CN112115427B - Code confusion method, device, electronic equipment and storage medium - Google Patents

Abstract

The embodiment of the invention provides a code confusion method, a device, electronic equipment and a storage medium; the method comprises the following steps: determining basic code blocks in a function according to the control flow trend of the function in a target program; dividing the basic code blocks to obtain sub code blocks; converting a target address of an unconditional jump instruction in a code block into an address determined when the target program runs; wherein the code blocks comprise sub-code blocks or sub-code blocks and basic code blocks which are not segmented. According to the code confusion method, the device, the electronic equipment and the storage medium, the target address of the unconditional jump instruction in the code block is converted into the address determined when the target program runs, so that the direct jump relation between the code block with the unconditional jump instruction and the code block to be jumped is cut off, and the difficulty of reverse analysis is increased.

Description

Code obfuscation method, device, electronic device and storage medium

Technical Field

The present invention relates to the field of computer security technology, and in particular to a code obfuscation method, device, electronic device and storage medium.

Background technique

With the development of information science and technology, software systems bring convenience to users, but their security also faces serious threats. Attackers can easily obtain user private information, core algorithms, key business processes, and even software source code contained in the software through reverse means such as decompilation, disassembly, and dynamic debugging. This has caused huge losses to the company's software intellectual property protection.

In order to effectively resist the reverse analysis of software by attackers, software developers have proposed protection technologies such as software encryption, code obfuscation, software watermarking, and anti-tampering. Code obfuscation technology is one of the key technologies to ensure software security. Without changing the semantics of the original program, it converts the source code and internal structure logic of the program into a form that is more difficult to analyze and modify, greatly increasing the cost of reverse analysis for attackers.

Control flow obfuscation is a relatively mature and key technology in code obfuscation. It hides the real execution logic of the program by changing the control flow of the original program or making the control flow complicated, making it more difficult for crackers to analyze and reconstruct the control flow of the program, thereby protecting the source code. The implementation methods of control flow obfuscation technology that are currently being studied include:

(1) Opaque predicates

For the basic blocks in the control flow graph, add opaque predicates whose values are always true, always false, or sometimes true and sometimes false, which are difficult to infer from the expression itself, to confuse the actual execution flow of the basic blocks and make the control flow more complicated.

(2) Control flow flattening

By destroying the easily identifiable conditions and loop structures in the function control flow graph, the easy-to-read code flow is reorganized into a difficult-to-understand switch case code execution flow.

(3) Inserting false control flow

By using opaque predicate technology, redundant control flows are inserted into the original control flow, increasing the complexity of the original control flow and making it more difficult for attackers to reconstruct the original control flow.

The features of the program after being obfuscated using the above control flow obfuscation method are obvious, and it is easy for attackers to discover and crack it using existing reverse engineering techniques to restore the code control flow. For example, the frequently used opaque predicates are a limited number of complex mathematical expressions, which can be collected and sorted and directly filtered out during reverse analysis; for example, after the control flow is flattened, the program has an obvious switch case structure, and the execution order of the code blocks can be recorded during the dynamic debugging process to reconstruct the control flow.

Summary of the invention

The embodiments of the present invention provide a code obfuscation method, device, electronic device and storage medium, which are used to solve the defect that after the code obfuscation method in the prior art obfuscates the program code, the program features are more obvious and can be easily discovered and cracked by attackers.

A first aspect of the present invention provides a code obfuscation method, comprising:

Determine the basic code block in the function according to the control flow direction of the function in the target program;

Splitting the basic code block to obtain sub-code blocks;

Converting a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block.

In the above technical solution, after the step of dividing the basic code block to obtain sub-code blocks, the method further includes:

The arrangement order of the code blocks in the function in the target program is disrupted.

In the above technical solution, converting the target address of the non-conditional jump instruction in the code block into an address determined when the target program is running specifically includes:

An address calculation code block is inserted between a first code block having an unconditional jump instruction and a second code block to be jumped according to the unconditional jump instruction, and the jump target of the unconditional jump instruction is changed to the address calculation code block; wherein the address calculation code block is used to dynamically calculate the address of the second code block at runtime.

In the above technical solution, inserting an address calculation code block between a first code block having an unconditional jump instruction and a second code block to be jumped according to the unconditional jump instruction specifically includes:

Inserting an address calculation code block between the first code block and the second code block;

Calculating an address offset between the address calculation code block and the second code block according to the address information of the address calculation code block and the address information of the second code block;

The address to be jumped by the unconditional jump instruction in the address calculation code block is modified into an address calculation formula, wherein the address calculation formula includes: the address information of the address calculation code block itself, and the address offset between the address calculation code block and the second code block.

In the above technical solution, the method further comprises:

The direct calling instruction to the system function in the target program is replaced by an indirect calling instruction to the system function.

In the above technical solution, the step of replacing the direct call instruction to the system function in the target program with the indirect call instruction to the system function specifically includes:

Generate an indirect call instruction according to the real address of the system function and the dynamic link library, wherein the indirect call instruction obtains the real address of the system function to be executed by parsing the function address in the dynamic link library;

Replace the direct call instructions to the system function in the target program with indirect call instructions to the system function.

In the above technical solution, the basic code block is segmented according to the second preset rule to obtain sub-code blocks, which specifically includes:

Determine whether the basic code block satisfies a preset rule, and when the preset rule is satisfied, segment the basic code block to obtain a first segmentation result;

Determine whether there is a jump instruction at the end of the first segmentation result. When there is no jump instruction, add a jump instruction at the end of the first segmentation result to obtain a sub-code block; wherein the jump instruction is used to jump to the next instruction of the last instruction of the first segmentation result in the basic code block.

A second aspect of the present invention provides a code obfuscation device, comprising:

A basic code block determination module, used to determine a basic code block in a function in a target program according to the control flow direction of the function;

A sub-code block generation module, used for segmenting the basic code block to obtain sub-code blocks;

An instruction conversion module is used to convert the target address of the non-conditional jump instruction in the code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block.

The third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the code obfuscation method described in the first aspect of the present invention are implemented.

The fourth aspect of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the code obfuscation method described in the first aspect of the present invention are implemented.

The code obfuscation method, device, electronic device and storage medium provided by the embodiments of the present invention convert the target address of the unconditional jump instruction in the code block into an address determined when the target program is running, thereby cutting off the direct jump relationship between the code block with the unconditional jump instruction and the code block to be jumped, thereby increasing the difficulty of reverse analysis.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a flow chart of a code obfuscation method provided by an embodiment of the present invention;

FIG2 is a schematic diagram of inserting an address calculation code block between a code block having a non-conditional jump instruction and a code block to be jumped;

Figure 3 shows a control flow graph of a function before it is obfuscated, viewed using the reverse engineering tool IDA;

FIG4 is a control flow graph of the function related to FIG3 after being obfuscated, viewed using the reverse engineering tool IDA;

FIG5 is a schematic diagram of a code obfuscation device provided by an embodiment of the present invention;

FIG6 is a schematic diagram of a physical structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

FIG. 1 is a flow chart of a code obfuscation method provided by an embodiment of the present invention. As shown in FIG. 1 , the code obfuscation method provided by an embodiment of the present invention includes:

Step 101: Determine a basic code block in a function in a target program according to the control flow direction of the function.

In the embodiment of the present invention, the target program refers to a program that is obfuscated using the code obfuscation method provided by the embodiment of the present invention. Specifically, the function in the target program is the object of the code obfuscation operation, that is, the code in the function contained in the target program needs to be obfuscated.

Those skilled in the art know that a function in the computer field is a fixed program segment that can independently complete a specific function. The basic unit of a function is an instruction. Executing an instruction can achieve a specific operation. A basic code block is between a function and an instruction. A basic code block includes multiple instructions, and a function can include one or more basic code blocks.

The execution logic inside the target program is called the control flow. The control flow reflects the calling relationship between functions and the execution flow of each instruction inside the function. As an optional implementation method, the control flow of the function of the target program can be represented by a control flow graph.

In the embodiment of the present invention, the control flow direction is obtained by pre-analysis. In other embodiments of the present invention, the target program can also be analyzed by the tools and function libraries provided by LLVM to obtain the control flow direction of the function of the target program. LLVM compiles the source code of the target program into an intermediate code file, parses the intermediate code file, and traverses the functions in the intermediate code file to obtain the control flow direction of the function.

As an optional implementation method, you can use the tools and function libraries provided by LLVM to analyze the control flow of the function, replace all switch-case structures in the function with if-else structures, and obtain the basic code blocks of the original control flow of the function. Since the switch-case structure can be easily used by attackers to reverse analyze the target program, it is necessary to replace all switch-case structures in the function with if-else structures.

According to the control flow direction of the target program, the function is further segmented to obtain basic code blocks. When the function is further segmented, the basic code blocks can be segmented from the function according to the control flow direction of the function in the target program and the first preset rule.

According to the first preset rule, the starting instruction of the basic code block can be determined, and the first preset rule includes any one of the following three items:

a) Function entry instruction;

b) target instruction of jump instruction;

c) The next instruction after the jump instruction and this instruction is not the target instruction of the jump instruction.

After the start instruction of the basic code block is determined, all instructions between the start instructions of two basic code blocks in the same function (excluding the second start instruction) form a basic code block.

It should be noted that it is easy for those skilled in the art to understand that if a function includes a switch-case structure, after the switch-case structure is replaced, the basic code block obtained by further segmenting the function will no longer have the switch-case structure.

Step 102: Segment the basic code block to obtain sub-code blocks.

In order to further increase the difficulty of reverse analysis, in the embodiment of the present invention, the basic code block may be further divided to obtain sub-code blocks.

The sub-code block is a part of the basic code block, including multiple instructions. Before the basic code block is segmented, it is necessary to first determine whether the basic code block meets the second preset rule. The second preset rule is used to describe the segmentation condition of the basic code block. For example, one implementation method of the second preset rule is a preset number of instructions, such as 5. When determining whether the basic code block meets the second preset rule, determine whether the number of instructions in the basic code block is 5. If it is greater than or equal to 5, the basic code block meets the second preset rule and can be further segmented; if it is less than 5, the basic code block cannot be segmented. The content of the second preset rule is not limited to the preset number of instructions, and the content of the second preset rule can also be determined according to actual needs.

The second preset rule can not only be used to determine whether the basic code block can be split, but also can be used to guide the splitting of the basic code block. When the basic code block is split, the basic code block can be split according to the second preset rule (such as the preset number of instructions) to obtain sub-code blocks. For example, it is preset that every 5 instructions form a sub-code block, then when splitting the basic code block, the 5 consecutive instructions in the basic code block are split as a basic unit to obtain the corresponding sub-code block. If the basic code block has less than 5 instructions left after a certain split, the remaining instructions can be used as a basic unit to form a sub-code block.

It should be noted that when generating a basic code block, the jump instruction is used as the dividing line, so the logical relationship between the basic code blocks obtained by segmentation will not be interrupted. However, when generating a sub-code block, except for a few sub-code blocks (such as the sub-code block at the end of the basic code block), there are no instructions such as jump instructions at the end of the sub-code block that have a clear logical relationship with other sub-code blocks before being segmented. Therefore, when segmenting a basic code block and generating a sub-code block, a jump instruction needs to be added to the end of the sub-code block to clarify the next sub-code block to be executed after the current sub-code block is executed.

For example, a basic code block in a function is as follows:

label%3:

%4 = alloca i8*, align 8

%5 = alloca i32*, align 8

%6 = alloca i32*, align 4

%7 = alloca i32*, align 4

%8 = alloca i32*, align 4

store i8*%0,i8**%4,align 8

store i32*%1,i32**%5,align 8

store i32*%2,i32**%6,align 4

store i32*%0,i32**%7,align 4

store i32*%0,i32**%8,align 4

br label%9

By dividing the above basic code block according to certain rules, the following multiple sub-code blocks can be obtained:

Subcode block 1

label%3:

%4 = alloca i8*, align 8

%5 = alloca i32*, align 8

%6 = alloca i32*, align 4

br label%.split

Subcode block 2

label.split:

%7 = alloca i32*, align 4

%8 = alloca i32*, align 4

br label%.split.split

Subcode block 3

label.split.split:

store i8*%0,i8**%4,align 8

br label%.split.split.split

Subcode block 4

label.split.split.split:

store i32*%1,i32**%5,align 8

store i32*%2,i32**%6,align 4

store i32*%0,i32**%7,align 4

store i32*%0,i32**%8,align 4

br label%9

It can be seen from the above example that jump instructions are newly added to the tails of sub-code blocks 1 to sub-code blocks 3 newly divided from the basic code block, and the next sub-code block can be jumped according to these newly added jump instructions.

Step 103: Convert the target address of the non-conditional jump instruction in the code block to an address determined when the target program is running.

After the operations in the previous steps, each function in the target program includes sub-code blocks. In some cases, some basic code blocks in the function do not meet the conditions for segmentation, so the function also includes unsegmented basic code blocks. The unsegmented basic code blocks (if any) and sub-code blocks are uniformly recorded as code blocks.

The converting the target address of the non-conditional jump instruction in the code block into an address determined when the target program is running specifically includes:

An address calculation code block is inserted between a first code block having an unconditional jump instruction and a second code block to be jumped according to the unconditional jump instruction, and the jump target of the unconditional jump instruction is changed to the address calculation code block; the address calculation code block is used to dynamically calculate the address of the second code block at runtime.

Jump instructions include conditional jump instructions and unconditional jump instructions. Unconditional jump instructions are also called direct jump instructions, which require jump operations without conditional judgment. Jump instructions can clearly reflect the execution order of the target program, so in order to increase the difficulty of reverse analysis, jump instructions need to be hidden.

Specifically, an address calculation code block is inserted between a first code block having an unconditional jump instruction and a second code block to be jumped, and at the same time, the direct control flow relationship between the first code block having an unconditional jump instruction and the second code block to be jumped according to the unconditional jump instruction is cut off by modifying the target address of the unconditional jump instruction of the first code block, that is, the target address of the unconditional jump instruction of the first code block is modified from the second code block to the address calculation code block. The address calculation module includes an unconditional jump instruction, and the address to be jumped by the unconditional jump instruction is an address calculation formula, and the address calculation formula includes: the address information of the address calculation code block itself, and the address offset between the address calculation code block and the second code block. The address offset between the address calculation code block and the second code block can be pre-calculated based on the address information of the address calculation code block and the address information of the second code block.

When the target program is running, it can determine the specific value of the address information of the address calculation code block itself, and then calculate the address information of the second code block in combination with the address offset between the address calculation code block and the second code block, thereby realizing a jump to the second code block.

This operation can cut off the direct jump relationship between the first code block and the second code block, so that the address of the second code block can only be dynamically calculated when the target program is running, which increases the difficulty of reverse analysis.

For example, FIG. 2 is a schematic diagram of inserting an address calculation code block between a code block with an unconditional jump instruction and a code block to be jumped. In the embodiment shown in FIG. 2 , it is assumed that there are code blocks A and code blocks B in the target program, and the leftmost side of FIG. 2 describes the original execution flow of code blocks A and code blocks B. According to the original execution flow, code block A directly jumps to code block B, and code block A includes a pseudo jump instruction Jump B (which can actually be various types of instructions such as jump, mov, bx, jne, etc.). According to the description of the embodiment of the present invention, first, a code block T is added between code block A and code block B. At this time, the content of code block T only includes an instruction to jump to code block B, and at the same time, the instruction Jump B in code block A that jumps to code block B is changed to the instruction Jump T that jumps to code block T. The middle part of FIG. 2 describes adding code block T between code block A and code block B. Next, the address offset between code block B and code block T is calculated, which is recorded as offset. Modify the content of code block T as follows: Get the address of T, modify the direct jump instruction to an indirect jump, that is, replace the Jump B instruction in code block T that directly jumps to code block B with Jump T+offset, thereby cutting off the direct jump relationship between code block A and code block B, so that the address of code block B can only be calculated dynamically at runtime. The rightmost side of Figure 2 describes the modification of the address content in code block T.

The code obfuscation method provided by the embodiment of the present invention converts the target address of the unconditional jump instruction in the code block into an address determined when the target program is running, thereby cutting off the direct jump relationship between the code block with the unconditional jump instruction and the code block to be jumped, thereby increasing the difficulty of reverse analysis.

Based on any of the above embodiments, in an embodiment of the present invention, after step 102, the method further includes:

Disrupt the order of code blocks within the target program's functions.

There is a linear order between the code blocks within each function. In order to increase the difficulty of reverse analysis, in this embodiment, the order between the code blocks within the function is disrupted.

Specifically, in an embodiment of the present invention, a number may be set for each code block in a function, and a random array reflecting the code block number may be generated. For example, there are N code blocks in a function, and these code blocks are numbered in order from 1 to N. After the code blocks are numbered, a random array of size N, content from 1 to N and no repeated data may be generated. The numbers in this random array are not sorted according to the size of the numbers, but are randomly sorted.

With the random array, the code blocks can be rearranged in the order of the random array to achieve the purpose of destroying the original layout of the function. For example, the numbers in a random array of size 10 are arranged as follows: 1, 3, 8, 5, 7, 4, 6, 2, 9, 10. When sorting the code blocks, the code block numbered 1 is placed at the first position in the function, followed by the code block numbered 3 at the second position in the function, followed by the code block numbered 8 at the third position in the function, and so on, and finally the code block numbered 10 is placed at the tenth position in the function.

It should be noted that, in the embodiment of the present invention, disrupting the order of code blocks within a function refers to disrupting the static layout order of the code blocks in the function. Since each code block contains a jump instruction, the dynamic execution logic of the entire function is not changed, and the function can still be executed normally.

The target program includes multiple functions, and the order of the code blocks inside each function can be disrupted according to the above description.

The code obfuscation method provided by the embodiment of the present invention obtains basic code blocks from the functions included in the target program, divides the basic code blocks to obtain sub-code blocks, and then arranges the undivided basic code blocks and sub-code blocks in the function in random order, thereby changing the content layout of each function in the target program, thereby increasing the difficulty of reverse analysis.

Based on any of the above embodiments, in an embodiment of the present invention, the method further includes:

Replace the direct call instructions to the system function in the target function with indirect call instructions to the system function.

In the embodiment of the present invention, the system function refers to a library function specified by the C language standard, such as a function in glibc. The system function easily exposes the location of certain key codes, so the system function in the target program needs to be hidden.

In the specific implementation, the direct call instruction of the system function in the target program is replaced with an indirect call instruction of the system function, and the indirect call instruction obtains the real address of the system function to be executed by parsing the function address in the dynamic link library. For example, under Linux, the address of the system function to be executed is parsed through the dlsym function form, thereby introducing the system function; under Windows, the address of the system function to be executed is obtained through the GetProcAddress function form, thereby introducing the system function.

For example, in one embodiment, the functions in the target program are first traversed, the system functions in the function calls are analyzed and obtained, and the system functions are recorded as sysFunc; then, the system function name is encrypted to obtain the encrypted system function name encStr; then, all system function call instructions in the target program are converted into indirect call instructions, specifically including: using dlsym to load the system function to be called, recording the name of the related function as indirectCall, and the system function name will be decrypted at runtime; finally, the function indirectCall replaces the previous system function in the target function.

The relevant codes corresponding to this embodiment are as follows:

Before the system function is replaced:

…

sysFunc(…)

…

After the system function is replaced:

…

encStr = encode("sysFunc");

indirectCall = dls ym ((void*)0, decode (encStr))

indirectCall(…)

…

After the above operations, the calls to the system functions in the target program are hidden, making it impossible for attackers to find the system functions in the target program through reverse analysis.

In the above embodiment, as a preferred implementation, while replacing the direct call instruction of the system function with the indirect call instruction of the system function, the operation of encrypting the system function name is also performed. This can further deepen the obfuscation degree of the system function. In other embodiments, the operation of encrypting the system function name can also be omitted according to actual needs.

The code obfuscation method provided by the embodiment of the present invention hides the call to the system function in the target program, so that the attacker cannot find the system function in the target program through reverse analysis, which can effectively prevent static analysis and delay the copying or tampering of the software.

In order to illustrate the technical effect of the code obfuscation method provided by the embodiment of the present invention, the control flow graphs of the target program before and after code obfuscation are compared through the accompanying drawings.

FIG3 is a control flow graph of a function before it is obfuscated, viewed using the reverse tool IDA. According to the control flow graph, an attacker can clearly see the layout and execution flow of the program. After using the code obfuscation method provided by an embodiment of the present invention, the control flow of the function is viewed using the IDA reverse tool as shown in FIG4. From the figure, it can be seen that the program code blocks have increased, and there are many unrelated code blocks, making it difficult for an attacker to understand the code and directly analyze the program execution flow.

FIG5 is a schematic diagram of a code obfuscation device provided by an embodiment of the present invention. As shown in FIG5 , the code obfuscation device provided by an embodiment of the present invention includes:

A basic code block determination module 501 is used to determine a basic code block in a function in a target program according to the control flow direction of the function;

A sub-code block generation module 502 is used to divide the basic code block into sub-code blocks;

The instruction conversion module 503 is used to convert the target address of the non-conditional jump instruction in the code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block.

The code obfuscation device provided by the embodiment of the present invention converts the target address of the unconditional jump instruction in the code block into an address determined when the target program is running, thereby cutting off the direct jump relationship between the code block with the unconditional jump instruction and the code block to be jumped, thereby increasing the difficulty of reverse analysis.

FIG6 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. As shown in FIG6 , the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the following method: according to the control flow direction of the function in the target program, determine the basic code block in the function; divide the basic code block to obtain a sub-code block; convert the target address of the non-conditional jump instruction in the code block to the address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block.

It should be noted that the electronic device in this embodiment can be a server, a PC, or other devices in specific implementation, as long as its structure includes the processor 610, the communication interface 620, the memory 630, and the communication bus 640 shown in FIG6, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640, and the processor 610 can call the logic instructions in the memory 630 to execute the above method. This embodiment does not limit the specific implementation form of the electronic device.

In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

Furthermore, an embodiment of the present invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: determining a basic code block in the function according to the control flow direction of the function in the target program; dividing the basic code block to obtain sub-code blocks; converting the target address of the non-conditional jump instruction in the code block to an address determined when the target program is running; wherein the code block includes sub-code blocks, or includes sub-code blocks and undivided basic code blocks.

On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the methods provided in the above embodiments, for example, including: determining a basic code block in the function according to the control flow direction of the function in the target program; dividing the basic code block to obtain sub-code blocks; converting the target address of the non-conditional jump instruction in the code block to an address determined when the target program is running; wherein the code block includes sub-code blocks, or includes sub-code blocks and undivided basic code blocks.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (11)

1. A code obfuscation method, comprising: Determine the basic code block in the function according to the control flow direction of the function in the target program; Splitting the basic code block to obtain sub-code blocks; Converting a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; After the step of dividing the basic code block to obtain sub-code blocks, the method further includes: Disrupting the arrangement order of code blocks in a function in the target program; The converting the target address of the non-conditional jump instruction in the code block into an address determined when the target program is running specifically includes: Inserting an address calculation code block between a first code block having an unconditional jump instruction and a second code block to be jumped according to the unconditional jump instruction, and changing the jump target of the unconditional jump instruction to the address calculation code block; wherein the address calculation code block is used to dynamically calculate the address of the second code block at runtime; The inserting of the address calculation code block between the first code block having the unconditional jump instruction and the second code block to be jumped according to the unconditional jump instruction specifically includes: Inserting an address calculation code block between the first code block and the second code block; Calculating an address offset between the address calculation code block and the second code block according to the address information of the address calculation code block and the address information of the second code block; The address to be jumped by the unconditional jump instruction in the address calculation code block is modified into an address calculation formula, wherein the address calculation formula includes: the address information of the address calculation code block itself, and the address offset between the address calculation code block and the second code block. 2. The code obfuscation method according to claim 1, characterized in that the method further comprises: The direct calling instruction to the system function in the target program is replaced by an indirect calling instruction to the system function. 3. The code obfuscation method according to claim 2, characterized in that the step of replacing the direct call instruction to the system function in the target program with the indirect call instruction to the system function specifically comprises: Generate an indirect call instruction according to the real address of the system function and the dynamic link library, wherein the indirect call instruction obtains the real address of the system function to be executed by parsing the function address in the dynamic link library; Replace the direct call instructions to the system function in the target program with indirect call instructions to the system function. 4. The code obfuscation method according to claim 1, characterized in that the step of segmenting the basic code block according to the second preset rule to obtain sub-code blocks specifically comprises: Determine whether the basic code block satisfies a preset rule, and when the preset rule is satisfied, segment the basic code block to obtain a first segmentation result; Determine whether there is a jump instruction at the end of the first segmentation result. When there is no jump instruction, add a jump instruction at the end of the first segmentation result to obtain a sub-code block; wherein the jump instruction is used to jump to the next instruction of the last instruction of the first segmentation result in the basic code block. 5. A code obfuscation method, characterized by comprising: Determine the basic code block in the function according to the control flow direction of the function in the target program; Splitting the basic code block to obtain sub-code blocks; Converting a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; Replacing a direct call instruction to a system function in the target program with an indirect call instruction to the system function; The step of replacing the direct call instruction to the system function in the target program with the indirect call instruction to the system function specifically includes: Generate an indirect call instruction according to the real address of the system function and the dynamic link library, wherein the indirect call instruction obtains the real address of the system function to be executed by parsing the function address in the dynamic link library; Replace the direct call instructions to the system function in the target program with indirect call instructions to the system function. 6. A code obfuscation method, characterized by comprising: Determine the basic code block in the function according to the control flow direction of the function in the target program; Splitting the basic code block to obtain sub-code blocks; Converting a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; The step of dividing the basic code block according to the second preset rule to obtain sub-code blocks specifically includes: Determine whether the basic code block satisfies a preset rule, and when the preset rule is satisfied, segment the basic code block to obtain a first segmentation result; Determine whether there is a jump instruction at the end of the first segmentation result. When there is no jump instruction, add a jump instruction at the end of the first segmentation result to obtain a sub-code block; wherein the jump instruction is used to jump to the next instruction of the last instruction of the first segmentation result in the basic code block. 7. A code obfuscation device, comprising: A basic code block determination module, used to determine a basic code block in a function in a target program according to the control flow direction of the function; A sub-code block generation module, used for segmenting the basic code block to obtain sub-code blocks; An instruction conversion module, used to convert a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; and is also used to disrupt the arrangement order of the code blocks in a function in the target program; The instruction conversion module is specifically used to insert an address calculation code block between a first code block having an unconditional jump instruction and a second code block to be jumped according to the unconditional jump instruction, and change the jump target of the unconditional jump instruction to the address calculation code block; wherein the address calculation code block is used to dynamically calculate the address of the second code block at runtime; The instruction conversion module is further specifically configured to insert an address calculation code block between the first code block and the second code block; Calculating an address offset between the address calculation code block and the second code block according to the address information of the address calculation code block and the address information of the second code block; The address to be jumped by the unconditional jump instruction in the address calculation code block is modified into an address calculation formula, wherein the address calculation formula includes: the address information of the address calculation code block itself, and the address offset between the address calculation code block and the second code block. 8. A code obfuscation device, comprising: A basic code block determination module, used to determine a basic code block in a function in a target program according to the control flow direction of the function; A sub-code block generation module, used for segmenting the basic code block to obtain sub-code blocks; An instruction conversion module, configured to convert a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; and replace a direct call instruction to a system function in the target program with an indirect call instruction to the system function; The instruction conversion module is specifically used to generate an indirect call instruction based on the real address of the system function and the dynamic link library. The indirect call instruction obtains the real address of the system function to be executed by parsing the function address in the dynamic link library; and replaces the direct call instruction to the system function in the target program with the indirect call instruction to the system function. 9. A code obfuscation device, comprising: A basic code block determination module, used to determine a basic code block in a function in a target program according to the control flow direction of the function; A sub-code block generation module, used for segmenting the basic code block to obtain sub-code blocks; An instruction conversion module, used for converting a target address of a non-conditional jump instruction in a code block into an address determined when the target program is running; wherein the code block includes a sub-code block, or includes a sub-code block and an undivided basic code block; The sub-code block generation module is specifically used to determine whether the basic code block meets the preset rules. When the preset rules are met, the basic code block is segmented to obtain a first segmentation result; determine whether there is a jump instruction at the end of the first segmentation result. When there is no jump instruction, add a jump instruction to the end of the first segmentation result to obtain a sub-code block; wherein the jump instruction is used to jump to the next instruction of the last instruction of the first segmentation result in the basic code block. 10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the code obfuscation method according to any one of claims 1 to 6 when executing the program. 11. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the code obfuscation method according to any one of claims 1 to 6 is implemented.