基于融合编译的软件多样化保护方法

熊小兵; 舒辉; 康绯

doi:10.11959/j.issn.2096-109x.2020075

您当前的位置：

首页 >

文章列表页 >

基于融合编译的软件多样化保护方法

专栏：网络应用与防护技术 | 更新时间：2024-06-03

- 基于融合编译的软件多样化保护方法
- Method of diversity software protection based on fusion compilation
- 网络与信息安全学报 2020年6卷第6期页码：13-24
- 作者机构：
- 作者简介：
  
  [ "熊小兵（1985- ），男，江西丰城人，博士，信息工程大学讲师，主要研究方向为网络信息安全、软件逆向分析。 " ]
  [ "舒辉（1974- ），男，江苏盐城人，博士，信息工程大学教授、博士生导师，主要研究方向为网络信息安全、嵌入式系统分析与信息安全。 " ]
  [ "康绯（1972- ），女，北京人，信息工程大学教授，主要研究方向为网络信息安全、加解密机制分析。 " ]
- 基金信息：
  
  国家重点研发计划基金资助项目;The National Key R＆D Plan Program of China(2016YFB08011601)
- DOI：10.11959/j.issn.2096-109x.2020075
  中图分类号： TP393
- 网络首发：2020-12，
  
  纸质出版：2020-12-15
- 稿件说明：
移动端阅览
熊小兵, 舒辉, 康绯. 基于融合编译的软件多样化保护方法[J]. 网络与信息安全学报, 2020,6(6):13-24.

Xiaobing XIONG, Hui SHU, Fei KANG. Method of diversity software protection based on fusion compilation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 13-24.
熊小兵, 舒辉, 康绯. 基于融合编译的软件多样化保护方法[J]. 网络与信息安全学报, 2020,6(6):13-24. DOI： 10.11959/j.issn.2096-109x.2020075.

Xiaobing XIONG, Hui SHU, Fei KANG. Method of diversity software protection based on fusion compilation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 13-24. DOI： 10.11959/j.issn.2096-109x.2020075.

摘要

针对现有主流保护方法存在的特征明显、模式单一等问题，以 LLVM 开源编译框架为基础，提出了一种基于融合编译的软件多样化保护方法，该方法将目标软件进行随机化加密处理，并在编译层面与掩护软件进行深度融合，通过内存执行技术，将加密后的目标软件进行解密处理，进而在内存中以无进程的形式执行，利用掩护代码的多样性、融合策略的随机性来实现目标软件的多样化保护效果。选取了多款常用软件作为测试集，从资源开销、保护效果、对比实验等多个角度对所提方法进行了实例测试，从测试结果可以看出，所提方法资源开销较小，相较于混淆、加壳等传统方法，所提方法在抗静态分析、抗动态调试等方面具有较大优势，能有效对抗主流代码逆向分析和破解手段。

Abstract

For the obvious characteristics and single mode of the existing common protection methods

with the help of the LLVM framework

a diversity software protection method based on fusion compilation was proposed.In the proposed method

the target software is encrypted randomly

and deeply integrated with the bunker code at the compilation level

and the encrypted target software is decrypted by memory execution technology.Then it is executed in the form of no process in memory

and the diversified protection effect of the target software is realized by the diversity of the bunker and the randomness of the fusion strategies.A number of commonly used software are selected as the test case

and the proposed method is tested from the aspects of resource cost

protection effect

comparative experiment and so on.Compared with the traditional methods such as obfuscation and packing

the proposed method has great advantages in anti-static analysis and anti-dynamic debugging

and can effectively resist the mainstream methods of reverse analyzing and cracking.

关键词

Keywords

references

周国祥 , 陆文海 . 基于 BHO 技术的数字版权保护系统的研究与设计 [J ] . 计算研究与发展 , 2010 , 47 ( 6 ): 316 - 320 .

ZHOU G X , LU W H . Application of BHO-based PDF digital management system [J ] . Journal of Computing Research and Development , 2010 , 47 ( 6 ): 316 - 320 .

刘芳 , 金松根 , 卢国强 . 数字版权管理与数字图书馆建设 [J ] . 图书馆学刊 , 2011 ( 4 ): 105 - 108 .

LIU F , JIN S G , LU G Q . Digital copyright management and digital library construction [J ] . Journal of Library Science , 2011 ( 4 ): 105 - 108 .

国务院 . 计算机软件保护条例 [J ] . 新疆新闻出版 , 2013 ( 2 ): 82 - 84 .

State Council . Regulations of protecting computer software [J ] . Publishing House of Xinjiang News , 2013 ( 2 ): 82 - 84 .

刘军 . 基于 CUDA 的软件保护技术研究与实现 [D ] . 长沙:湖南大学 , 2011 : 5 - 25 .

LIU J . The Research and implementation of CUDA-assisted software protection technology [D ] . Changsha:Hunan University , 2011 : 5 - 25 .

高艳军 . 数据安全管理系统加壳技术研究与实现 [D ] . 长沙:国防科学技术大学 , 2008 : 15 - 30 .

GAO Y J . Research and Implementation of packing technique for data security management System [D ] . Changsha:National University of Defense Technology , 2008 : 15 - 30 .

马珂 . 基于虚拟机的内核模块行为分析技术研究 [D ] . 湘潭:湘潭大学 , 2014 : 20 - 28 .

MA K . Research on the technologies of kernel module behavior analysis based on VMM [D ] . Xiangtan:Xiangtan University , 2014 : 20 - 28 .

郝景超 . Windows下软件实名机制的设计与实现 [D ] . 郑州:解放军信息工程大学 , 2008 : 24 - 36 .

HAO J C . Design and realization of the software real name mechanism in windows system [D ] . Zhengzhou:PLA Information Engineering University , 2008 : 24 - 36 .

李勇 . 基于 Windows 平台的目标代码混淆 [D ] . 成都:电子科技大学 , 2007 : 37 - 45 .

LI Y . Object code obfuscation based on Windows platform [D ] . Chengdu:University of Electronic Science and Technology of China , 2007 : 37 - 45 .

房鼎益 , 张恒 , 汤战勇 , 等 . 一种抗语义攻击的虚拟化软件保护方法 [J ] . 四川大学学报(工程科学版) , 2017 , 49 ( 1 ): 159 - 168 .

FANG D Y , ZHANG H , TANG Z Y , et al . DAS-VMP:a virtual machine-based software protection method for defending against semantic attacks [J ] . Journal of Sichuan University (Engineering Science Edition) , 2017 , 49 ( 1 ): 159 - 168 .

TANG Z , LI G , FANG D , et al . Code virtualized protection system with instruction set randomization [J ] . Journal of Huazhong University of Science ＆ Technology , 2016 , 44 ( 3 ): 28 - 33 .

KUANG K , TANG Z , GONG X , et al . Exploiting dynamic scheduling for VM-based code obfuscation [C ] // Proc of the Trustcom/Bigdatase/Ispa . 2017 . 489 - 496 .

COLLBERG C , THOMBORSON C , LOW D . A taxonomy of obfuscating transformations [J ] . Department of Computer Science the University of Auckland New Zealand , 1997

COLLBERG C , THOMBORSON C , LOW D . Manufacturing cheap,resilient,and stealthy Opaque constructs [C ] // Proc.25th ACM SIGPLANSIGACT Symposium on Principles of Programming Languages '98 . 1998 : 184 - 196 .

BANESCU S , COLLBERG C , GANESH V , et al . Code obfuscation against symbolic execution attacks [C ] // Proceedings of the 32nd Annual Conference on Computer Security Applications . 2016 : 189 - 200 .

WANG Z , JIA C F , LIU W J , et al . Branch obfuscation to combat symbolic execution [J ] . Acta Electronica Sinica , 2015 , 43 ( 5 ): 870 - 878 .

潘雁 , 祝跃飞 , 林伟 . 基于指令交换的代码混淆方法 [J ] . 软件学报 , 2019 , 30 ( 6 ): 1778 - 1792 .

PAN Y , ZHU Y F , LIN W . Code obfuscation based on instructions swapping [J ] . Journal of Software , 2019 , 30 ( 6 ): 1788 - 1792 .

BALACHANDRAN V , KEONG N W , EMMANUEL S . Function level control flow obfuscation for software security [C ] // Eighth International Conference on Complex,Inteligence and Software Intensive Systems . 2014 : 133 - 140 .

王志 . 二进制代码路径混淆技术研究 [D ] . 天津:南开大学 , 2012 .

WANG Z . Research on binary code path obfuscation [D ] . Tianjin:Nankai University , 2012 :

TAMBOLI T , AUSTIN T H , STAMP M . Metamorphic code generation from LLVM bytecode [J ] . Journal of Computer Virology ＆Hacking Techniques , 2014 , 10 ( 3 ): 177 - 187 .

章立春 . 一种PE程序文件加载执行方法,CN 104331308 A [P ] . 2015 .

ZHANG L C . A method for loading and executing PE program files,CN 104331308 A [P ] . 2015 .

ZHOU J . Method and apparatus for bypassing hook:CN 101414338 B [P ] . 2012 .

WANG H , FANG D , LI J , et al . The research and discussion on effectiveness evaluation of software protection [C ] // Proc of the Int’l Conf on Computational Intelligence and Security . 2016 . 628 - 632 .

SCHULMAN A . Finding binary clones with opstrings and function digests [J ] . Dr.Dobb’s Journal , 2005 , 30 ( 9 ): 64 - 70 .

ZYNAMICS . Sabre BinDiff [EB ] .

浏览量

392

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于图神经网络的代码漏洞检测方法

基于代码碎片化的软件保护技术