Software protection technology based on code fragmentation

Jingcheng GUO; Hui SHU; Xiaobing XIONG; Fei KANG

doi:10.11959/j.issn.2096-109x.2020063

您当前的位置：

首页 >

文章列表页 >

Software protection technology based on code fragmentation

Special Column:Network Application and Protection Technology | 更新时间：2024-06-03

- Software protection technology based on code fragmentation
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 57-68(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020063
  CLC： TP309.5
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Jingcheng GUO, Hui SHU, Xiaobing XIONG, et al. Software protection technology based on code fragmentation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 57-68.
DOI：

Jingcheng GUO, Hui SHU, Xiaobing XIONG, et al. Software protection technology based on code fragmentation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 57-68. DOI： 10.11959/j.issn.2096-109x.2020063.

摘要

针对当前软件保护技术存在的不足，提出一种代码碎片化技术，该技术是一种以函数为单元，对函数进行代码shell化、内存布局随机化、执行动态链接化的新型软件保护技术，代码shell化实现代码碎片的位置无关变形，内存布局随机化实现代码碎片的随机内存加载，动态链接化实现对代码碎片的动态执行，通过上述3个环节实现对程序的碎片化处理。实验表明，代码碎片化技术不仅能实现程序执行过程中函数碎片内存位置的随机化，还能实现函数碎片的动态链接执行，增加程序静态逆向分析和动态逆向调试的难度，提高程序的抗逆向分析能力。

Abstract

Aiming at the shortcomings of the current software protection technology

a code fragmentation technology was proposed.This technology is a new software protection technology that takes functions as units

shells functions

randomizes memory layout

and performs dynamic linking.The code shellization realizes the position-independent morphing of code fragments

the memory layout randomizes the random memory loading of the code fragments

the dynamic linking realizes the dynamic execution of the code fragments

and the program fragmentation processing is achieved through the above three links.The experiments show that the code fragmentation technology can not only realize the randomization of the memory location of function fragments during program execution

but also the dynamic link execution of function fragments

increasing the difficulty of static reverse analysis and dynamic reverse debugging of the program

and improving the anti-reverse analysis ability of the program.

关键词

Keywords

references

许团 , 屈蕾蕾 , 石文昌 . 基于结构特征的二进制代码安全缺陷分析模型 [J ] . 网络与信息安全学报 , 2017 , 3 ( 9 ): 31 - 39 .

XU T , QU L L , SHI W C . Analysis model of binary code security flaws based on structure characteristics [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 9 ): 31 - 39 .

孙博文 , 黄炎裔 , 温俏琨 , 等 . 基于静态多特征融合的恶意软件分类方法 [J ] . 网络与信息安全学报 , 2017 , 3 ( 11 ): 68 - 76 .

SUN B W , HUANG Y Y , WEN Q K , et al . Malware classification method based on static multiple-feature fusion [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 11 ): 68 - 76 .

李伟明 , 邹德清 , 孙国忠 . 针对恶意代码的连续内存镜像分析方法 [J ] . 网络与信息安全学报 , 2017 , 3 ( 2 ): 20 - 30 .

LI W M , ZOU D Q , SUN G Z . Successive memory image analysis method for malicious codes [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 2 ): 20 - 30 .

王健 . 基于完整性验证和壳的软件保护技术研究 [D ] . 太原:中北大学 , 2018 .

WANG J . Research on software protection technology based on in-tegrity verification and shell [D ] . Taiyuan:North China University , 2018 .

杜春来 , 孔丹丹 , 王景中 , 等 . 一种基于指令虚拟化的代码保护模型 [J ] . 信息网络安全 , 2017 ( 2 ): 22 - 28 .

DU C L , KONG D D , WANG J Z , et al . A code protection model based on instruction virtualization [J ] . Netinfo Security , 2017 ( 2 ): 22 - 28 .

BALACHANDRAN V , EMMANUEL S , KEONG N . Obfuscation by code fragmentation to evade reverse engineering [C ] // 2014 IEEE International Conference on Systems,Man,and Cybernetics (SMC . 2014 .

BALACHANDRAN V , KEONG N W , EMMANUEL S . Function level control flow obfuscation for software security [C ] // Eighth International Conference on Complex,Intelligence and Software Intensive Systems . 2014 : 133 - 140 .

LASZLO T , KISS A . Obfuscating C++ programs via control flow flattening [R ] . 2009 .

JUNOD P , RINALDINI J , WEHRLI J , et al . Obfusca-torLLVM-software protection for the masses [C ] // 2015 IEEE/ACM 1st International Workshop on Software Protection . 2015 : 3 - 9 .

DAVIDSON J , HILL J , KNIGHT J . Protection of software-based survivability mechanisms [C ] // 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . 2001 : 193 - 193 .

WANG C , HILL J , KNIGHT J . Software tamper resistance:obstructing static analysis of programs [J ] . 2000 :

WANG C . A security architecture for survivability mechanisms [D ] . Virginia:University of Virginia,School of Engineering and Applied Science , 2000 .

蒋华 , 刘勇 , 王鑫 . 基于控制流的代码混淆技术研究 [J ] . 计算机应用研究 , 2013 , 30 ( 3 ): 897 - 899 .

JIANG H , LIU Y , WANG X . Code confusion technology research based on control flow [J ] . Application Research of Computers , 2013 , 30 ( 3 ): 897 - 899 .

王旭 . 基于目标代码的控制流混淆技术研究 [D ] . 北京:北京邮电大学 , 2013 .

WANG X . Research on control flow obfuscation technology based on object code [D ] . Beijing:Beijing University of Posts and Telecommunications , 2013 .

王丰峰 , 张涛 , 徐伟光 , 等 . 进程控制流劫持攻击与防御技术综述 [J ] . 网络与信息安全学报 , 2019 , 5 ( 6 ): 10 - 20 .

WANG F F , ZHANG T , XU W G , et al . Overview of control-flow hijacking attack and defense techniques for process [J ] . Chinese Journal of network and information security , 2019 , 5 ( 6 ): 10 - 20 .

乔向东 , 郭戎潇 , 赵勇 . 代码复用对抗技术研究进展 [J ] . 网络与信息安全学报 , 2018 , 4 ( 3 ): 1 - 12 .

QIAO X D , GUO R X , ZHAO Y . Research progress in code reuse attacking and defending [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 3 ): 1 - 12 .

Views

307

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on link detection technology based on dynamic browser fingerprint

Method of diversity software protection based on fusion compilation

Related Author

Fan GAO

Jian WANG

Jiqiang LIU

Xiaobing XIONG

Hui SHU

Fei KANG

Related Institution

No data

⁰