A polymorphic method and system for instruction-level dynamic protection

Abstract

The present application relates to a kind of instruction level dynamic protection polymorphic shell method and system, belong to information security technical field.The present application realizes the dynamic encryption protection of original program code instruction level, solves the problem that large section of original program code is exposed in memory in traditional encryption shell and compression shell technology, so that analyst is difficult to obtain original program code directly by memory dump etc.Technology;Realize the multiple protection of shell program, improve the anti-analysis ability of shell program from two aspects of anti-static analysis and anti-dynamic analysis, solve the problem that shell program feature is obvious in common shell technology, easy to be positioned and unshelled;Realize the self-modification of the program after shell, will be effectively modified after shell each time, break the mapping relationship between the program after shell and original program, further increase the analysis difficulty of the program after shell.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a polymorphic packing method and system for instruction-level dynamic protection. Background Technology

[0002] Packing is a commonly used computer program protection technique that prevents external programs or software from performing static analysis such as disassembly and decompilation, as well as dynamic analysis such as debugger execution and behavior monitoring. This effectively protects the original program from being damaged or cracked, thus protecting the copyright of the computer program. However, due to its ability to alter the characteristics of a computer program and circumvent analysis, packing is also abused in the evasion of antivirus software. Packing can quickly transform malicious programs, generating variants with characteristics drastically different from the original program, which is highly effective in evading signature-based detection. Some packing techniques can even hide the behavioral characteristics of malicious programs, achieving evasion of behavioral detection. Integrating offense and defense, whether for strengthening computer program copyright protection, preventing program cracking, or improving the ability to detect and eliminate malicious programs and preventing their proliferation, in-depth research into packing techniques is essential.

[0003] Packing technology protects computer programs by adding extra bootloader code outside the program. The computer program is usually called the original program, the bootloader code is usually called the shell program, the program that adds the shell program to the original program is usually called a packing tool, and the processed original program is called the packed program. The packing tool is responsible for encrypting, compressing, and converting the original program, adding the processed original program to the shell program or injecting the shell program into the original program, ultimately resulting in a directly executable packed program. When the packed program runs, the shell program is executed first, and then the shell program is responsible for the subsequent program execution.

[0004] Based on the method of processing the original code, packing techniques can be divided into three types: encryption packers, compression packers, and virtual machine packers. Encryption and compression packers encrypt and compress the original program. During runtime, the packer program decrypts and decompresses the original program in memory, restoring its original state, and then transfers control to the original program code. Virtual machine packers convert the original program code into their own instructions, which are then parsed and executed during runtime. Packed programs processed by compression and encryption packers typically exhibit obvious decryption, decompression, and control transfer characteristics. They also expose complete or large sections of the original code in memory, making them easily recoverable through unpacking, resulting in insufficient protection. Virtual machine packers, on the other hand, have relatively difficult-to-crack instruction sets and parsing engines. However, their instruction sets and parsing engines are not easily modified, and the mapping relationship between the original program and the packer program is difficult to break, allowing the packer program to represent the original program to a certain extent. Therefore, it is necessary to study highly protective packing techniques to avoid exposing large sections of original program code in memory during the execution of the packed program. At the same time, it is necessary to study polymorphic packing techniques to break the mapping relationship between the packed program and the original program, so as to avoid judging the original program by detecting the packed program. Summary of the Invention

[0005] (a) Technical problems to be solved The technical problem to be solved by this invention is to design a polymorphic packing method and system with instruction-level dynamic protection, which solves the problem of large sections of original program code being exposed in memory in traditional encryption and compression packing technologies.

[0006] (II) Technical Solution To address the aforementioned technical problems, this invention provides a polymorphic packing method with instruction-level dynamic protection. This method comprises three steps: packing the original program, running the shell program, and polymorphic processing of the packed program. The original program packing step involves packing the original program, including data distortion and code encryption, and injecting the shell program into the original program to obtain a independently runnable packed program. The shell program consists of an outer shell program and an inner shell program. The outer shell program loads and runs the inner shell program, protecting it, while the inner shell program protects the original program. In the shell program running step, the shell program drives the execution of the packed program. The polymorphic processing step of the packed program is responsible for implementing polymorphism. The inner shell program injects the polymorphic program into other processes, and modifies the packed program after its execution.

[0007] This invention also provides a system for implementing the method, comprising a raw program packing tool, a shell program, and a polymorphic program; the raw program packing tool is responsible for processing the raw program, packaging and injecting the shell program into the raw program, and finally generating the packed program; the shell program is responsible for performing instruction-level dynamic encryption and decryption of the raw program code, execution flow jump, and polymorphic program release; the polymorphic program is used to implement functions such as closing the packed program process, moving the shell program position, randomly enabling the shell program for anti-debugging, and using a new pseudo-randomization seed to process encrypted data in the raw program code.

[0008] (III) Beneficial Effects This invention provides a polymorphic packing method and system with instruction-level dynamic protection. It achieves dynamic encryption and decryption protection of the original program code at the instruction level, solving the problem of large sections of the original program code being exposed in memory in traditional encryption and compression packing techniques, making it difficult for analysts to directly obtain the original program code through techniques such as memory dumping. It achieves multiple protections for the packed program, improving its resistance to analysis from both static and dynamic analysis perspectives, and solving the problem that common packing techniques make the packed program easily identifiable and easy to unpack. It also enables self-modification of the packed program, effectively modifying it after each run, breaking the mapping relationship between the packed program and the original program, and further increasing the difficulty of analyzing the packed program. Attached Figure Description

[0009] Figure 1 The schematic diagram shows the principle of the polymorphic packing method for instruction-level dynamic protection provided by this invention. Detailed Implementation

[0010] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0011] Encryption and compression shells require the shell program to decrypt and decompress the original program code in memory during runtime. This exposes all or part of the original code in memory, making it easy for analysts to extract the original code using techniques such as memory dumping. Furthermore, encryption and compression shells exhibit obvious decryption / decompression and control transfer characteristics, making them easy for analysts to locate and remove using unpacking techniques, exposing the original program. Virtual machine shells possess their own instruction set and parsing engine, which are difficult to modify. This makes the one-to-one mapping between the shell program and the original program impossible to break, allowing the shell program to represent the original program to a certain extent.

[0012] To address the aforementioned technical problems, this invention provides a polymorphic packing method and system with instruction-level dynamic protection. It aims to resolve the risks associated with large blocks of original program code exposed in memory by achieving dynamic protection of the original program code at the instruction level. It also addresses the issue of easily unpacked programs with obvious packer characteristics, strengthening the protection of the packer itself and enhancing its resistance to analysis at the packer level. Furthermore, it breaks the one-to-one mapping between the packer and the original program, enabling dynamic changes in the packer and further enhancing its resistance to analysis. In addition, to avoid excessive space overhead from stream cipher keys and excessive time overhead from repeated key calculations, this invention adopts a compromise approach by designing a key cache table to record the keys of recently decrypted data.

[0013] refer to Figure 1 The polymorphic packing method of this invention can be divided into three steps: packing the original program, running the shell program, and polymorphic packing of the program. The original program packing section describes the packing process, including table transformation and code encryption of the original program, and then packaging the shell program and its protection code into the original program to obtain a packed program that can run independently. The shell program running section describes the principle of a double-layer shell program. The outer shell program is responsible for loading and running the inner shell program to protect it. The inner shell program is responsible for dynamically decrypting, executing, and encrypting the original program instructions to protect the original program. The polymorphic packing of the program describes the implementation of polymorphism in the program. The inner shell program injects the polymorphic program into other processes, and after the program finishes running, it modifies the program by moving code positions and re-randomizing encrypted data.

[0014] The original program packing process mainly includes three sub-steps: original program table data transformation, code segment encryption, and packer injection, as detailed below: Step 11: For the table data of the original program, generate a relocation table for the hard-coded addresses in its code segment, and transform it together with the IAT table (Import Address Table). The processed data is stored in the resource segment of the original program, and the original relocation table and IAT table are deleted.

[0015] Step 12: For the code segment of the original program, encrypt the code segment using a stream cipher algorithm, perform pseudo-randomization on the encrypted data, add the key seed and pseudo-randomization seed to the resource segment of the original program, and add the pseudo-randomized data to the code segment of the original program. Modify the code segment attributes to executable, readable, and writable.

[0016] Step 13: Generate a two-layer shell program. To enhance the shell program's resistance to analysis, this solution designs a two-layer shell program, consisting of an outer shell program and an inner shell program. The outer shell program is responsible for protecting the inner shell program, while the inner shell program is responsible for protecting the original program. Anti-debugging code is added to the inner shell program to achieve runtime shell program protection: various anti-debugging codes are prepared and randomly inserted at random locations within the inner shell program. The inner shell program is encrypted, and the encrypted data is added to the outer shell program code. Code for decrypting and manually loading and executing the inner shell program is added to the outer shell program.

[0017] Step 14: Inject the above double-shell program into the blank area of ​​the original program's code segment, record the entry point of the original program, and modify the entry point of the original program to the starting address of the double-shell program.

[0018] It is important to note that a shell program is a piece of code wrapped around the original program to protect it. A shell program is not a complete, independently executable computer program; its essence is a piece of binary code that can be executed by attaching to the original program process.

[0019] After completing the above steps, the original program is packed, resulting in the packed program. This packed program can run independently, and during execution, the shell program handles dynamic encryption / decryption, execution, and polymorphism of instructions. Specifically, dynamic encryption is performed by the inner shell program's encryption module (which uses a stream cipher algorithm to encrypt the original program's code segments); dynamic decryption is performed by the inner shell program's decryption module; dynamic execution is performed by the inner shell program's execution module; and polymorphism is achieved by the polymorphic program release module within the inner shell program.

[0020] It should be noted that since the packer does not change the original program structure, the original program resource segment becomes the packed program resource segment, and the original program code segment becomes the packed program code segment.

[0021] In the shell program execution steps, the shell program is responsible for driving the execution of the packed program, specifically including the following steps: Step 21: When the shell program starts, the outer shell program is executed first. The outer shell program decrypts and obtains the inner shell program code. Then, the inner shell program is loaded at a random loading address by manual loading and execution, and the entry point of the inner shell program is jumped to execute the inner shell program.

[0022] Step 22: The inner shell program decryption module checks whether the inner shell program is being run for the first time. If so, it derandomizes the code segment of the original program after pseudo-randomization processing according to the pseudo-randomization seed, and then proceeds to the next step; otherwise, it proceeds directly to the next step.

[0023] Step 23: The inner shell program dynamically decrypts the code segment of the original program. Starting from a specified address, the inner shell program's decryption module decrypts the code segment of the original program byte by byte until it identifies an instruction as the execution instruction based on the longest instruction principle. During decryption, it first queries the key cache table; if no corresponding key is found, it reads the key seed, generates a key, and updates the key cache table.

[0024] Step 24: Pass the starting address, instruction length, and next instruction address of the instruction to be executed to the execution module.

[0025] Step 25: The inner shell program dynamically executes the code segment of the original program. The inner shell program execution module first modifies the next instruction of the instruction to be executed into a jump instruction, with the jump address being the address of the inner shell program encryption module. Then, it passes the original data of the next instruction before modification, the address of the instruction to be executed, and the length of the instruction to be executed to the shell program encryption module. Finally, it jumps to the address of the instruction to be executed and executes the instruction.

[0026] Step 26: The inner shell program dynamically encrypts the code segment of the original program. After the instruction to be executed is executed, the jump instruction continues to be executed, and the program runs to the inner shell program encryption module. The inner shell program encryption module first encrypts the above instruction to be executed, then restores the original data before the next instruction was modified, and finally jumps to the inner shell program decryption module to decrypt the next logical instruction.

[0027] Step 27: Repeat steps 23 to 26 above until an exit command is detected.

[0028] Step 28: Release the polymorphic program.

[0029] In the polymorphic step of the packed program, the inner shell program releases and executes the polymorphic program, which then modifies the packed program, thus achieving polymorphism. When the inner shell program recognizes that the instruction to be executed is a process exit instruction, it injects the above polymorphic program into other processes (processes other than the packed program process), and waits for the packed program process to close before modifying the packed program.

[0030] Furthermore, the functions of the aforementioned polymorphic program mainly include moving the position of the new shell program in the packed program file, randomly enabling anti-debugging of the shell program, and using a new pseudo-randomization seed to process the code segment of the original program, thereby effectively changing the packed file.

[0031] To achieve the above solution, this invention provides a program packing system including a raw program packing tool, a shell program, and a polymorphic program. Detailed descriptions of its functions and implementation are as follows: (1) Original program packer The original program packer tool is responsible for processing the original program, packaging and injecting the packer program into the original program, and finally generating the packed program. Specifically, follow these steps: Step 1: Generate a relocation table for the original program code. Scan the original program code, identify the hard-coded addresses, and record the virtual offset address of this data relative to the file load base address into the relocation table.

[0032] Step 2: Modify and store the relocation table and IAT table in the resource segment of the original program, and delete the original relocation table, IAT table, and related information. The design of the relocation table and IAT table modification and storage location should be consistent with the design of the relevant parts of the shell program; that is, the shell program should be able to read the modified relocation table and IAT table from the specified location and effectively identify the data in the tables.

[0033] The above two steps correspond to step 11 mentioned above.

[0034] Step 3: Generate a stream cipher key seed and a pseudo-randomization seed. Use the key seed to generate a key. Use a stream cipher algorithm to encrypt the original program code segment. Pseudo-randomize the encrypted data. Add the key seed and pseudo-randomization seed to the original program resource segment, and store the pseudo-randomized data in the original program code segment.

[0035] Step 4: Modify the access attributes of the original program code segment to be readable, writable, and executable.

[0036] The above two steps correspond to step 12 mentioned above.

[0037] Step 5: Generate a double-shell program. Randomly insert anti-debugging code into the functional modules of the inner shell program, encrypt the inner shell program, add the encrypted data to the outer shell program code, and add code in the outer shell program for decryption and manual loading and execution of the inner shell program. This step corresponds to step 13 mentioned above.

[0038] Step Six: Expand the original program code segment, reserve sufficient storage space for the double-shell program, write the double-shell program into the reserved storage area, record the original program entry point in the resource section, and modify the entry point to the double-shell program entry point. This step corresponds to the aforementioned Step 14.

[0039] (2) Shell program The shell program is the core of the packer system, responsible for instruction-level dynamic encryption and decryption of the original program code, execution flow jumps, and polymorphic program release. It consists of an outer shell program and an inner shell program. The specific implementation follows these steps: Step 1: The outer shell program is responsible for decrypting the inner shell program.

[0040] Step 2: Load the decrypted inner shell program at a random loading address by manually loading and executing it.

[0041] Step 3: Jump to the entry address of the inner shell program and hand over process control to the inner shell program.

[0042] The above three steps correspond to step 21 mentioned above.

[0043] Furthermore, the inner shell program consists of an inner shell program decryption module, an inner shell program encryption module, an inner shell program execution module, and a polymorphic program release module. The inner shell program decryption module is responsible for decrypting instructions, then handing them over to the inner shell program execution module for execution. After that, the inner shell program encryption module re-encrypts the instructions and jumps back to the inner shell program decryption module to decrypt the next instruction. This cycle repeats until the inner shell program decryption module exits at the point of decryption, at which point the polymorphic program release module releases the polymorphic program, and finally the packed program process exits, with the polymorphic program modifying the packed program.

[0044] Furthermore, the aforementioned inner shell program decryption module, inner shell program encryption module, inner shell program execution module, and polymorphic program release module are implemented according to the following steps: 1) Inner shell program decryption module Step 1: If this is the first run, read the pseudo-randomization seed from the resource segment of the packed program and derandomize the data in the code segment of the packed program. This step corresponds to step 22 above.

[0045] Step 2: Create a key cache table in memory, with fields including data address, data key, and remaining count. The initial remaining count is the size of the key cache table.

[0046] Step 3: Read and decrypt data byte by byte according to the address until a complete instruction is identified as the instruction to be executed based on the longest instruction principle. During decryption, first decrement the remaining count of all entries in the key cache table by 1, and then search the key cache table according to the data address. If the corresponding key exists, increment the remaining count of the corresponding entry by 1, and delete the entry with a remaining count of 0. If the corresponding key does not exist, first delete the entry with a remaining count of 0, and then calculate the decryption key according to the key seed. If the key cache table is full at this time, replace the entry with the smallest remaining count with <data address, data key, initial remaining count>; otherwise, add it directly to the key cache table.

[0047] The above two steps correspond to step 23 mentioned above.

[0048] Step 4: Identify the function of the instruction to be executed. If it is an exit instruction, jump directly to the polymorphic program release module.

[0049] Step 4: Encapsulate the starting address, instruction length, and next instruction address of the instruction to be executed into parameters and pass them to the execution module. This step corresponds to step 24 above.

[0050] 2) Inner shell program execution module Step 1: Calculate the offset of the next instruction from the starting address of the encryption module based on the address of the next instruction, modify the data at the address of the next instruction to the jump instruction to the encryption module, and record the data before modification.

[0051] Step 2: Record the address of the instruction to be executed, jump to the address of the instruction to be executed, and execute the instruction.

[0052] The above two steps correspond to step 25 mentioned above.

[0053] Because the jump instruction is set in advance, after the instruction is executed, it will automatically jump to the inner shell program encryption module.

[0054] 3) Inner shell program encryption module Step 1: Read the execution instruction address, query the key buffer table, and encrypt the instruction.

[0055] Step 2: Restore the original data at the address of the next instruction.

[0056] Step 3: Pass the address of the next instruction to the inner shell program decryption module and call the inner shell program decryption module.

[0057] The above three steps correspond to step 26 mentioned above.

[0058] 4) Polymorphic program release module Step 1: Create a notepad process, obtain the process handle, and suspend the process.

[0059] Step 2: Allocate a remote writable, readable, and executable space in the process's memory and write the polymorphic program into it.

[0060] Step 3: Create a remote thread to execute the polymorphic program.

[0061] Step 4: Exit the packed program process.

[0062] The above four steps correspond to step 28 mentioned above.

[0063] The aforementioned released polymorphic program has the functions of closing the packed program process, moving the shell program's location, randomly enabling the shell program's anti-debugging function, and using a new pseudo-randomization seed to process the original program code and encrypt data. The specific implementation steps (i.e., the polymorphic steps of the packed program) are as follows: Step 1: Traverse the process list, find the packed program, and if the packed program has not ended, obtain the process handle of the packed program and force its process to end.

[0064] Step 2: Read the disk file of the packed program, locate the shell program data in the file, randomly move it by 256~1024 bytes, and adjust the size of the packed program file, section size and other related information.

[0065] Step 3: Randomly select anti-debugging code from the shell program and modify it into junk instructions with special identifiers.

[0066] Step 4: In addition to the aforementioned junk instructions, scan the shell program for junk instructions with special identifiers and randomly modify them into anti-debugging code.

[0067] Step 5: Process the original program code to encrypt data using a new pseudo-randomization seed, and store the seed in the third byte of the packed program.

[0068] Step 6: Exit its own thread.

[0069] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A polymorphic packing method for instruction-level dynamic protection, characterized in that, This method comprises three steps: packing the original program, running the shell program, and polymorphism in the packed program. The packing step involves packing the original program, including transforming table data, encrypting code, and injecting the shell program into the original program to obtain a separately runnable packed program. The shell program consists of an outer shell program and an inner shell program. The outer shell program is responsible for loading and running the inner shell program to protect it, while the inner shell program is responsible for protecting the original program. In the shell program execution step, the shell program drives the execution of the packed program. The polymorphism step is responsible for implementing polymorphism in the packed program. The inner shell program injects the polymorphic program into other processes and modifies the packed program after it finishes running.

2. The method as described in claim 1, characterized in that, The original program packing process includes three sub-steps: original program table data transformation, code segment encryption, and shell program injection, as detailed below: Step 11: For the table data of the original program, generate a relocation table for the hard-coded addresses in its code segment, and transform it together with the import address table (IAT table). The processed data is stored in the resource segment of the original program, and the original relocation table and IAT table are deleted. Step 12: For the original program code segment, use a stream cipher algorithm to encrypt the original program code segment, perform pseudo-randomization on the encrypted data, add the key seed and pseudo-randomization seed to the original program resource segment, and add the pseudo-randomized data to the original program code segment. Modify the code segment attributes to be executable, readable, and writable; Step 13: Add anti-debugging code to the inner shell program to achieve runtime shell program protection: Prepare multiple anti-debugging codes and randomly insert them at random positions in the inner shell program; encrypt the inner shell program and add the encrypted data to the outer shell program code; add code in the outer shell program for decryption and manual loading and execution of the inner shell program. Step 14: Inject the shell program obtained in Step 13 into the blank area of ​​the original program's code segment, record the entry point of the original program, and modify the entry point of the original program to the starting address of the shell program, thereby completing the shelling of the original program and obtaining the shelled program.

3. The method as described in claim 1, characterized in that, The shell program is a piece of code wrapped around the original program to protect it. It is a piece of binary code that can be executed by the original program process. The shell program can run independently, and during the operation, the shell program can realize the dynamic encryption and decryption of instructions, execution, and polymorphism of the shell program.

4. The method as described in claim 1, characterized in that, The shell program execution steps specifically include the following sub-steps: Step 21: When the shell program starts, the outer shell program is executed first. The outer shell program decrypts and obtains the inner shell program code. Then, the inner shell program is loaded at a random loading address by manual loading and execution, and the entry point of the inner shell program is jumped to execute the inner shell program. Step 22: The inner shell program checks whether the inner shell program is running for the first time. If so, it derandomizes the code segment of the original program after pseudo-randomization processing according to the pseudo-randomization seed, and then executes the next step; otherwise, it directly executes the next step. Step 23: The inner shell program dynamically decrypts the code segment of the original program: Starting from the specified address, the inner shell program decrypts the code segment of the original program byte by byte until it identifies an instruction as the instruction to be executed based on the longest instruction principle. During decryption, it first queries the key cache table. If there is no corresponding key, it reads the key seed, generates a key, and updates the key cache table. If there is a corresponding key, it proceeds to the next step. Step 24: Obtain the starting address, instruction length, and next instruction address of the instruction to be executed; Step 25: The inner shell program dynamically executes the code segment of the original program: The inner shell program first modifies the next instruction of the instruction to be executed into a jump instruction. The jump address is the address of the encryption module of the inner shell program. Then, it obtains the original data of the next instruction before it is modified, the address of the instruction to be executed, and the length of the instruction to be executed. Finally, it jumps to the address of the instruction to be executed and executes the instruction to be executed. Step 26: The inner shell program dynamically encrypts the code segment of the original program: After the instruction to be executed is executed, the instruction to be executed is first encrypted, then the original data before the next instruction was modified is restored, and finally the next logical instruction is decrypted. Step 27: Repeat steps 23 to 26 above until an exit command is detected.

5. The method as described in claim 1, characterized in that, In the polymorphic step of the packed program, the inner shell program releases and executes the polymorphic program, which modifies the packed program to achieve polymorphism. When the inner shell program recognizes that the instruction to be executed is an exit process instruction, it injects the polymorphic program into a process other than the packed program process, and waits for the packed program process to close before modifying the packed program.

6. The method as described in claim 1, characterized in that, The functions of polymorphic programs include moving the new shell program to the position of the packed program file, randomly enabling anti-debugging of the shell program, and processing the original program's code segment with a new pseudo-randomization seed.

7. The method as described in claim 1, characterized in that, In step 11, when generating a relocation table for the hard-coded addresses in its code segment, the original program code is scanned, the hard-coded addresses are identified, and the virtual offset address of the hard-coded address relative to the file load base address is recorded in the relocation table. The design of the relocation table and IAT table deformation and storage location should be consistent with the design of the relevant parts of the shell program, that is, the shell program can read the deformed relocation table and IAT table from the specified location and can effectively identify the data in the table.

8. The method as described in claim 4, characterized in that, In step 23, the fields in the key cache table include data address, data key, and remaining count. The initial remaining count is the size of the key cache table. When decrypting the code segment of the original program, data is read and decrypted byte by byte according to the address until a complete instruction is identified as the instruction to be executed based on the longest instruction principle. During decryption, the remaining count of all entries in the key cache table is decremented by 1. Then, the key cache table is searched according to the data address. If the corresponding key exists, the remaining count of the corresponding entry is incremented by 1, the entry with a remaining count of 0 is deleted, and then the next step is executed. If the corresponding key does not exist, the entry with a remaining count of 0 is deleted, and then the key is calculated according to the key seed. If the key cache table is full at this time, the entry with the smallest remaining count is replaced by <data address, data key, initial remaining count>. Otherwise, <data address, data key, initial remaining count> is directly added to the key cache table to update the key cache table.

9. The method according to any one of claims 1 to 8, characterized in that, The specific polymorphic steps of the packed program are as follows: Step 1: Traverse the process list, find the packed program, and if the packed program has not ended, obtain the process handle of the packed program and force the packed program process to end. Step 2: Read the disk file of the packed program, locate the shell program data in the disk file, randomly move it by 256~1024 bytes, and adjust the file size and section size of the packed program; Step 3: Randomly select anti-debugging code from the shell program and modify it into junk instructions with preset identifiers; Step 4: Scan the shell program for junk instructions with preset identifiers and randomly modify them into anti-debugging code; Step 5: Process the original program code encrypted data using a new pseudo-randomization seed, and store the new pseudo-randomization seed in the third byte of the packed program.

10. A system for implementing the method as described in any one of claims 1 to 9, characterized in that, It includes the original program packing tool, the shell program, and the polymorphic program; the original program packing tool is responsible for processing the original program, packaging and injecting the shell program into the original program, and finally generating the packed program; The shell program is responsible for performing instruction-level dynamic encryption and decryption of the original program code, execution flow jumps, and polymorphic program release; the polymorphic program is used to implement functions such as closing the packed program process, moving the shell program position, randomly enabling the shell program for anti-debugging, and using a new pseudo-randomization seed to process the encrypted data of the original program code.

Images