摘要
针对当前软件保护技术存在的不足,提出一种代码碎片化技术,该技术是一种以函数为单元,对函数进行代码shell化、内存布局随机化、执行动态链接化的新型软件保护技术,代码shell化实现代码碎片的位置无关变形,内存布局随机化实现代码碎片的随机内存加载,动态链接化实现对代码碎片的动态执行,通过上述3个环节实现对程序的碎片化处理。实验表明,代码碎片化技术不仅能实现程序执行过程中函数碎片内存位置的随机化,还能实现函数碎片的动态链接执行,增加程序静态逆向分析和动态逆向调试的难度,提高程序的抗逆向分析能力。
Aiming at the shortcomings of the current software protection technology,a code fragmentation technology was proposed.This technology is a new software protection technology that takes functions as units,shells functions,randomizes memory layout,and performs dynamic linking.The code shellization realizes the position-independent morphing of code fragments,the memory layout randomizes the random memory loading of the code fragments,the dynamic linking realizes the dynamic execution of the code fragments,and the program fragmentation processing is achieved through the above three links.The experiments show that the code fragmentation technology can not only realize the randomization of the memory location of function fragments during program execution,but also the dynamic link execution of function fragments,increasing the difficulty of static reverse analysis and dynamic reverse debugging of the program,and improving the anti-reverse analysis ability of the program.
作者
郭京城
舒辉
熊小兵
康绯
GUO Jingcheng;SHU Hui;XIONG Xiaobing;KANG Fei(Information Engineering University,Zhengzhou 450001,China)
出处
《网络与信息安全学报》
2020年第6期57-68,共12页
Chinese Journal of Network and Information Security
基金
国家重点研发计划(2016YFB08011601)。
关键词
代码碎片化
软件保护
分离
动态链接
code fragmentation
software protection
separation
dynamic linking
