CN114707124B - .NET platform code protection method and system based on code virtualization - Google Patents

Abstract

The present invention proposes a .NET platform code protection method based on code virtualization, including constructing a control flow graph about each process in a .NET platform program, and constructing a data flow graph according to the control flow graph; according to the control flow Figure and data flow diagram, the MSIL code to be protected in the .NET platform program is decompiled to obtain the MSIL syntax tree; the MSIL syntax tree is compiled into a virtual intermediate language. Convert the MSIL code to be protected in the .NET platform program into a virtual intermediate language that is customizable, dynamic and convertible, and difficult to be analyzed, which can effectively prevent various decompilers from converting the MSIL code to be protected It is a high-level language, so that the key code of the .NET platform program cannot be tampered with and can run safely.

Description

Method and system for code protection of .NET platform based on code virtualization

technical field

The invention relates to the technical field of software security, and more specifically, to a code protection method and system for a .NET platform based on code virtualization.

Background technique

At present, many commercial software are often cracked by attackers through reverse engineering, stealing the core algorithms and confidential information in the software, resulting in infringement of software copyrights of many developers. Therefore, in many scenarios, the demand for software code protection is increasing. For example, applications on the .NET platform, Android applications, and some IoT devices all have security requirements on how to protect application codes from reverse cracking. All languages under the .NET platform are based on the common language runtime (CommonLanguage Runtime) and follow the standards of the common language architecture, and are uniformly compiled into MSIL codes, and the compiled MSIL codes are executed by the common language runtime. MSIL codes are public infrastructure, Attackers can use various decompilers to convert the underlying MSIL code back to the corresponding .NET language, such as C# and VB.NET, etc., thereby stealing the software code information and infringing on the rights and interests of developers.

Most of the existing MSIL code protection schemes under the .NET platform use constant protection technology, that is, encrypt constants and decrypt constants during operation, or use control flow obfuscation technology to confuse the execution order of MSIL codes to make static analysis invalid. Although the above method can increase the complexity of the MSIL code, it is difficult to statically analyze the MSIL code, but through dynamic debugging, it is still possible to understand the internal execution process of the program and further obtain MSIL code information.

Contents of the invention

In order to solve the defect that the protected .NET platform program code is easily reverse-compiled into a high-level language, the invention provides a .NET platform code protection method and system based on code virtualization.

In order to solve the problems of the technologies described above, the technical solution of the present invention is as follows:

In the first aspect, the present invention proposes a code protection method for .NET platform based on code virtualization, comprising the following steps:

S1: Construct a control flow graph about each process in the .NET platform program, and construct a data flow graph according to the control flow graph;

S2: According to the control flow graph and the data flow graph, decompile the MSIL code to be protected in the .NET platform program to obtain the MSIL syntax tree;

S3: Compile the MSIL syntax tree into a virtual intermediate language.

As a preferred solution, S1 specifically includes the following steps:

S1.1: Analyze the metadata of the .NET platform program, obtain the method body that needs to be virtualized in the .NET platform program, and extract the MSIL code and exception handling clause of the method body;

S1.2: Decoding the instructions of the MSIL code, and assigning stack elements in the MSIL code stack to local variables;

S1.3: Construct a control flow graph according to the jump instructions and exception handling clauses of the MSIL code;

S1.4: Based on the control flow graph and local variables, analyze the data flow of the program on the .NET platform, and construct a data flow graph.

As a preferred solution, S1.2 specifically includes the following steps:

S1.2.1: Starting from the head of the MSIL code, traverse each instruction of the MSIL code backwards according to the offset order, and save the stack information before execution for each instruction;

S1.2.2: According to the stack information, allocate each stack element in the MSIL code stack to a local variable, and assign names to the local variables in stack order.

As a preferred solution, in S1.2.2, when assigning each stack element in the stack of MSIL code to a local variable, by fusing the information of the in-node of the program, if there is a local variable of 64-bit integer type in the in-node, then the Local variables of 32-bit integer type are converted to local variables of 64-bit integer type; if the entry node of the data flow graph is a reference type, the local variable is set to the base class Object type.

As a preferred solution, in S1.3, the basic block of the control flow graph is divided with the jump instruction and the exception handling clause of the MSIL code as the boundary, and the jump source and the jump target of the jump instruction are respectively set is the predecessor node and the successor node of the control flow graph, and the control flow graph is obtained.

As a preferred solution, it also includes verifying the method body, the MSIL code of the method body and the exception handling clause, specifically including the following steps:

Verify the support status of all opcodes in the method body;

Verify the stack balance status of MSIL code;

Verify the ordering status of the exception handling clauses.

As a preferred solution, in S1.4, the data flow analysis of the .NET platform program includes analysis of local variables;

If there is an address fetch operation for the local variable, a virtual reference type is generated for the local variable; if a mathematical operation is performed on the pointer obtained after the address fetch operation of the local variable, an error is thrown when the local variable is allocated.

As a preferred solution, in S3, the MSIL syntax tree is compiled into a virtual intermediate language-based syntax tree, and then the virtual intermediate language-based syntax tree is compiled into a virtual intermediate language.

As a preferred solution, the virtualization protection method also includes: after compiling the MSIL syntax tree into a virtual intermediate language, converting the virtual intermediate language into a serializable form; saving the serializable virtual intermediate language as The hex array is written to the file.

In the second aspect, the present invention also proposes a .NET platform code virtualization protection system, which is applied to the .NET platform code protection method based on code virtualization in any of the above schemes, including:

The control flow graph building block is used to construct the control flow graph of each process in the .NET platform program;

A data flow graph building module, configured to construct a data flow graph according to the control flow graph;

The decompilation module is used to decompile the MSIL code to be protected in the .NET platform program according to the control flow graph and the data flow graph to obtain the MSIL syntax tree;

The compiling module is used for compiling the MSIL syntax tree into a virtual intermediate language.

Compared with the prior art, the beneficial effect of the technical solution of the present invention is: convert the MSIL code to be protected in the .NET platform program into a virtual intermediate language that is customizable, dynamic and convertible, and difficult to be analyzed , which can effectively prevent various decompilers from converting the protected MSIL code into a high-level language, so that the key code of the .NET platform program cannot be tampered with and can run safely.

Description of drawings

FIG. 1 is a flow chart of the code protection method for the .NET platform based on code virtualization in Embodiment 1.

Fig. 2 is a flow chart of implementing the runtime of the virtual intermediate language in the third embodiment.

FIG. 3 is an architecture diagram of the .NET platform code virtualization protection system in Embodiment 4.

Detailed ways

The accompanying drawings are for illustrative purposes only and cannot be construed as limiting the patent;

The technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Example 1

This embodiment proposes a .NET platform code protection method based on code virtualization, as shown in FIG. 1 , and FIG. 1 is a flow chart of the .NET platform code protection method based on code virtualization in this embodiment, including the following steps:

S1: Build a control flow graph for each process in the .NET platform program, and build a data flow graph based on the control flow graph.

S2: According to the control flow graph and the data flow graph, decompile the MSIL code to be protected in the .NET platform program to obtain the MSIL syntax tree.

S3: Compile the MSIL syntax tree into a virtual intermediate language.

In the specific implementation process, through the control flow analysis of each process in the .NET platform program, the execution process of the .NET platform program is determined, the control flow graph is obtained, and the data flow analysis is performed on the basis of the control flow graph to obtain the data. flow graph. According to the control flow graph and data flow graph, decompile the stack-based MSIL code to be protected in the .NET platform program, convert the MSIL code into a form based on local variables, and obtain the MSIL syntax tree. MSIL syntax tree has the same semantics as MISL code, does not depend on the stack, and its expression form is similar to high-level language. Compared with MSIL code, MSIL syntax tree has the advantage of being easier to analyze. Finally, the MSIL syntax tree is compiled into a virtual intermediate language-based syntax tree, and then the virtual intermediate language-based syntax tree is compiled into a virtual intermediate language, so that the virtual intermediate language can safely run on the virtual language runtime.

Convert the MSIL code to be protected in the .NET platform program into a virtual intermediate language that is customizable, dynamic and convertible, and difficult to be analyzed, which can effectively prevent various decompilers from converting the MSIL code to be protected It is a high-level language, so that the key code of the .NET platform program cannot be tampered with, and can run safely on the virtual language runtime, and is suitable for the protection of the key code of the program, such as the code of authentication and authorization.

Example 2

This embodiment proposes a code protection method for the .NET platform based on code virtualization, including the following steps:

S1: Build a control flow graph for each process in the .NET platform program, and build a data flow graph based on the control flow graph. Specifically include the following steps:

S1.1: Analyze the metadata of the .NET platform program, obtain the method body that needs to be virtualized in the .NET platform program, and extract the MSIL code and exception handling clause of the method body.

In this embodiment, the method bodies that need to be virtualized are marked and acquired through the protection parameters passed in by the user.

In this embodiment, the method body, the MSIL code of the method body and the exception handling clause are verified, which specifically includes the following steps:

Verify the support status of all opcodes in the method body to ensure that all opcodes in the method body are supported. An exception is thrown if there is an unsupported opcode in the method body.

Verify the stack balance status of MSIL code, determine whether the stack of MSIL code is balanced, and prevent incorrect MSIL code from entering subsequent processing. An exception is thrown if the MSIL code stack is unbalanced.

Verify the ordering status of the exception handling clauses, determine whether the exception handling clauses are in order, and ensure the correctness of the language. An exception is thrown if the exception-handling clause permutation is invalid.

S1.2: Decode the instructions of the MSIL code, and allocate the stack elements in the MSIL code stack to local variables. Specifically include the following steps:

S1.2.1: Starting from the head of the MSIL code, traverse each instruction of the MSIL code backwards according to the offset order, and save the stack information before execution for each instruction;

S1.2.2: According to the stack information, allocate each stack element in the stack of the MSIL code to a local variable, and assign names to the local variables in stack order. The stack elements in the stack of the MSIL code are converted into local variables, so that the MSIL code is converted from a stack-based architecture to a local variable-based architecture, which is convenient for subsequent debugging.

In this embodiment, when allocating each stack element in the stack of the MSIL code to a local variable, it is necessary to obtain a compatible local variable type by fusing information of all in-nodes.

For a local variable of 32-bit integer type, it needs to be converted to a local variable of native size integer type or a local variable of 64-bit integer type to satisfy the allocation of in-node values. For reference type local variables, they are uniformly converted to the base class Object local variables, and there is no need to calculate the common base class, because all reference types are pointers to the GC (Garbage Collection, garbage collection) heap at runtime, and the size is equivalent to the native integer . Through the above conversion process, a variable-based intermediate code form can be obtained, which is more convenient and efficient than the original stack-based intermediate code during analysis.

S1.3: Construct a control flow graph according to the jump instruction of the MSIL code and the exception handling clause.

In this embodiment, the basic block of the control flow graph is divided with the jump instruction of the MSIL code and the exception handling clause as the boundary, and the jump source and the jump target of the jump instruction are respectively set as control The predecessor node and the successor node of the flow graph get the control flow graph. The jump instruction is a branch statement of MSIL code.

S1.4: Based on the control flow graph and local variables, analyze the data flow of the program on the .NET platform, and construct a data flow graph.

In this embodiment, on the basis of the control flow graph, combined with stack local variable information, data flow analysis is performed to indicate where local variables are assigned, valued and addressed. Data flow analysis is the analysis of the flow of data in a control flow graph, that is, analysis that determines information about the definition and use of data in a program. The propagation process of variable values can be obtained using data flow analysis. The results of data flow analysis represent information that can be used for compilation and optimization, indicating the flow of data during program execution. These data flow information can be used to compile MSIL code into a virtual intermediate. language.

S2: According to the control flow graph and the data flow graph, decompile the MSIL code to be protected in the .NET platform program to obtain the MSIL syntax tree;

S3: Compile the MSIL syntax tree into a virtual intermediate language.

In this embodiment, after the MSIL syntax tree is compiled into a virtual intermediate language, the virtual intermediate language is converted into a serializable form; the serializable virtual intermediate language is saved as a hexadecimal array and written into a file In, it is used for the execution of the virtual machine and realizes the runtime of the virtual intermediate language.

In this embodiment, when an unsupported MSIL syntax node is encountered during the process of compiling the MSIL syntax tree into a virtual intermediate language, an exception is thrown to stop and continue compiling. Since the virtual intermediate language is executed by a virtual machine written in a safe managed language, there are some operations that cannot be simulated, such as operations on GC heap references, and such operations are the same as pointer operations at the MSIL language level. In order to avoid data corruption, data flow analysis is required to obtain where variables are fetched, their magnitudes, and where their addresses are fetched.

If there is an address fetch operation for the local variable, a virtual reference type is generated for the local variable. The virtual reference type abstracts all pointer operations, but cannot obtain the original address of the pointer; if the local variable is obtained after the address fetch operation, the pointer is executed Mathematical operations, because the virtual reference type cannot obtain the original address of the pointer, the mathematical operations will be invalid, that is, this type of MSIL language cannot be compiled into the virtual intermediate language, and an error needs to be thrown when assigning variables.

Example 3

This embodiment makes improvements on the basis of the .NET platform code protection method based on code virtualization proposed in Embodiment 2, including using the virtual intermediate language for the execution of the virtual machine to realize the runtime of the virtual intermediate language, as shown in FIG. 2 Shown, Fig. 2 is the flow chart that realizes the runtime of virtual intermediate language in the present embodiment, specifically comprises the following steps:

The virtual runtime executes the initialization operation at the program entry point, initializes the variables required by the virtual runtime, loads the execution interface of all virtual opcodes, and maps the original value of the virtual opcode and the execution interface to the dictionary.

The parameters passed in by the method entry stub are analyzed to obtain the location of the virtual intermediate language, and the virtual intermediate language is loaded into the virtual machine to create a virtual execution context.

Call the corresponding execution interface for the current virtual opcode, set the position of the next virtual instruction, and repeat this step until the method finishes running. If an exception occurs during execution, simulate stack backtracking to determine whether the exception can be caught. If the exception can be caught, execute the exception handling clause, otherwise throw an exception and exit the virtual machine.

Example 4

This embodiment proposes a .NET platform code virtualization protection system, as shown in FIG. 3 , and FIG. Compile modules and compile modules.

In the specific implementation process, the control flow graph construction module constructs a control flow graph about each process in the .NET platform program, and the data flow graph construction module constructs a data flow graph according to the control flow graph, which specifically includes the following steps:

The control flow graph building module parses the metadata of the .NET platform program, obtains the method body that needs to be virtualized in the .NET platform program, and extracts the MSIL code and exception handling clauses of the method body. The instructions of the MSIL code are decoded, and the stack elements in the stack of the MSIL code are allocated to local variables. A control flow graph is constructed according to the jump instruction of the MSIL code and the exception handling clause.

The data flow graph construction module analyzes the data flow of the .NET platform program based on the control flow graph and local variables, and constructs the data flow graph. In this embodiment, on the basis of the control flow graph, combined with stack local variable information, data flow analysis is performed to indicate where local variables are assigned, valued and addressed.

The decompilation module decompiles the MSIL code to be protected in the .NET platform program according to the control flow graph and the data flow graph, converts the MSIL code into a form based on local variables, and obtains an MSIL syntax tree.

The compilation module compiles the MSIL syntax tree into a virtual intermediate language-based syntax tree, and then compiles the virtual intermediate language-based syntax tree into a virtual intermediate language.

Convert the MSIL code to be protected in the .NET platform program into a virtual intermediate language that is customizable, dynamic and convertible, and difficult to be analyzed, which can effectively prevent various decompilers from converting the MSIL code to be protected It is a high-level language, so that the key code of the .NET platform program cannot be tampered with, and can run safely on the virtual language runtime, and is suitable for the protection of the key code of the program, such as the code of authentication and authorization.

The terms describing the positional relationship in the drawings are only for illustrative purposes and cannot be interpreted as limitations on this patent;

Apparently, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, rather than limiting the implementation of the present invention. For those of ordinary skill in the art, other changes or changes in different forms can be made on the basis of the above description. It is not necessary and impossible to exhaustively list all the implementation manners here. All modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (9)

1. NET platform code protection method based on code virtualization is characterized by comprising the following steps:

s1: constructing a control flow diagram of each process in a NET platform program, and constructing a data flow diagram according to the control flow diagram; the method specifically comprises the following steps:

s1.1: analyzing metadata of a NET platform program, acquiring a method body needing virtualization in the NET platform program, and extracting MSIL codes and exception handling clauses of the method body;

s1.2: decoding the instruction of the MSIL code, and distributing stack elements in an MSIL code stack to local variables;

s1.3: constructing a control flow graph according to a jump instruction and an exception handling clause of the MSIL code;

s1.4: performing data flow analysis on the NET platform program based on the control flow graph and the local variable to construct a data flow graph;

s2: according to the control flow diagram and the data flow diagram, decompiling MSIL codes to be protected in a NET platform program, and converting the MSIL codes into a form based on local variables to obtain an MSIL syntax tree;

s3: compiling the MSIL syntax tree into a virtual intermediate language.

2. The code virtualization-based NET platform code protection method of claim 1, wherein S1.2 specifically comprises the steps of:

s1.2.1: traversing each instruction of the MSIL code backwards according to the offset sequence from the head part of the MSIL code, and storing stack information before execution for each instruction;

s1.2.2: and according to the stack information, allocating each stack element in the MSIL code stack to a local variable, and allocating names to the local variables according to the stack sequence.

3. NET platform code protection method based on code virtualization according to claim 2, characterized in that in S1.2.2, when each stack element in the stack of MSIL codes is assigned to a local variable, if the local variable of 64-bit integer type exists in the ingress node, the local variable of 32-bit integer type is converted into the local variable of 64-bit integer type by fusing the information of the ingress node of the program; if the in-node of the dataflow graph is a reference type, then the local variable is set to the base class Object type.

4. The code virtualization-based NET platform code protection method of claim 1, wherein in S1.3, a basic block of a control flow graph is divided by taking a jump instruction and an exception handling clause of an MSIL code as boundaries, and a jump source and a jump target of the jump instruction are respectively set as a predecessor node and a successor node of the control flow graph to obtain the control flow graph.

5. NET platform code protection method based on code virtualization according to claim 1, characterized in that, in S1.1, it further includes verifying the MSIL code and exception handling clause of the method body and method body, specifically including the following steps:

verifying the support states of all operation codes in the method body;

verifying the stack balance state of the MSIL code;

and verifying the sequential arrangement state of the exception handling clauses.

6. The method of claim 1, wherein in S1.4, the analyzing data flow of the.net platform program includes analyzing local variables;

if the local variable has an address fetching operation, generating a virtual reference type for the local variable; if the pointer obtained after the address fetch operation of the local variable is executed with the mathematical operation, an error is thrown when the local variable is allocated.

7. NET platform code protection method based on code virtualization according to claim 1, characterized in that in S3 the MSIL syntax tree is compiled to a virtual intermediate language based syntax tree, which is then compiled to a virtual intermediate language.

8. The method of claim 1, wherein the method further comprises: after the MSIL syntax tree is compiled into a virtual intermediate language, the virtual intermediate language is converted into a serializable form; saving the serializable virtual intermediate language as a hexadecimal array to be written into a file.

NET platform code virtualization protection system for use in a code virtualization based NET platform code protection method according to any one of claims 1 to 8, comprising:

the NET platform program comprises a control flow graph construction module, a control flow graph construction module and a network management module, wherein the control flow graph construction module is used for constructing a control flow graph of each process in the NET platform program;

the data flow graph construction module is used for constructing a data flow graph according to the control flow graph;

the decompiling module is used for decompiling MSIL codes to be protected in the NET platform program according to the control flow graph and the data flow graph to obtain an MSIL syntax tree;

and the compiling module is used for compiling the MSIL grammar tree into a virtual intermediate language.

Images