Control flow obfuscation method and system based on a callback function

Abstract

The invention belongs to the technical field of network security, and particularly relates to a control flow obfuscation method and system based on a callback function, aiming at a loop structure in aprogram, a basic block loop hop is converted into inter-function repeated calling through the callback function, so that the original execution logic of the program is hidden, and the original control flow of the program is merged into a sequence structure in a unified manner; through program analysis, data dependence is reconstructed in a callback function so as to maintain functional consistency before and after cyclic jump conversion. According to the method, the callback function is cyclically called; program key algorithm logic is hidden; the detection cannot be easily performed by an automatic analysis technology; the problem that a traditional confusion method is difficult to confront an automatic analysis means is effectively solved; because only a small number of function calls and necessary parameter transfer instructions are introduced into the original program, the influence on the program overhead is effective, the anti-analysis capability is greatly enhanced under the condition of ensuring the program execution efficiency, the program size and the execution efficiency are not obviously changed before and after an actual application test, and the method has good applicability.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a control flow obfuscation method and system based on a callback function. Background technique [0002] Reverse analysis technology is a common technique used by malicious code writers. By reverse-analyzing existing programs and mining the algorithmic logic and key data contained in the programs, software piracy and even vulnerability-based hacking attacks can be effectively implemented. According to a software survey released by the Business Software Alliance (BSA) in 2018, as many as 36% of installed software worldwide is not legally authorized, posing a great threat to the software industry and user information security. Code obfuscation technology is a common technology for software protection. By constructing an effective obfuscation algorithm, the program data flow and control flow are obfuscated to achieve the purpose of hiding code logic. Among th...

AI Technical Summary

Problems solved by technology

[0004] For this reason, the present invention provides a control flow obfuscation method and system based on a callback function to solve the shortcomings of traditional obfuscation algorithms such as low obfuscation intensity and high operating overhead, and enhance the ability of network programs to resist reverse analysis

Images