input conditions, and these logical constructs contain opaque logical judgments and calculations that are difficult to reason about. Examples include opaque predicates, hard-coded data transfer, and function template embedding mechanisms. Although the logical complexity is high, the computational overhead is also significant.

[0013] Currently, the method closest to the present invention includes:

[0014] 1. OLLVM (Obfuscator-LLVM) is an obfuscation and hardening module based on the LLVM compiler. It supports various obfuscation strategies such as Bogus Control Flow, Control Flow Flattening, and Instruction Substitution. This tool can perform static obfuscation on Indirect Representations (IRs). However, it lacks dynamic support for Representation on Programming Objects (ROPs) and does not consider the system integration of strategies against opaque predicate and symbolic execution attacks.

[0015] 2. Tigress: Tigress is an advanced obfuscation and virtualization protection system that supports various control flow transformations and function virtual machine replacements. It primarily relies on function extraction and runtime offsets to execute code logic, which is costly and prone to focusing on function boundaries for attack analysis. It does not support polymorphic structures in Gadget fragments.

[0016] 3. The O-LLVM + Kaleidoscope strategy combination was used in some high-adversarial environment projects to combine OLLVM and ROP chain-level instrumentation tools to obfuscate the process, extract the machine code ROP chain, and insert it into specific functions to partially hide the command chain. However, this method did not achieve a complete closed transformation of the control flow structure and lacked an opaque predicate protection mechanism, making it extremely vulnerable to being dechained and restored line by line by a symbolic execution engine.

[0017] 4. Unsolvable Logic Protection Methods Based on 3SAT and RSA Factorization: This is a logic protection strategy proposed by some academic research institutes. It introduces NP-hard problems (such as Composite Number Factorization) to construct opaque expressions and generate conditional jumps. Although it has ideal theoretical protection capabilities, it does not provide deployable system modules and has significant semantic differences from declarative code, resulting in poor development and implementation.

[0018] Therefore, while traditional obfuscation techniques have slowed down reverse engineering to some extent, they fall short when dealing with modern automated analysis tools. The following is a summary of the systemic shortcomings of existing major methods:

[0019] First, source code-level obfuscation techniques (such as variable substitution and statement refactoring) are ineffective against semantic analysis tools. These methods only tamper with symbolic representations and do not affect the intermediate representation of the program (such as LLVM IR) or the final machine code. Therefore, they are almost ineffective against tools such as AST reflection, data flow reconstruction, and control logic unrolling.

[0020] Secondly, control flow perturbation methods have limited impact on static CFGs and are difficult to interfere with dynamic path symbolic execution tools. Current control flow topology flattening and pseudo-jump expansion mechanisms can be used with symbolic path decoupling tools such as angr for step-by-step reasoning and path expansion, and the execution sequence can be dynamically reconstructed, forming an effective restoration attack path.

[0021] Third, current mainstream implementations of opaque predicates do not incorporate path context semantic design, making them easily bypassed by symbolic execution engines. Because they lack truly "computationally difficult" mathematical logic or contextual variability in input conditions, opaque predicates are often evaluated as dead code and skipped by symbolic execution, thus losing their control flow protection effect.

[0022] Fourth, the lack of integration of the ROP mechanism as a code self-disruption method results in a lack of physical-level obfuscation capabilities. The ROP mechanism inherently possesses the ability to perform generalized instruction refactoring. If utilized in a positive direction, it can achieve cross-module mapping rearrangement of semantically mapped instructions while maintaining the semantic fidelity of the target instruction, significantly increasing the reverse engineering barrier.

[0023] Based on this, the present invention proposes a three-order obfuscation protection framework that combines ROP instruction dynamic reconstruction, opaque predicate protection, and instruction semantic hiding. Summary of the Invention

[0024] To address the problems in the existing technology, this application provides a method and apparatus for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates, which completely breaks the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0025] To solve at least one of the above problems, this application provides the following technical solution:

[0026] Firstly, this application provides a method for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates, including:

[0027] Obtain the source code of the target program and convert it into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to;

[0028] Instruction fragments are extracted from the shared library file and the LLVM IR code, and the instruction sequences are concatenated together to form a ROP chain according to the logic of the target program; the ROP chain is used to replace some of the original instructions of the LLVM IR code to obtain the assembly instruction stream;

[0029] An opaque predicate is constructed and inserted into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes a nested structure of context judgment logic and constant control instructions.

[0030] The obfuscated code is sent to an assembler to be converted into assembly language code, and scheduling instructions are inserted into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0031] Furthermore, the step of obtaining the source code of the target program and converting the source code into an LLVM intermediate representation to obtain LLVM IR code includes:

[0032] The compiler receives the source code and preprocesses it; the preprocessing includes macro expansion and file inclusion processing.

[0033] The source code is subjected to lexical and syntactic analysis using a compiler, and the source code is converted into an abstract syntax tree;

[0034] An encoder is used to perform semantic checks on the abstract syntax tree; the semantic checks include parsing the abstract syntax tree for variables, functions, and types.

[0035] The compiler extracts the LLVM IR from the abstract syntax tree and generates a .ll file, which contains the LLVM IR code.

[0036] Furthermore, the step of extracting instruction fragments from the shared library file and the LLVM IR code, and concatenating the instruction sequences together to form a ROP chain according to the logic of the target program, includes:

[0037] The shared library file and the LLVM IR code are scanned using reverse engineering tools to obtain all ret instructions, and code snippets containing ret instructions are extracted from them to obtain instruction snippets.

[0038] Analyze the control flow of the target program to identify target areas in the target program that can be attacked using ROP;

[0039] According to the logic of the target program, instruction fragments that can replace the target region are selected, and the selected instruction fragments are spliced ​​together in a specific order to form the ROP chain.

[0040] Furthermore, the step of replacing a portion of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream includes:

[0041] Analyze the stack structure of the target program and load the ROP chain into the stack in reverse order;

[0042] Modify the pointers and return address on the stack so that the target program can jump to the correct instruction segment every time it executes the ret instruction.

[0043] Furthermore, the step of constructing an opaque predicate and inserting the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code includes:

[0044] Choose a logical expression that is difficult to parse, and construct a Boolean expression based on the logical expression, which is always true or false under different input conditions;

[0045] The opaque predicate is inserted into the assembly instruction stream by modifying the jump instructions of the assembly instruction stream;

[0046] After the step of constructing an opaque predicate and inserting the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code, the method further includes: inserting neutral code into the obfuscated code; the neutral code includes: NOP instructions, data move instructions, no-operation, and dead code segments.

[0047] Furthermore, the step of transmitting the obfuscated code to an assembler to be converted into assembly language code, and inserting scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code includes:

[0048] The obfuscated code is converted into assembly language code using an assembler, and the operators in the obfuscated code are mapped to the instruction set of the target machine to ensure that the program semantics remain consistent.

[0049] According to the control flow of the target program, scheduling instructions are inserted into the assembly language code; the scheduling instructions are used to instruct the assembly language code how to jump or modify register values ​​during execution.

[0050] Furthermore, after the steps of transmitting the obfuscated code to an assembler to convert it into assembly language code, and inserting scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code, the method further includes the deployment and execution of the final target program code, wherein the deployment and execution of the final target program code includes:

[0051] During program loading, the actual address of each instruction segment in the ROP chain is adjusted according to the base address and symbol offset of the loaded shared library, so that the address of the ROP chain is different each time the program runs.

[0052] During program execution, the scheduler rebuilds the stack structure of the ROP chain and adjusts the data in the stack so that the ret instruction can jump to the correct instruction segment each time.

[0053] During program execution, the memory addresses of the program are randomized using address space layout randomization technology to change the position of the ROP chain and the stack structure.

[0054] Secondly, this application provides an obfuscation and anti-reverse engineering protection device based on ROP chains and opaque predicates, comprising:

[0055] The code conversion module is used to obtain the source code of the target program, convert the source code into an LLVM intermediate representation to obtain LLVM IR code, and load the shared library files that the target program can link to;

[0056] The code assembly module is used to extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; and replace some of the original instructions of the LLVM IR code with the ROP chain to obtain an assembly instruction stream;

[0057] The code obfuscation module is used to construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes a nested structure of context judgment logic and constant control instructions;

[0058] The code generation module is used to transmit the obfuscated code to the assembler to convert it into assembly language code, and insert scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0059] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates.

[0060] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the described obfuscation and anti-reverse protection method based on ROP chains and opaque predicates.

[0061] Fifthly, this application provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates.

[0062] As can be seen from the above technical solution, this application provides a method and apparatus for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates. This solution proposes a three-tiered obfuscation protection framework combining dynamic reconstruction of ROP instructions, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely disrupts the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a flowchart illustrating the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates in the embodiments of this application.

[0065] Figure 2 This is a general framework diagram of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates in the embodiments of this application;

[0066] Figure 3 This is a framework diagram of an embodiment of the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates in this application, which utilizes ROP, opaque predicates, and instruction hiding for obfuscation transformation.

[0067] Figure 4 This is a structural diagram of the obfuscation and anti-reverse protection device based on ROP chain and opaque predicate in the embodiments of this application;

[0068] Figure 5 This is a schematic diagram of the structure of the electronic device in the embodiments of this application.

[0069] Figure label:

[0070] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver storage unit 9144, antenna 9111, speaker 9131, microphone 9132. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0072] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0073] Terminology Explanation

[0074] 1. ROP (Return-Oriented Programming) is an attack method that utilizes code snippets (called "gadgets") ending with the `ret` instruction in existing executable programs (such as shared libraries) to construct malicious logic. ROP chains control the stack return address, sequentially executing multiple gadget logic without introducing new code. They possess high stealth and complexity and are widely used to bypass execution protection mechanisms in modern operating systems. This invention borrows the ROP mechanism for reverse code obfuscation.

[0075] 2. Opaque Predicates: In program obfuscation, opaque predicates are logical expressions whose values ​​are constant (e.g., always 1 or always 0), but whose computation process is complex, unpredictable, or difficult to symbolically infer. They are often used to obfuscate control flow or data constants, making them difficult for static analysis tools to identify and reconstruct the true execution path, thus increasing the difficulty of reverse engineering.

[0076] 3. Dynamic Symbolic Execution (DSE) is a program analysis technique that combines actual execution and symbolic execution, also known as concolic execution. It maintains a symbolic path while running the program on concrete input, primarily used for coverage path discovery and vulnerability exploitation. By reasoning about the relationship between input and program logic, it can effectively execute complex control branches. This invention designs a mechanism to resist DSE interference with analysis accuracy.

[0077] 4. In ROP attack and defense, a Gadget refers to an inline executable micro-fragment (usually 1-2 instructions) extracted from an executable program or shared library and ending with a ret instruction. In this invention, these Gadgets are selected to refactor the program's target logic, disrupting local code coherence while maintaining semantic structural consistency.

[0078] 5. Instruction Hiding: Instruction hiding is an obfuscation technique that embeds the semantics of key instructions into other structures (such as opaque predicates), making the target instructions unrecognizable or difficult to abstract, thereby increasing the difficulty of static and symbolic reconstruction. This invention combines ROP chain structure with opaque predicate logic instrumentation to achieve multi-level instruction semantic protection.

[0079] The design objective of this invention is:

[0080] • Establish a deployable intermediate code obfuscation architecture based on the ROP refactoring mechanism;

[0081] • Enhance the ability to integrate with instruction-level opaque predicates to ensure the unanalyzability of semantics and execution paths;

[0082] • By using dynamic input control methods, the path selection pollution of control branches by symbolic execution such as DSE is blocked;

[0083] • Employing a micro-gadget chain and stack regression mechanism, a new structural obfuscation system is achieved, where control semantics are reversible and the control flow graph is not reconstructable;

[0084] Ultimately, a set of obfuscation frameworks with the capabilities of code instruction-level irreversibility, path conditionalization, and polymorphic instruction delivery protection were created, providing a strong boundary for software security to block reverse engineering analysis and attack implantation.

[0085] In view of the problems existing in the prior art, this application provides a method and apparatus for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates. This scheme proposes a three-tiered obfuscation protection framework combining dynamic reconstruction of ROP instructions, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disturbance of key logic blocks, jump structures, and constant fields of the program. This completely disrupts the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0086] To completely disrupt the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, and to achieve controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis, this application provides an embodiment of an obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates. See [link to implementation details]. Figure 1 The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates specifically includes the following:

[0087] Step S101: Obtain the source code of the target program and convert the source code into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to.

[0088] Optionally, in this embodiment, the Clang compiler can receive the source code written in C / C++ by the developer and convert it into an intermediate representation (IR). This process mainly includes the following steps: Preprocessing: Clang performs preprocessing steps, including macro expansion and file inclusion (#include) processing. Syntax Analysis: Clang converts the source code into an Abstract Syntax Tree (AST) through lexical analysis and syntax analysis. During this process, Clang checks for syntax errors and performs necessary type checks. Semantic Analysis: Clang performs semantic checks on the AST, including the parsing of variables, functions, and types, to ensure that the code conforms to the semantic specifications of C / C++. Intermediate Representation (IR) Generation: LLVM IR is generated using Clang's internal AST. IR is a platform-independent low-level representation that is easy to optimize and subsequently process. The generated LLVM intermediate representation (IR) file is stored in a .ll file for use in subsequent stages.

[0089] During execution, the command-line tool `clang-S-emit-llvm source.c` or a similar command can be used to directly convert C / C++ code into LLVM IR. The output `.ll` file contains the program's logical structure, control flow, and data flow, but does not involve specific hardware details, making it suitable for subsequent cross-platform optimization.

[0090] Step S102: Extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; replace some of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream.

[0091] Optionally, in this embodiment, during Gadget extraction, a disassembler (such as objdump or IDA Pro) can be used to load the target program and potentially associated shared libraries (such as dynamic link libraries). The target program and shared libraries contain usable instruction fragments (Gadgets). Since ROP Gadgets are code fragments composed of multiple instructions, each Gadget typically ends with a ret (return) instruction. Therefore, it is first necessary to scan all ret instructions in the program using a reverse engineering tool (such as ROPgadget, Ropper). Then, code fragments containing ret instructions are extracted from the target program and shared libraries; these code fragments are the Gadgets. The extraction process includes checking the context of the instructions to ensure they perform the expected operation when called. For example, a Gadget might be an instruction like pop eax; ret, which means loading a value into a register via stack operations and returning. When selecting Gadgets, Gadgets suitable for the program's attack target can be chosen, such as those requiring changes to register values ​​or jumps. During selection, it must be ensured that the operation performed by each Gadget is valid and can be executed sequentially in the ROP chain.

[0092] Optionally, in this embodiment, the construction of the ROP chain includes the following steps:

[0093] First, select gadgets based on program logic: Analyze the program's control flow to identify target areas that can be exploited using ROP attacks, such as sensitive areas like function calls and jumps. Based on the target logic, select gadgets that can replace these sensitive operations. For example, use the combination of pop and ret instructions to control data on the stack and change the program's execution path. Use operations like mov or xor to modify registers.

[0094] Next, select appropriate Gadgets. The criteria for selecting Gadgets are: Operational Consistency: Ensure that the operations performed by each Gadget conform to the target logic, such as modifying the correct registers and performing predetermined operations. Control Flow Correctness: Ensure that the execution order and jump order of Gadgets conform to the control flow of the target attack. Avoid Duplication: Avoid selecting Gadgets with redundant functions, and ensure that each Gadget performs independent and necessary operations.

[0095] Finally, the ROP chain is constructed: the selected Gadgets are concatenated in a specific order. This order includes: loading necessary register values: first, loading the target data into registers using a pop operation; executing control jumps: executing a specific code path using a jmp or call operation; and stack repair: gradually returning to the correct execution path using multiple ret operations. Sequence requirements: ensuring the concatenation order allows each operation to be executed in the order required by the program. For example, stack operations need to be inserted from top to bottom to guarantee the correct execution of the ROP chain. The final output is a complete ROP chain containing multiple Gadgets that can execute target operations in sequence.

[0096] This operation replaces the original function call or jump instructions with the corresponding ROPGadget, ensuring that the program logic remains unchanged while disrupting the original execution flow.

[0097] Optionally, in this embodiment, the ROP chain is inserted into the program's execution path using a stack reversal reconstruction method. While the program's functionality remains consistent, the construction of the ROP chain disrupts the local coherence of the code. Specifically, the operation steps are as follows:

[0098] First, analyze the stack structure: ROP attacks change the program's execution path by controlling the stack's return address. Therefore, it's necessary to analyze the target program's stack structure and ensure that the stack is reconstructed in reverse order.

[0099] Then, the ROP chain is reconstructed in reverse order: the selected ROP Gadgets are loaded onto the stack in reverse order. Typically, ROP attacks jump to the malicious code execution path by modifying the return address on the stack. By modifying the pointers and return addresses on the stack, the program can jump to a specific Gadget each time the `ret` instruction is executed, thus constructing a complete ROP chain.

[0100] Finally, push and pop instructions are used to adjust the stack contents, inserting each gadget into the stack to ensure that each gadget can access the correct return address during execution. The resulting reconstructed stack contains the reverse-ordered ROP chain.

[0101] By refactoring using stack reversal, the ROP chain is inserted into the program's execution path. While this maintains the program's functionality, the construction of the ROP chain disrupts the local coherence of the code.

[0102] Step S103: Construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes context judgment logic and a nested structure of constant control instructions.

[0103] Optionally, in this embodiment, the construction of opaque predicates typically relies on expressions that are difficult to statically parse, such as Boolean expressions generated based on NP-hard problems (e.g., large integer factorization, 3SAT). These expressions often obfuscate certain path conditions into unsolvable logical conditions. For example, a complex Boolean expression can be constructed whose value is always true or false under different input conditions, but it is difficult to derive through static analysis. Inserting these opaque predicates into the program's control flow is usually achieved by modifying conditional jump instructions. For example, inserting `if(opaque_predicate){ / / original logic}else{ / / junk code}`.

[0104] Opaque predicates typically appear in the form of conditional statements, but their values ​​are always constant (e.g., always true or always false). Although the result is constant, reverse engineering tools cannot easily identify their true or false values ​​through static analysis because the computation involves complex register operations or indirect logical judgments. Therefore, inserting opaque predicates into conditional jumps, function calls, or data access paths can increase the difficulty for static analysis tools (such as control flow recovery tools) to predict the program execution path.

[0105] Optionally, in this embodiment, neutral code is also inserted into the assembly instruction stream after the opaque predicate is inserted. That is, some invalid operations that have no effect on the program logic are inserted into the program. Common neutral code includes: NOP (NoOperation) instructions: these instructions do not change the program state and are purely for increasing the length of the instruction stream. Data movement instructions without side effects (such as mov) or no-operations, which are used to obfuscate the actual execution path. Dead code segments: even if the code segment has no actual effect during execution, it increases the complexity of the analysis tools.

[0106] These neutral code snippets are typically inserted into programs where control flow is complex, such as before and after function calls, or within loops. This neutral code increases program complexity and execution paths, making static analysis more difficult. By filling in more redundant code, it makes the program harder to trace during execution and increases the difficulty for automated analysis tools (such as disassemblers). To maintain semantic consistency, the inserted instructions do not change the program's final output; they only increase the complexity of static analysis.

[0107] Step S104: The obfuscated code is sent to an assembler to be converted into assembly language code, and scheduling instructions are inserted into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0108] Optionally, in this embodiment, the final obfuscated code is passed to the assembler, and an assembly tool (such as an LLC) is used to convert the obfuscated LLVM IR code into assembly language (.s file), ensuring that the operations of the assembly code are consistent with the original code, i.e., the functionality is not changed. The assembler maps the operators in the IR (such as addition and multiplication) to the instruction set of the target machine, ensuring that the assembly code is consistent with the functionality of the original program, and that the output remains unchanged even if the code structure changes significantly.

[0109] This step inserts scheduling instructions according to the program's control flow. These instructions will instruct the program on how to jump or modify register values ​​during execution, ensuring that the obfuscated parts are smoothly connected and that different obfuscated blocks are always executed in sequence, regardless of how the program's execution path changes, thus ensuring that the program can run normally.

[0110] Optionally, in this embodiment, during program loading, the actual address of each Gadget in the ROP chain is dynamically adjusted based on the shared library base address and symbol offset loaded by the target platform. This can be automatically achieved through the dynamic linking process, ensuring that the ROP chain address is different each time the program runs, increasing the difficulty of predictability.

[0111] During program execution, the scheduler rebuilds the stack structure of the ROP chain as needed. The scheduler is responsible for adjusting the data in the stack as required during execution to ensure that each jump leads to the correct gadget.

[0112] During each program execution, the operating system randomizes the program's memory addresses using ASLR (Address Space Layout Randomization) technology. This causes the location of the ROP chain and the stack structure to change each time the program executes, making it impossible for static analysis tools to predict the program's execution path.

[0113] Adjusting the execution path based on runtime input: The program's execution path is dynamically determined by examining user input or environment variables. Depending on the input, the program will jump to different execution paths, further enhancing its defense against automated analysis tools.

[0114] As described above, the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates provided in this application proposes a three-tiered obfuscation protection framework that combines dynamic reconstruction of ROP instructions, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely disrupts the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0115] refer to Figure 2 As shown, this invention proposes a three-stage obfuscation system for the x86 platform, specifically designed for LLVM intermediate representation (IR), which performs ROP transformation, opaque predicate instrumentation, and fine-grained instruction hiding on the original IR.

[0116] This system introduces instruction-level ROP reconstruction, a semantic link trusted breakage mechanism, and context-aware protection logic, and proposes and implements the following technical approach:

[0117] 1. Using the ROP Transformer, a Gadget fragment of one instruction length is intelligently extracted from the shared library and the scheduling logic is inserted by reconstructing the stack in reverse order.

[0118] 2. Based on the control flow semantic decision engine, combined with 3SAT and the opaque Boolean expression mechanism of factorization, an unsolvable logic predictor is inserted on the semantically equivalent path to block path deconstruction;

[0119] 3. By using an instruction hider, key variables / semantic transformation code are injected into the opaque control section, hiding the logical transformation process to the greatest extent possible while maintaining correct output;

[0120] 4. Introducing a regular derivation function based on user input and finite combination of registers, the symbolic input parameters are pushed into the call heap environment. Without a path combination graph reference, the expected path cannot be accurately deduced.

[0121] The scheduler completes the construction of the ROP chain stack segment during runtime and automatically calculates the ASLR base address offset of the dynamic link library, so that the obfuscated chain behaves differently on different machines during each deployment.

[0122] Figure 2This demonstrates the complete workflow of a ROP (Return-Oriented Programming) obfuscation tool implemented based on the LLVM compilation framework. The core idea of ​​this process is to introduce a specific assembly-level obfuscation mechanism into traditional C / C++ source code during the compilation stage. By inserting unpredictable control flow structures and instruction perturbations, it enhances the program's resistance to reverse engineering and its ability to resist ROP attacks.

[0123] First, the user-written C / C++ source code is converted into LLVM Intermediate Representation Language (IR) by the Clang compiler frontend. LLVM IR is a platform-independent low-level code format, facilitating the subsequent generation of specific machine code on different target architectures. At this stage, the program does not involve any platform-related details and represents the clearest form of logical structure.

[0124] Next, LLVM's `llc` tool converts these LLVM IRs into x86 assembly code. Normally, this step generates standard, well-structured assembly code files. However, in this system, a special ROP obfuscation module is injected after this stage to perform a series of deep obfuscation operations on the generated assembly instructions. This obfuscation module receives the assembly code output from the compiler and the library file information required by the target program, and performs multi-layered processing on the instruction stream based on this.

[0125] In the first step of the obfuscation process, the system performs a ROP swap operation. This means that parts that originally used function calls, jump instructions, or standard stack operations are replaced by a set of functionally equivalent ROP gadget fragments. These gadgets often come from existing code snippets in the target program, and the system automatically performs the replacement based on the function semantics and the gadget set. This replacement not only preserves the original functionality but also greatly disrupts the direct mapping relationship between instructions and semantics.

[0126] Subsequently, in addition to replacing the ROP gadget, the system inserts opaque predicates. While these predicates always calculate to a fixed value at runtime (e.g., always true), their calculation involves complex register operations or indirect logical judgments, making it difficult to easily identify their true or false nature through static analysis. The existence of these opaque predicates makes the construction of the control flow graph more difficult, raising the barrier to automatic reverse engineering.

[0127] Following the insertion of opaque predicates, the system introduces an instruction filling phase. This phase inserts neutral code segments with invalid functionality into the assembly instructions, such as no-ops (NOPs), data moves without side effects, and dead code segments. These instructions do not affect the final program logic, but they significantly increase the complexity and length of the assembly code, thereby further reducing the feasibility of automated analysis and ROP chain construction.

[0128] After the above multiple rounds of processing, the obfuscated assembly code is re-entered into the assembler to generate a .s file. This file contains all the obfuscation results and can be converted into an executable file by subsequent standard assemblers and linkers. In this process, the obfuscation module exists as a plugin for the LLVM backend and does not affect the frontend's semantic parsing, type checking, or other processes. It only intervenes in the final stage of machine code generation, thus ensuring the correctness of program logic and semantic equivalence.

[0129] The architecture diagram fully covers every step from C / C++ source code to obfuscated binary generation, demonstrating a pluggable, low-intrusion ROP obfuscation framework. This design not only possesses strong flexibility and controllability but also provides an engineering-ready path for software protection and reverse engineering research.

[0130] refer to Figure 3 As shown, the workflow of this solution is as follows:

[0131] The entire obfuscation and protection process is mainly completed through the following steps:

[0132] 1. Source code parsing stage: The C / C++ project source code is compiled into LLVM IR by the Clang frontend for subsequent processing.

[0133] 2. ROP chain generation stage: The ROP converter reads the shared library, extracts the Gadget micro-instructions that meet the constraints, and splits the function logic in conjunction with the available register list to synthesize the ROP equivalent framework step by step.

[0134] 3. Control flow water injection stage: Insert an opaque path node before the entry of each basic block, and use an integer puzzle and a conditional Boolean constructor to make its path value appear undefined to the outside world.

[0135] 4. Hidden Logic Projection Stage: Combining the important variable access segments existing on the path, the corresponding IR is added to the opaque predicate through the semantically preserved transformation structure to hide the output calculation factor.

[0136] 5. Architecture Deployment Phase: The controller ultimately schedules the storage, classification, and packaging of the products from each phase, and encapsulates them into the running results of the architecture with ROP stack positioning, which can be inserted into the original program callback architecture.

[0137] To address the need to combat modern reverse engineering and automated analysis, this invention integrates several key innovations to construct an obfuscation protection system, possessing deployability, strong resistance to analysis, and semantic accuracy. In summary, the following five key technical points constitute the core components for which this invention seeks protection:

[0138] 1. LLVM IR Semantic-Level ROP Chain Transformation Mechanism Based on Gadgets: This mechanism differs from traditional binary-level ROP chain construction. It abstracts and extracts the corresponding target semantics from the intermediate representation layer, combines them with available Gadget fragments from shared libraries to construct a complete semantically equivalent ROP chain structure, and pushes them onto the stack in reverse order of the calling logic, achieving a highly stable runtime instruction fragment replacement mechanism. This ensures that the code maintains functional consistency while its binary implementation structure is extremely dispersed, complex, and difficult to understand, thus significantly increasing the threshold for static analysis.

[0139] 2. An opaque predicate chain technique combining path control and constant protection: This invention's opaque predicate construction mechanism generates expressions based on NP-hard problems (such as large integer factorization and 3SAT), including a nested structure of context judgment logic and constant control instructions. This makes conditional statement logic difficult to reason about and path states controlled by input, achieving the dual goals of path disruption and address / value protection. The non-static solvability of such predicates creates a force field-like obstacle to CFG reconstruction and symbolic execution.

[0140] 3. A Symbolic Pollution Mechanism Supporting Context Input Regulation: Targeting the Dynamic Symbolic Execution analysis mode, this invention designs a path control node constructed using a three-segment chain of "user input - intermediate variables - control dynamic predicates." The guiding engine incorrectly symbolizes path variables, distorting the analysis target or even trapping it in a path bomb, significantly increasing the computational resource consumption for path exploration. This mechanism achieves a triple effect of delay, misleading, and path inflation against DSE, constituting one of the most crucial anti-attack capabilities in real-world applications.

[0141] 4. A dynamic instrumentation method combining instruction nesting and semantic hiding mechanisms. This invention combines a semantic recognizer with the LLVM Pass mechanism. It transcribes specific IR instructions into intermediate semantic fragments and nests them within opaque predicate paths. Simultaneously, it inserts spurious computation paths and control-masked computations, thereby achieving instruction-level support to deceive static feature recognition systems (such as class ID instruction detection and sensitive code reconstruction processes). These visual "instruction fragments" can still execute the target logic completely, but they cannot trigger shallow syntax checking results.

[0142] 5. The runtime ROP dynamic restoration mechanism based on deployment-time symbol offset and stack reordering automatically adjusts the Gadget addresses in all ROP chains during program deployment according to the runtime base address and symbol offset of the shared libraries loaded on the target platform. This makes the ROP chain obfuscation structure platform-dependent, and the stack construction changes over time and with different entry points, exhibiting extremely high unpredictability and non-repeatability. Any batch analysis and symbol table reconstruction will fail; only by executing the behavior in the deployment environment can the industrial application advantages of this invention be maximized.

[0143] The above five points are the most significant technical innovations of this invention, possessing quantifiable security enhancement capabilities. They are all within the core scope of the patent to be protected. It is recommended to provide complete technical strategy protection and protection against negative technical bypass restrictions (i.e., any obfuscated implementation using ROP reconstruction chain + opaque predicate coupling + stack structure control is covered by the protection scope).

[0144] The advantages of the present invention compared to the prior art are mainly reflected in the following aspects:

[0145] 1. Full semantic level protection, not syntax level masking: Unlike traditional variable renaming or dead code insertion, this system outputs value protection at the control point level.

[0146] 2. Strong path decoupling capability: Based on the obfuscation of execution format and control jump based on ROP chain, the structure has a high success rate of automatic breakage and can avoid the static CFG recovery capability.

[0147] 3. Significantly enhanced robustness to DSE: The introduction of path variation by the opaque predicates protected by the randomly generated 3SAT and factorization problem makes it impossible for DSE to quickly determine the valid path.

[0148] 4. Scalable deployment and runtime address remapping capability: Compared to compile-time obfuscation methods, this system can perform dynamic obfuscation by building the ROP stack in real time during deployment and adapt to the Address Space Layout Randomization (ASLR) environment, making it more secure.

[0149] 5. Seamless integration with the LLVM system: It is perfectly embedded in the mainstream LLVM Pass system. After optimizing the intermediate presentation layer, it can be quickly integrated into the backend code generation, with strong scalability and framework compatibility.

[0150] To verify the advanced obfuscation scheme proposed in this invention, which integrates ROP chain reconstruction, opaque predicate instrumentation, and instruction hiding strategies, we designed a series of performance evaluation experiments, focusing on the following dimensions:

[0151] 1. Obfuscation Intensity Metric: The degree to which code readability is reduced.

[0152] We used standard code readability scoring tools (such as the cognitive complexity index in SonarQube) to score the original and obfuscated programs. The average increase in function complexity across different levels was 5.3×, with some control-sensitive functions experiencing increases as high as 12×. Combined with static analysis using IDA Pro, we confirmed that the average accuracy of CFG reconstruction decreased by over 80%, and the graph structure exhibited non-linear fission, verifying the significant ability of this invention to disrupt control flow graph reconstruction.

[0153] 2. Automatic analysis and evaluation of the effectiveness of countermeasures

[0154] We used symbolic execution engines (angr, KLEE) to simulate an attack analyst's perspective to conduct path exploration tasks, tracking and analyzing various program samples (encryption functions, verification logic, multi-branch classifiers):

[0155] The original program had an average path coverage of around 76%.

[0156] • After applying the obfuscation mechanism of this invention, the coverage rate dropped to 32%, with the highest sample rate being only 7%, indicating that the DSE path finding was significantly interfered with.

[0157] • The average path length of conditional branch functions with keys increases by 4.5 to 6.8 times compared to the original, and the time complexity increases from several seconds to tens of minutes.

[0158] Especially for programs that integrate context-sensitive opaque predicates, the path explosion phenomenon reaches the analysis resource limit (memory overflow or path number cap) after running the third basic block, effectively blocking the symbol engine from propagating backward.

[0159] 3. Execution performance overhead assessment

[0160] Performance evaluation covers key metrics such as CPU runtime, stack space overhead, memory residency time, and I / O overhead. The following comparisons are conducted using samples of different sizes:

[0161] • The execution delay of ordinary functions increases by approximately 10-25%, averaging 14.6%;

[0162] • The stack footprint of the obfuscated function increases by 12 to 40 bytes;

[0163] • ASLR adaptive Gadget offset processing does not introduce perceptual-level performance jitter.

[0164] Because of the use of precise obfuscation, not all functions are converted into ROP chains. Combined with partial obfuscated code segments and dynamic memory gating mechanism, a nearly seamless running experience is achieved under the operating system, and it also performs stably when deployed on embedded platforms.

[0165] 4. Instruction coverage

[0166] To evaluate the system's high semantic fidelity, we conducted a comprehensive assessment of Gadget transformation matching rate and instruction reconstruction coverage. It supports approximately 80 commonly used x86 IR instructions, including but not limited to:

[0167] • Data transfer commands: mov, lea, xchg, etc.;

[0168] Arithmetic operation commands: add, sub, xor, and, etc.;

[0169] • Control transfer instructions: jmp, je, jne, call, etc.

[0170] The overall conversion success rate is as high as 94.2%, and the specially optimized micro-gadget coverage accounts for 87% of the entire conversion process. Uncovered blocks are handled using a traditional instruction hiding strategy, ensuring a final obfuscation protection rate of 100%.

[0171] This invention proposes an advanced software obfuscation method that deeply integrates assembly semantic transformation, opaque path calculation, and dynamic symbol anti-disturbance multiple mechanisms. In particular, it designs a complete system scheme optimized for actual deployment to resist static analysis, symbolic reasoning, and feature matching, especially targeting the automated analysis capabilities of modern reverse engineering attack tools.

[0172] From a security perspective, this invention overcomes the limitations of traditional obfuscation strategies that only modify the surface code structure. It delves into the semantic level of instructions, disassembling the original logic at the execution architecture level and adding irreversible, asymmetric artificial path control interference, significantly compressing information that can be extracted through reversible analysis. It constructs the code execution path as a stack rollback problem, hiding the actual execution logic within dynamic gadget combinations, thus maximally hindering brute-force and automated tools from reconstructing the logic.

[0173] From an engineering deployment perspective, the system deeply integrates the LLVM Pass framework, possessing strong embeddability and industrial scalability; ROP construction is highly modular, with good instruction adaptability; it works in conjunction with mechanisms such as Gadget automatic scheduling and ASLR self-parsing to adapt to modern operating system loading environments, ensuring core portability. It can provide full-process obfuscation protection for large C / C++ projects.

[0174] In the future, this system can be extended to intermediate representation channels in multiple languages ​​(such as WebAssembly, ARM IR conversion code, etc.), and a delayed unlinking mechanism will be added to further resist dynamic debugging. Combined with machine learning analysis of Gadget sequence distribution patterns, the efficiency of automated obfuscation pre-training will be improved, providing an important technical support framework for highly confidential code, DRM anti-tampering protection, IoT secure execution environment, and security protection in the fields of defense and industrial control.

[0175] This invention, based on LLVM intermediate representation and compatible with standard C / C++ source code structure, is applicable to numerous platforms including general desktop applications, kernel modules, embedded code, and cloud service deployment scripts. Furthermore, in existing LLVM plugin injection module program chains, only two types of passes—ROP transformation and opaque predicate instrumentation—need to be introduced to implement a complete obfuscation strategy without modifying the program source logic or platform runtime logic.

[0176] This framework is designed for x86 architecture, but the technology itself does not depend on any specific platform instruction set. All obfuscation mechanisms are based on intermediate representation construction, and the Gadget searcher submodule can be overloaded to adapt to architectures such as ARM and MIPS. Currently, LLVM IR already provides solutions for most general-purpose ISAs, and cross-platform migration capabilities are expected.

[0177] By combining a lightweight VM runner with a symbol path spoofing engine, a high-licensed obfuscated microkernel with features such as dynamic scheduling, online gadget editing, and virtual chain escape structures can be developed. In the future, a pre-loaded obfuscated firmware mechanism can be established with terminal security chips to create an integrated platform obfuscation framework from source to instruction chain level.

[0178] In summary, this invention, based on the instruction reconfiguration and combination principle and the information path masking algorithm, proposes a stack-recoverable, non-path-forwarding, structurally polymorphic, and scalably deployable LLVM obfuscation solution. This fills the gap in current path interference and structural restoration countermeasure technologies for highly dynamic adversarial needs, possessing both theoretical depth and practical value. Its applications are suitable for multiple cutting-edge security fields, including modern malware analysis and countermeasures, security software obfuscation, control flow protection, and the construction of cryptographic verification chains.

[0179] To completely disrupt the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, and to achieve controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis, this application provides an embodiment of an obfuscation and anti-reverse engineering protection device based on ROP chains and opaque predicates for implementing all or part of the aforementioned obfuscation and anti-reverse engineering protection method. See [link to embodiment]. Figure 4 The obfuscation and anti-reverse protection device based on ROP chains and opaque predicates specifically includes the following:

[0180] The code conversion module 10 is used to obtain the source code of the target program, convert the source code into an LLVM intermediate representation to obtain LLVM IR code, and load the shared library files that the target program can link to.

[0181] The code assembly module 20 is used to extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; and replace some of the original instructions of the LLVM IR code with the ROP chain to obtain an assembly instruction stream;

[0182] The code obfuscation module 30 is used to construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes context judgment logic and a nested structure of constant control instructions;

[0183] The code generation module 40 is used to transmit the obfuscated code to an assembler to be converted into assembly language code, and to insert scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0184] As described above, the obfuscation and anti-reverse engineering protection device based on ROP chains and opaque predicates provided in this application proposes a three-tiered obfuscation protection framework that combines dynamic reconstruction of ROP instructions, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely disrupts the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0185] From a hardware perspective, in order to completely disrupt the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, and to achieve controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis, this application provides an embodiment of an electronic device for implementing all or part of the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates. The electronic device specifically includes the following components:

[0186] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the obfuscation and anti-reverse engineering protection device based on ROP chains and opaque predicates and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates, and the embodiments of the obfuscation and anti-reverse engineering protection device based on ROP chains and opaque predicates, the contents of which are incorporated herein, and repeated details will not be described again.

[0187] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0188] In practical applications, the obfuscation and anti-reverse engineering protection methods based on ROP chains and opaque predicates can be partially executed on the electronic device side as described above, or all operations can be completed in the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed in the client device, the client device may further include a processor.

[0189] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0190] Figure 5 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 5 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 5 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0191] In one embodiment, the obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following controls:

[0192] Step S101: Obtain the source code of the target program and convert the source code into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to;

[0193] Step S102: Extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; replace some of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream;

[0194] Step S103: Construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes context judgment logic and a nested structure of constant control instructions;

[0195] Step S104: The obfuscated code is sent to an assembler to be converted into assembly language code, and scheduling instructions are inserted into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0196] As described above, the electronic device provided in this application proposes a three-tiered obfuscation protection framework that combines dynamic refactoring of ROP instructions, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely disrupts the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0197] In another embodiment, the obfuscation and anti-reverse protection device based on ROP chains and opaque predicates can be configured separately from the central processing unit 9100. For example, the obfuscation and anti-reverse protection device based on ROP chains and opaque predicates can be configured as a chip connected to the central processing unit 9100, and the obfuscation and anti-reverse protection method function based on ROP chains and opaque predicates can be implemented through the control of the central processing unit.

[0198] like Figure 5 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 5 All components shown; in addition, the electronic device 9600 may also include Figure 5 For components not shown, please refer to existing technologies.

[0199] like Figure 5 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0200] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0201] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0202] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0203] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0204] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processing unit 9100 to provide input signals and receive output signals, which is the same as in a conventional mobile communication terminal.

[0205] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 9130 is coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored audio via the speaker 9131.

[0206] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates in the above embodiments, wherein the execution subject is a server or client. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0207] Step S101: Obtain the source code of the target program and convert the source code into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to;

[0208] Step S102: Extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; replace some of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream;

[0209] Step S103: Construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes context judgment logic and a nested structure of constant control instructions;

[0210] Step S104: The obfuscated code is sent to an assembler to be converted into assembly language code, and scheduling instructions are inserted into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0211] As described above, the computer-readable storage medium provided in this application proposes a three-tiered obfuscation protection framework combining ROP instruction dynamic reconstruction, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely breaks the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0212] Embodiments of this application also provide a computer program product capable of implementing all steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates in the above embodiments, where the execution subject is a server or client. When this computer program / instruction is executed by a processor, it implements the steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates. For example, the computer program / instruction implements the following steps:

[0213] Step S101: Obtain the source code of the target program and convert the source code into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to;

[0214] Step S102: Extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; replace some of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream;

[0215] Step S103: Construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes context judgment logic and a nested structure of constant control instructions;

[0216] Step S104: The obfuscated code is sent to an assembler to be converted into assembly language code, and scheduling instructions are inserted into the assembly language code according to the control flow of the target program to obtain the final target program code.

[0217] As described above, the computer program product provided in this application proposes a three-tiered obfuscation protection framework that combines ROP instruction dynamic reconstruction, opaque predicate protection, and instruction semantic hiding. This framework compiles ordinary C / C++ source code into an LLVM intermediate representation (IR), and then uses dynamic extraction of Gadgets and opaque predicate combinations based on user input states to achieve deep semantic disruption of key logic blocks, jump structures, and constant fields. This completely breaks the control flow restoration chain, making it difficult for reverse engineers to analyze the obfuscation results, achieving controllable, verifiable, and highly stable obfuscation protection for the program, while maximizing resistance to advanced analysis techniques such as symbolic execution and static analysis.

[0218] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0219] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0220] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0221] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0222] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for obfuscation and anti-reverse engineering protection based on ROP chains and opaque predicates, characterized in that, The method includes: Obtain the source code of the target program and convert it into an LLVM intermediate representation to obtain LLVM IR code; load the shared library files that the target program can link to; Instruction fragments are extracted from the shared library file and the LLVM IR code, and the instruction sequences are concatenated together to form a ROP chain according to the logic of the target program. The ROP chain is used to replace some of the original instructions of the LLVM IR code to obtain the assembly instruction stream, including: analyzing the stack structure of the target program and loading the ROP chain onto the stack in reverse order; modifying the pointers and return addresses on the stack so that the target program can jump to the correct instruction fragment each time the ret instruction is executed. An opaque predicate is constructed and inserted into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes a nested structure of context judgment logic and constant control instructions, which is used to guide the dynamic symbolic execution engine to erroneously symbolize path variables. The obfuscated code is sent to an assembler to be converted into assembly language code. According to the control flow of the target program, scheduling instructions are inserted into the assembly language code to obtain the final target program code. The scheduling instructions are used to trigger the scheduler to rebuild the stack structure of the ROP chain as needed during program execution.

2. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, The steps of obtaining the source code of the target program and converting the source code into an LLVM intermediate representation to obtain LLVM IR code include: The compiler receives the source code and preprocesses it; the preprocessing includes macro expansion and file inclusion processing. The source code is subjected to lexical and syntactic analysis using a compiler, and the source code is converted into an abstract syntax tree; An encoder is used to perform semantic checks on the abstract syntax tree; the semantic checks include parsing the abstract syntax tree for variables, functions, and types. The compiler extracts the LLVM IR from the abstract syntax tree and generates a .ll file, which contains the LLVM IR code.

3. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, The step of extracting instruction fragments from the shared library file and the LLVM IR code, and concatenating the instruction sequences together to form a ROP chain according to the logic of the target program, includes: The shared library file and the LLVM IR code are scanned using reverse engineering tools to obtain all ret instructions, and code snippets containing ret instructions are extracted from them to obtain instruction snippets. Analyze the control flow of the target program to identify target areas in the target program that can be attacked using ROP; According to the logic of the target program, instruction fragments that can replace the target region are selected, and the selected instruction fragments are spliced ​​together in a specific order to form the ROP chain.

4. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, The step of replacing a portion of the original instructions of the LLVM IR code with the ROP chain to obtain the assembly instruction stream includes: Analyze the stack structure of the target program and load the ROP chain into the stack in reverse order; Modify the pointers and return address on the stack so that the target program can jump to the correct instruction segment every time it executes the ret instruction.

5. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, The step of constructing an opaque predicate and inserting the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code includes: Choose a logical expression that is difficult to parse, and construct a Boolean expression based on the logical expression, which is always true or false under different input conditions; The opaque predicate is inserted into the assembly instruction stream by modifying the jump instructions of the assembly instruction stream; After the step of constructing an opaque predicate and inserting the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code, the method further includes: inserting neutral code into the obfuscated code; the neutral code includes: NOP instructions, data move instructions, no-operation, and dead code segments.

6. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, The step of transmitting the obfuscated code to an assembler to convert it into assembly language code, and inserting scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code includes: The obfuscated code is converted into assembly language code using an assembler, and the operators in the obfuscated code are mapped to the instruction set of the target machine to ensure that the program semantics remain consistent. According to the control flow of the target program, scheduling instructions are inserted into the assembly language code; the scheduling instructions are used to instruct the assembly language code how to jump or modify register values ​​during execution.

7. The obfuscation and anti-reverse engineering protection method based on ROP chains and opaque predicates according to claim 1, characterized in that, After the steps of transmitting the obfuscated code to an assembler to convert it into assembly language code, and inserting scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code, the method further includes the deployment and execution of the final target program code, wherein the deployment and execution of the final target program code includes: During program loading, the actual address of each instruction segment in the ROP chain is adjusted according to the base address and symbol offset of the loaded shared library, so that the address of the ROP chain is different each time the program runs. During program execution, the scheduler rebuilds the stack structure of the ROP chain and adjusts the data in the stack so that the ret instruction can jump to the correct instruction segment each time. During program execution, the memory addresses of the program are randomized using address space layout randomization technology to change the position of the ROP chain and the stack structure.

8. A confusion and anti-reverse engineering protection device based on ROP chains and opaque predicates, characterized in that, The device includes: The code conversion module is used to obtain the source code of the target program, convert the source code into an LLVM intermediate representation to obtain LLVM IR code, and load the shared library files that the target program can link to; The code assembly module is used to extract instruction fragments from the shared library file and the LLVM IR code, and concatenate the instruction sequences together to form a ROP chain according to the logic of the target program; replace some of the original instructions of the LLVM IR code with the ROP chain to obtain an assembly instruction stream, including: analyzing the stack structure of the target program and loading the ROP chain onto the stack in reverse order; modifying the pointers and return addresses on the stack so that the target program can jump to the correct instruction fragment each time it executes the ret instruction; The code obfuscation module is used to construct an opaque predicate and insert the opaque predicate into the program execution path of the assembly instruction stream to obtain obfuscated code; the opaque predicate is a Boolean expression that includes a nested structure of context judgment logic and constant control instructions, which is used to guide the dynamic symbolic execution engine to symbolize the path variable errors; The code generation module is used to transmit the obfuscated code to the assembler to convert it into assembly language code, and insert scheduling instructions into the assembly language code according to the control flow of the target program to obtain the final target program code. The scheduling instructions are used to trigger the scheduler to rebuild the stack structure of the ROP chain as needed during program execution.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the obfuscation and anti-reverse protection method based on ROP chains and opaque predicates as described in any one of claims 1 to 7.

Images