A system and method for cooperative obfuscation based on heterogeneous execution

Abstract

This invention discloses a collaborative obfuscation system and method based on heterogeneous execution, relating to the field of code protection, and representing a hardware-software collaborative code protection scheme. By constructing a covert execution environment on a solid-state drive (SSD), its internal structure, communication protocols, and firmware are analyzed and functionally extended, and a dedicated instruction space is partitioned. Simultaneously, based on the LLVM compiler framework, three collaborative obfuscation algorithms—control flow flattening, spoofed control flow, and data encryption—are researched and implemented to generate obfuscated binary code and extract key elements. Furthermore, communication facilities between the host and the SSD are established, a stable interaction process is designed, and collaborative obfuscation and anti-debugging functions are implemented. This invention effectively improves the code's resistance to static analysis and dynamic debugging, offering significant advantages over classical methods and providing a more effective solution for code protection.

Description

Technical Field

[0001] This invention relates to the field of code protection, and in particular to a collaborative obfuscation system and method based on heterogeneous execution, which improves the code's resistance to static analysis and dynamic debugging through hardware and software collaboration, thereby protecting code security. Background Technology

[0002] With the rapid development of mobile internet technology and the widespread use of electronic products, the security issues of their underlying binary code have become increasingly prominent. Reverse engineering, leading to threats such as code plagiarism and the cracking of core algorithms, seriously harms the interests of software developers and also endangers user privacy and data security.

[0003] Currently, code protection primarily focuses on two levels: software and hardware. At the software level, code obfuscation is a common technique, increasing the difficulty of reverse engineering by complicating the code structure and logic. This includes methods such as control flow obfuscation, data obfuscation, layout obfuscation, and anti-obfuscation. However, layout obfuscation is ineffective against binary code, anti-obfuscation lacks universality, and existing control flow and data obfuscation methods remain vulnerable to being cracked by increasingly sophisticated analysis techniques.

[0004] At the hardware level, hardware security extension technologies such as Trusted Execution Environments (TEEs) based on dedicated CPUs and Trusted Platform Modules (TPMs) based on coprocessors provide a secure environment for code execution. However, TEEs are vulnerable to security vulnerabilities such as Foreshadow attacks and Branch Shadowing attacks, while TPMs face threats such as side-channel attacks and cold start attacks. Furthermore, these hardware protection solutions are only applicable to devices with corresponding hardware support, lacking effective protection for older devices.

[0005] It is evident that existing code protection solutions have limitations, failing to achieve collaborative work between software and hardware, and thus failing to meet code security requirements in terms of enhancing code's resistance to static analysis and dynamic debugging. Summary of the Invention

[0006] In view of this, the present invention provides a collaborative obfuscation system and method based on heterogeneous execution, which enhances the code's resistance to static analysis and dynamic debugging through the collaborative work of software and hardware, improves code security, solves the shortcomings of existing code protection schemes, and provides effective code protection for various devices.

[0007] To achieve the above objectives, one embodiment of the present invention provides a collaborative obfuscation system based on heterogeneous execution, comprising: a host-side module and an SSD-side module.

[0008] The host-side module is used for code obfuscation and communication with the SSD-side module; it includes a code obfuscation unit and a communication interface unit. The code obfuscation unit implements an obfuscation algorithm based on the LLVM compiler framework for code obfuscation and extracts key obfuscation elements. The communication interface unit analyzes the SSD communication protocol and the host-side SSD driver, uses the ioctl system call to implement the communication interface with the SSD covert execution environment, and interacts with the SSD-side module with data in a specific format.

[0009] The SSD-side module is used to build a covert execution environment and handle the hiding, parsing, and anti-debugging of key obfuscated elements; it includes a covert execution environment creation unit and an interaction processing and anti-debugging unit; the covert execution environment construction unit builds the SSD covert execution environment, that is, designs the functional extension framework and instruction address space, and completes the read and write operation function extension and anti-debugging function extension; the interaction processing and anti-debugging unit handles the collaborative obfuscation interaction process between the SSD and the host according to the execution logic of different obfuscation schemes.

[0010] Furthermore, the code obfuscation unit implements three obfuscation algorithms based on the LLVM compiler framework: control flow flattening, fake control flow, and data encryption.

[0011] Furthermore, the control flow flattening algorithm transforms the original program's basic blocks into a horizontally flat hierarchical structure. The specific implementation steps are as follows:

[0012] 1) Basic block partitioning: The basic blocks of the original function are partitioned according to logical entry and exit points, and a unique random identifier randNum is assigned to each basic block; 2) Scheduler construction: Insert a scheduler dispatcher at the function entry point, which contains a switch-case structure based on randNum. The scheduler jumps to the corresponding basic block according to the value of the current control variable swVar. 3) Dynamic resolution of control variables: The value of swVar is resolved in real time through interaction with the SSD. The SSD returns the randNum of the next basic block based on the preset key and index. 4) Instruction perturbation: Randomly generated operator substitutions and operand perturbations are inserted into each basic block. In addition, PHI instructions and register variables are repaired to ensure the correctness of data dependencies between basic blocks.

[0013] Furthermore, the spurious control flow algorithm constructs a spurious control flow by adding extra control statements and opaque predicates, and performs real-time parsing of the opaque predicate variables to perturb the original basic blocks and balance their in-degree and out-degree. The specific implementation steps are as follows: 1) Basic block segmentation and cloning: The original basic block is segmented into headBB, bodyBB, and endBB. The bodyBB is cloned to generate cloneBB, and instruction perturbation is added to cloneBB. 2) Conditional jump insertion: Insert conditional jump instructions in headBB, use opaque predicates to determine the jump direction, the parameters of the opaque predicates are parsed in real time through interaction with SSD, to prevent static analysis from directly obtaining the values; 3) Path merging and repair: Insert unconditional jumps at the end of cloneBB and bodyBB, eventually merging them into endBB, and repairing the PHI instruction of endBB to ensure that the data flow of different predecessor paths does not leak the real logic.

[0014] Furthermore, the data encryption algorithm protects global variables and string constants in the program with encryption, and the specific encryption strategy is as follows: 1) Encryption initialization: Initialize and encrypt the global variables in the .data section, and store them as ciphertext; 2) Runtime decryption and re-encryption: Insert a function call at the function entry point to obtain the key from the SSD and decrypt the data. Insert a function call when the function returns to re-encrypt the data and write it back to the .data segment.

[0015] Furthermore, the covert execution environment construction unit conducts in-depth analysis of the SSD's internal structure and communication protocols, and reverse-engineers the original firmware using open-source firmware code to locate key parts such as the main function, interrupt handling module, and read / write logic. It designs and implements a functional extension framework, utilizing the firmware's free space to create functional extension areas and instruction address spaces. It extends the functionality of read / write operations, saving host data to a buffer during write operations and performing obfuscated element parsing based on the buffer data during read operations, returning the host parsing result. By concealing the specific parsing operations within normal read / write operations, and ensuring that real data is not written to flash memory and cannot be read normally, a covert execution environment is constructed.

[0016] Furthermore, the interactive processing and anti-debugging unit handles the collaborative obfuscation interaction process between the SSD and the host according to the execution logic of different obfuscation schemes. By performing timeout detection before read and write instructions, if a timeout occurs, it is considered that debugging has been detected, and an abnormal state variable is set to prevent covert execution, thus realizing the anti-debugging function. If no timeout occurs, normal execution is performed, the abnormal state variable is persistently saved, and relevant recovery logic is implemented to ensure that the system can still maintain security after power-on.

[0017] Another embodiment of the present invention provides a collaborative obfuscation method based on heterogeneous execution, comprising the following steps: First, code obfuscation is performed, using three obfuscation algorithms to obfuscate the code and extract key obfuscated elements; Secondly, we construct an SSD covert execution environment, which involves designing a functional extension framework and instruction address space to complete the extension of read and write operation functions and anti-debugging functions. The extracted obfuscated elements are then embedded again into the reserved location of the SSD's covert execution environment, and the firmware is compiled and burned into the SSD. Ultimately, during the execution of obfuscated code on the host, the host sends data, the SSD parses and returns the results, and the SSD performs debugging and anti-debugging operations at the same time.

[0018] Beneficial effects: This invention, through a hardware-software collaborative approach, hides critical control flow information or initial data values ​​within the SSD firmware and loads them on demand at runtime, effectively enhancing the code's resistance to static analysis and dynamic debugging. Compared to the classic Obfuscator-LLVM method, it demonstrates significant advantages in improving code's resistance to static analysis, resisting symbolic execution path reconstruction, and enhancing its resistance to dynamic debugging. Furthermore, this invention utilizes general-purpose SSD storage devices for functional expansion, providing a feasible code protection solution for older devices lacking secure hardware protection, and has broad application prospects. Attached Figure Description

[0019] Figure 1 This invention provides a schematic diagram of the hardware relationships of a collaborative obfuscation system based on heterogeneous execution, as illustrated in an embodiment of the invention. Figure 2 This is a schematic diagram illustrating the construction process of a collaborative obfuscation system based on heterogeneous execution, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the collaborative obfuscation interaction process in a collaborative obfuscation system based on heterogeneous execution, provided as an embodiment of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] The purpose of this invention is to provide a collaborative obfuscation system and method based on heterogeneous execution. Through the collaborative work of software and hardware, it enhances the code's resistance to static analysis and dynamic debugging, improves code security, solves the shortcomings of existing code protection schemes, and provides effective code protection for various devices.

[0022] The heterogeneous execution-based collaborative obfuscation system of the present invention includes a host-side module and an SSD-side module. The host-side module is responsible for code obfuscation processing and communication with the SSD, while the SSD-side module constructs a covert execution environment and handles the hiding, parsing, and anti-debugging functions of key obfuscated elements.

[0023] Host-side module functionality: The code obfuscation unit implements three obfuscation algorithms based on the LLVM compiler framework: control flow flattening, fake control flow, and data encryption.

[0024] The control flow flattening algorithm transforms the original program's basic blocks into a horizontally flat hierarchical structure. The specific implementation steps are as follows: 1) Basic block segmentation: The original function's basic blocks are segmented according to logical entry and exit points, and a unique random identifier (randNum) is assigned to each basic block; 2) Scheduler construction: A scheduler is inserted at the function entry point, containing a switch-case structure based on randNum. The scheduler jumps to the corresponding basic block based on the current control variable (swVar) value; 3) Dynamic control variable resolution: The value of swVar is resolved in real-time through interaction with the SSD. The SSD returns the randNum of the next basic block based on a preset key and index; 4) Instruction perturbation: Randomly generated operator substitutions (a total of seven basic mathematical and logical operations) and operand perturbations (the parameters of the icmp instruction are inverted or replaced with random numbers) are inserted into each basic block. Additionally, the PHI instruction and register variables are repaired to ensure the correctness of data dependencies between basic blocks.

[0025] The spoof control flow algorithm constructs a spoof control flow by adding extra control statements and opaque predicates. It parses the opaque predicate variables in real time and perturbs the original basic blocks to balance in-degree and out-degree. The specific implementation steps are as follows: 1) Basic block segmentation and cloning: The original basic block is segmented into headBB, bodyBB, and endBB. BodyBB is cloned to generate cloneBB, and instruction perturbations are added to cloneBB. 2) Conditional jump insertion: Conditional jump instructions are inserted into headBB. Opaque predicates are used to determine the jump direction. The parameters of the opaque predicates are parsed in real time through interaction with SSD, preventing static analysis from directly obtaining values. 3) Path merging and repair: Unconditional jumps are inserted at the end of cloneBB and bodyBB, ultimately merging into endBB. The PHI instructions in endBB are repaired to ensure that data flows from different predecessor paths do not leak the real logic.

[0026] The data encryption algorithm protects global variables and string constants in the program with encryption. The specific encryption strategy is as follows: 1) Encryption initialization: Global variables in the .data segment are initialized and encrypted, and stored as ciphertext. 2) Runtime decryption and re-encryption: A function call is inserted at the function entry point to obtain the key from the SSD and decrypt the data. A function call is inserted when the function returns to re-encrypt the data and write it back to the .data segment.

[0027] The program, compiled by the LLVM compiler, is processed by an algorithm to ultimately generate an obfuscated executable file and obfuscated key elements. The former is sent to the host for execution, while the latter is used to build a covert execution environment on the SSD.

[0028] The communication interface unit analyzes the SSD communication protocol and the host-side SSD driver, uses the ioctl system call to implement the communication interface with the SSD's hidden execution environment, and interacts with the SSD with data in a specific format.

[0029] The SSD-side module's functionality includes a covert execution environment construction unit. This unit conducts in-depth analysis of the SSD's internal structure and communication protocols, and reverse-engineers the original firmware using open-source code to pinpoint key components such as the main function, interrupt handling module, and read / write logic. A functional extension framework is designed and implemented, utilizing free space in the firmware to create functional extension areas and instruction address spaces. Read and write operations are extended by saving host data to a buffer during write operations and performing obfuscated element parsing based on the buffer data during read operations, returning the parsing result to the host. By concealing the specific parsing operations within normal read and write operations, and ensuring that real data is not written to flash memory, a covert execution environment is constructed.

[0030] The interactive processing and anti-debugging unit handles the collaborative obfuscation interaction between the SSD and the host according to the execution logic of different obfuscation schemes. By performing timeout checks before read and write commands, if a timeout occurs, it is considered that debugging has been detected. An abnormal state variable is then set, and covert execution is prohibited, thus implementing anti-debugging functionality. If no timeout occurs, normal execution proceeds. To ensure security, the abnormal state variable must be persistently saved, and relevant recovery logic must be implemented to ensure that the system maintains security after power-on.

[0031] The collaborative obfuscation method involves the following steps: First, code obfuscation is performed using three obfuscation algorithms to obfuscate the code and extract key obfuscated elements. Second, an SSD covert execution environment is constructed, which involves designing a functional extension framework and instruction address space to complete read / write operation function extensions and anti-debugging function extensions. Third, the extracted obfuscated elements are embedded into the reserved locations of the SSD covert execution environment, and the firmware is compiled and burned into the SSD. Finally, during the execution of the obfuscated code on the host, the host sends data, the SSD parses and returns the results, and the SSD performs debugging detection and anti-debugging operations simultaneously.

[0032] Example 1 Experimental Equipment and Environment Selection: In the actual implementation, an OCZ Vertex Plus 120GB SSD was selected for research. Its controller chip is an Indilinx Barefoot chip, and the interface is SATA2. The host system used Ubuntu 22.04.5 LTS, with a 48-core Intel(R) Xeon(R) CPU E5-2678 v3 @ 2.50GHz and 94GB of RAM. The test program analysis environment used a Huawei Atlas 200I DKA2 development board, with an ARM Cortex-A57 processor and 4GB of RAM. The analysis software platform was Windows 1022H2 Professional Edition, with a 6-core Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz and 16GB of RAM. The software environment includes the LLVM 14.0 compiler suite with an extended implementation of the co-obfuscator, the Bin Diff 8.0 program analysis software, the arm-elf-gcc compiler suite, and the OpenSSD Jasmine source code, etc.

[0033] SSD-side operations: Firmware Reverse Engineering and Environment Construction: SSD firmware is extracted using software tools from the open-source project OpenSSD, and then preliminarily processed and analyzed. The location and function of the anomaly vector table and various functionalities in the firmware are determined, and the usage of the DRAM buffer is analyzed. A functional extension framework is designed using the free space in the firmware, implementing functional extensions by modifying original instructions and setting jump tables. A dedicated instruction address space is allocated, and the code segment for obtaining the sector number in the `ata_identify_device` function is modified to set the LBA space for extended instructions. Functionality is extended for read and write operations. Host data is saved at location 0x244A0 in the `main` function and location 0x21410 in the `ftl_write` function during write operations. Obfuscated elements are parsed at location 0x20C40 in the `ftl_read` function and location 0x244AC in the `main` function, constructing a stealthy execution environment.

[0034] Interactive processing and anti-debugging functionality implementation: During communication between the SSD and the host, interactive logic is handled according to different obfuscation schemes. For real-time parsing of obfuscated elements, the R0 and R1 registers are used to pass the parameters required to calculate the buffer address, based on the ARM procedure call standard. For obfuscated element parsing using the control flow flattening algorithm, a loop query method is used; for the other two algorithms, the original value is retrieved using the index value. Time-sensing extension functionality is deployed, configuring timer-related registers and adding patches to the interrupt handler for timeout checks and logic control. Anti-debugging functionality is implemented, persistently saving and restoring abnormal state variables to ensure system security.

[0035] Host-side operations: Code obfuscation: Based on the LLVM 14.0 compiler suite, an obfuscation pass was written to flatten the control flow, create a fake control flow, and encrypt the data. Taking the SM3 cryptographic hash algorithm as an example, its core function `sm3_fast_update` is obfuscated, and the answer array in the program is encrypted. Macro definitions are used to select the functions to be obfuscated and the data to be encrypted.

[0036] Communication Interface Implementation: The communication protocol of the OCZ Vertex Plus SSD is analyzed. Since it connects to the test host via USB and is managed by the Linux SCSI subsystem, the host side uses the SCSI protocol for communication. The ioctl system call is used to encapsulate and send commands according to the struct sg_io_hdr data structure to interact with the SSD. During the interaction, obfuscated data, including the opcode, index value, and key, is sent in a specific format, and the parsing results or real data returned by the SSD are received.

[0037] Experimental verification: Functional consistency verification: Run the test program to verify the consistency of program functionality before and after obfuscation. Under the same input, observe whether the obfuscated program can produce the same output as the original program. For example, run the SM3 algorithm test program to check whether the execution result of the obfuscated program is consistent with the original program, verifying the impact of the three obfuscation algorithms on program functionality.

[0038] Static analysis verification: Bin Diff 8.0 software was used to perform similarity analysis on the programs before and after obfuscation. The effects of the obfuscation algorithm of the Armariris project and the present invention were compared from four perspectives: Basic Blocks, Jumps, Instructions, and function similarity. The results show that the algorithm of the present invention can effectively reduce the similarity between basic blocks, jumps, and instructions. In the control flow flattening algorithm, the jump similarity is reduced to 0, thus hiding the jump information.

[0039] Dynamic analysis and verification: Symbolic execution tests were performed on the test program using the angr tool. The program's initial and target states were set, paths were explored, and solution time was recorded. Experimental results show that the program obfuscated by Armariris can be solved, while the program obfuscated by this invention outputs "Killed" after more than 30 minutes of solving due to near memory usage limits and excessive allocation failures. This indicates that the algorithm of this invention can effectively resist path exploration by automated symbolic execution. Simultaneously, manual and automatic debugging tests were conducted on the three algorithms of this invention using the gdb debugging tool. The results show that manual debugging cannot obtain key element content, and after the automatic debugging triggers the detection mechanism, the SSD no longer executes the extended function, proving that the algorithm of this invention has good anti-debugging capabilities.

[0040] Performance Verification: The perf tool was used to compare the performance of the obfuscation algorithm of this invention with Armariris. The actual execution time, CPU time, number of context switches, number of page faults, number of instructions, and space size were statistically analyzed after 50 executions. The results show that the execution time of the algorithm of this invention is significantly higher than that of Armariris in the time dimension, but the program size after obfuscation is smaller than that of Armariris in the space dimension. Furthermore, it achieves a lower similarity to the original program while having lower space overhead, demonstrating a certain advantage in overall performance.

[0041] Through the above implementation methods, the collaborative obfuscation system and method based on heterogeneous execution of the present invention can be effectively implemented, providing a reliable solution for code protection.

[0042] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A system for cooperative obfuscation based on heterogeneous execution, characterized in that, include: Host-side module and SSD-side module; The host module is used for code obfuscation and communication with the SSD module. It includes a code obfuscation unit and a communication interface unit; the code obfuscation unit implements an obfuscation algorithm based on the LLVM compiler framework for code obfuscation processing and extracts key obfuscation elements; The communication interface unit analyzes the SSD communication protocol and the host-side SSD driver, uses the ioctl system call to implement the communication interface with the SSD covert execution environment, and interacts with the SSD-side module in a specific format. The SSD-side module is used to construct a covert execution environment and handle the hiding, parsing, and anti-debugging of obfuscated key elements; it includes a covert execution environment creation unit and an interaction processing and anti-debugging unit; the covert execution environment construction unit constructs the SSD covert execution environment, that is, designs the functional extension framework and instruction address space, and completes the read and write operation function extension and anti-debugging function extension; the interaction processing and anti-debugging unit handles the collaborative obfuscation interaction process between the SSD and the host according to the execution logic of different obfuscation schemes.

2. The collaborative obfuscation system based on heterogeneous execution as described in claim 1, characterized in that, The code obfuscation unit implements three obfuscation algorithms based on the LLVM compiler framework: control flow flattening, fake control flow, and data encryption.

3. The collaborative obfuscation system based on heterogeneous execution as described in claim 2, characterized in that, The control flow flattening algorithm described above transforms the original program's basic blocks into a horizontally flat hierarchical structure. The specific implementation steps are as follows: 1) Basic block partitioning: The basic blocks of the original function are partitioned according to logical entry and exit points, and a unique random identifier randNum is assigned to each basic block; 2) Scheduler construction: Insert a scheduler dispatcher at the function entry point, which contains a switch-case structure based on randNum. The scheduler jumps to the corresponding basic block according to the value of the current control variable swVar. 3) Dynamic resolution of control variables: The value of swVar is resolved in real time through interaction with the SSD. The SSD returns the randNum of the next basic block based on the preset key and index. 4) Instruction perturbation: Randomly generated operator substitutions and operand perturbations are inserted into each basic block. In addition, PHI instructions and register variables are repaired to ensure the correctness of data dependencies between basic blocks.

4. The collaborative obfuscation system based on heterogeneous execution as described in claim 2 or 3, characterized in that, The spurious control flow algorithm constructs a spurious control flow by adding extra control statements and opaque predicates, and performs real-time parsing of opaque predicate variables to perturb the original basic blocks and balance their in-degree and out-degree. The specific implementation steps are as follows: 1) Basic block segmentation and cloning: The original basic block is segmented into headBB, bodyBB, and endBB. The bodyBB is cloned to generate cloneBB, and instruction perturbation is added to cloneBB. 2) Conditional jump insertion: Insert conditional jump instructions in headBB, use opaque predicates to determine the jump direction, the parameters of the opaque predicates are parsed in real time through interaction with SSD, to prevent static analysis from directly obtaining the values; 3) Path merging and repair: Insert unconditional jumps at the end of cloneBB and bodyBB, eventually merging them into endBB, and repairing the PHI instruction of endBB to ensure that the data flow of different predecessor paths does not leak the real logic.

5. The collaborative obfuscation system based on heterogeneous execution as described in claim 2 or 3, characterized in that, The data encryption algorithm protects global variables and string constants in the program with encryption. The specific encryption strategy is as follows: 1) Encryption initialization: Initialize and encrypt the global variables in the .data section, and store them as ciphertext; 2) Runtime decryption and re-encryption: Insert a function call at the function entry point to obtain the key from the SSD and decrypt the data. Insert a function call when the function returns to re-encrypt the data and write it back to the .data segment.

6. The collaborative obfuscation system based on heterogeneous execution as described in claim 1 or 2, characterized in that, The stealth execution environment construction unit conducts in-depth analysis of the SSD's internal structure and communication protocols, and reverse-engineers the original firmware using open-source firmware code to locate key parts such as the main function, interrupt handling module, and read / write logic. It designs and implements a functional extension framework, utilizing the firmware's free space to create functional extension areas and instruction address spaces. It extends the functionality of read / write operations, saving host data to a buffer during write operations and performing obfuscated element parsing based on the buffer data during read operations, returning the host parsing result. By concealing the specific parsing operations within normal read / write operations, and ensuring that real data is not written to flash memory and cannot be read normally, a stealth execution environment is constructed.

7. The collaborative obfuscation system based on heterogeneous execution as described in claim 6, characterized in that, The interactive processing and anti-debugging unit handles the collaborative obfuscation interaction process between the SSD and the host according to the execution logic of different obfuscation schemes. By performing timeout detection before read and write instructions, if a timeout occurs, it is considered that debugging has been detected, and an abnormal state variable is set to prevent covert execution, thus realizing the anti-debugging function. If no timeout occurs, normal execution is performed. The abnormal state variable is persistently saved and related recovery logic is implemented to ensure that the system can still maintain security after power-on.

8. A collaborative obfuscation method based on heterogeneous execution, characterized in that, Includes the following steps: First, code obfuscation is performed, using three obfuscation algorithms to obfuscate the code and extract key obfuscated elements; Secondly, we construct an SSD covert execution environment, which involves designing a functional extension framework and instruction address space to complete the extension of read and write operation functions and anti-debugging functions. The extracted obfuscated elements are then embedded again into the reserved location of the SSD's covert execution environment, and the firmware is compiled and burned into the SSD. Ultimately, during the execution of obfuscated code on the host, the host sends data, the SSD parses and returns the results, and the SSD performs debugging and anti-debugging operations simultaneously.

Images