CN112199158A - Virtual machine protected interpretation routine identification method, device, equipment and storage medium - Google Patents
Virtual machine protected interpretation routine identification method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN112199158A CN112199158A CN202011110312.XA CN202011110312A CN112199158A CN 112199158 A CN112199158 A CN 112199158A CN 202011110312 A CN202011110312 A CN 202011110312A CN 112199158 A CN112199158 A CN 112199158A
- Authority
- CN
- China
- Prior art keywords
- virtual machine
- interpretation
- routine
- interpretation routine
- execution
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45587—Isolation or security of virtual machine instances
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Computer Security & Cryptography (AREA)
- Devices For Executing Special Programs (AREA)
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the invention discloses a method, a device, equipment and a storage medium for identifying an interpretation routine protected by a virtual machine, wherein the method for identifying the interpretation routine protected by the virtual machine comprises the following steps: according to the jump characteristic of program thread type interpretation execution, the virtual machine interpreter is divided into a plurality of different byte codes to interpret the routine, namely: embedding the fetch, decode and dispatch code into the end of each interpretation routine; dividing and identifying interpretation routines by matching instruction features in the dynamic execution track record protected by the virtual machine; thereby being transferred from one interpretation routine to another for execution. Aiming at the reverse engineering analysis of the virtual machine software protection, the aim of accurately identifying the interpretation routine in the virtual machine interpreter is fulfilled through cluster analysis and feature matching.
Description
Technical Field
The invention relates to the technical field of virtual machines, and also relates to the technical field of information security, software analysis and reverse engineering, in particular to a method, a device, equipment and a storage medium for identifying an interpretation routine protected by a virtual machine.
Background
The routine is a computer program, is a description of a processing object and a processing rule corresponding to a calculation task, is a special program or is a part of a main program; the interpretation routine is a set of interpretation execution processing functions of a set of private virtual bytecodes designed in the software protection architecture of the virtual machine. Each processing routine in the set performs a specific atomic operation, being a functional instruction in the virtual machine interpreter. During the execution of the virtual machine interpreter, the interpretation routines in the set execute in a certain order to implement the functions of the protected critical code segments.
In the protection process of the virtual machine, the interpretation routine is embedded into the protected software as a key module of the virtual machine interpreter, and because the importance of the interpretation routine in the protection architecture of the virtual machine software is the key point of reverse engineering analysis of the target software of the virtual machine protection, the virtual machine protection software also correspondingly protects the interpretation routine.
The current interpretation routine extraction is based on the principle that each instruction in the program routine is executed the same number of times in the whole program execution process, and the execution times of each instruction in the virtual machine interpreter execution process are collected, then the execution times of the instructions are calculated, and the instruction sets with the same execution times are attributed to one interpretation routine. However, this method is inefficient to execute, and takes longer as the amount of code of the virtual machine increases.
Disclosure of Invention
The embodiment of the invention provides a method, a device, equipment and a storage medium for identifying an interpretation routine of virtual machine protection, aiming at reverse engineering analysis of virtual machine software protection, and achieving the purpose of accurately identifying the interpretation routine in a virtual machine interpreter through cluster analysis and feature matching.
The embodiment of the invention provides a virtual machine protection interpretation routine identification method, which comprises the following steps:
according to the jump characteristic of program thread type interpretation execution, the virtual machine interpreter is divided into a plurality of different byte codes to interpret the routine, namely:
embedding the fetch, decode and dispatch code into the end of each interpretation routine;
dividing and identifying interpretation routines by matching instruction features in the dynamic execution track record protected by the virtual machine;
thereby being transferred from one interpretation routine to another for execution.
Furthermore, each interpretation routine to be executed is connected in series according to the execution sequence, each interpretation routine is executed in sequence after the execution is started, and after the execution of the interpretation routine of the last virtual bytecode is finished, the control flow jumps to the next interpretation routine in a matched jump mode.
Furthermore, in a large number of virtual machine instruction sequences, the virtual machines execute the same action before completing one interpretation execution, including jumping to the instruction fetching position.
Further, the push reg and ret instruction feature matching in the virtual machine dynamic instruction tracking record is utilized to divide and identify the interpretation routine.
Further, jmp reg instruction feature matching in the virtual machine dynamic instruction tracking record is utilized for dividing and identifying the interpretation routine.
Furthermore, the division and identification of the interpretation routine are carried out by matching the linear interpretation execution situation in the dynamic execution track record protected by the virtual machine.
Further, polling the dynamic execution track record, if the ending characteristic of the interpretation routine is matched, creating a new interpretation routine instance, and then adding a polled subsequent instruction into the instance until a new characteristic appears, indicating that the instruction sequence of the instance is ended; by analogy, after the loop is over, a set of instances of all the executed interpretation routines is obtained.
Further, before each interpretation routine execution is complete, the esp register points to the location of the local variable table, with the constraint as a reinforcement condition for the interpretation routine identification.
An embodiment of the present invention further provides an apparatus for identifying an interpretation routine protected by a virtual machine, including:
an embedding module for embedding the fetch, decode and dispatch code into the end of each interpretation routine;
the dividing and identifying module is used for dividing and identifying the interpretation routine through instruction characteristic matching in the dynamic execution track record protected by the virtual machine;
a transfer module for transferring from one interpretation routine to another interpretation routine for execution.
The embodiment of the invention also provides virtual machine protection interpretation routine identification equipment, which comprises a memory, a processor and a computer program which is stored on the memory and can run on the processor, wherein when the processor executes the program, the virtual machine protection interpretation routine identification method is realized.
The embodiment of the invention also provides a computer-readable storage medium, which stores computer-executable instructions, wherein the computer-executable instructions are used for executing the virtual machine protected interpretation routine identification method.
According to the jump characteristic of program thread type interpretation execution, the method divides a virtual machine interpreter into a plurality of different bytecode interpretation routines, namely, a fetching code, a decoding code and a dispatching code are embedded into the end of each interpretation routine, and the interpretation routines are divided and identified through instruction characteristic matching in a dynamic execution track record protected by the virtual machine, so that one interpretation routine is transferred to another interpretation routine for execution; therefore, the division and identification of the interpretation routine are carried out by using the push reg and ret instruction feature matching in the virtual machine dynamic instruction tracking record; dividing and identifying an interpretation routine by using jmp reg instruction feature matching in the dynamic instruction tracking record of the virtual machine; and identifying the interpretation routine by using the position of the esp register pointing to the local variable table as a constraint condition before the execution of each interpretation routine is finished, so that the identification accuracy of the interpretation routine is improved.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
FIG. 1 is a schematic diagram of an illustrative routine identification method for virtual machine protection in accordance with an embodiment of the present invention;
FIG. 2 is a flow diagram of a method for identifying an interpretation routine for virtual machine protection in accordance with an embodiment of the present invention;
fig. 3 is a block diagram of the interpretation routine recognition apparatus of the virtual machine protection according to the embodiment of the present invention.
Detailed Description
The existing interpretation routine extraction is based on the principle that each instruction in the program routine is executed the same time in the whole program execution process, and the execution times of each instruction in the virtual machine interpreter execution process are collected, then the execution times of the instructions are calculated, and the instruction sets with the same execution times are attributed to one interpretation routine. However, this method is inefficient to execute, and takes longer as the amount of code of the virtual machine increases. The method and the device for processing the virtual machine interpreter in the embodiment of the invention extract the processing routine executed in the running process of the virtual machine interpreter based on the dynamic instruction tracking and extract the processing routine according to the characteristics of the virtual machine protection model.
Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
The steps illustrated in the flow charts of the figures may be performed in a computer system such as a set of computer-executable instructions. Also, while a logical order is shown in the flow diagrams, in some cases, the steps shown or described may be performed in an order different than here.
To address the above situation, as shown in fig. 1, an embodiment of the present invention provides a method for identifying an interpretation routine protected by a virtual machine, including:
dividing the virtual machine interpreter into a plurality of different byte codes to interpret routines according to jump characteristics of program thread type interpretation execution;
according to jump characteristics of program cable interpretation execution, the virtual machine interpreter is divided into a plurality of different byte codes to interpret routines, and subsequent virtual instruction syntax and semantic analysis are facilitated. According to the jump characteristics of program thread type interpretation execution, the virtual machine interpreter is divided into a plurality of different byte codes to interpret the routine, namely:
as shown in FIG. 2, at step 101, instruction fetch, decode, and dispatch code is embedded into the end of each interpretation routine.
Step 102, performing division and identification of interpretation routines by instruction feature matching in the dynamic execution trace record protected by the virtual machine.
Step 103, whereby the transfer from one interpretation routine to another is performed.
During the virtual machine protection process, a virtual machine interpreter is inserted into a program, and the virtual machine interpreter is composed of components in the virtualization protection processes such as a virtual machine context structure, virtual environment initialization, instruction fetching, decoding, function dispatching, interpretation routines, virtual environment exit and the like. The interpretation routine is a module which is actually executed in the virtual machine interpreter and is used for completing the functions of the key code segments, and the interpretation routine is an important target for protecting software reverse attack of the virtual machine. The interpretation routine of the virtual machine interpreter first needs to be accurately identified from the protection program before reverse engineering the virtual machine bytecode.
As shown in fig. 1-2, in the implementation model of the virtual machine interpreter, a code dispatching mechanism is usually used to interpret and execute the virtual machine bytecode, after the function interpretation routine corresponding to the current virtual machine bytecode is executed, the next bytecode is fetched from the virtual bytecode code segment, and the location of the next processing routine is calculated according to the operation code of the new bytecode. In recent years, some virtual machine protection software has employed threaded interpretive execution that embeds fetch, decode, and dispatch code into the end of each interpretive routine to be transferred directly from one interpretive routine to another.
In fig. 1, the virtual machine interpreter has no uniform dispatcher, each interpretation routine to be executed is serially connected according to the execution sequence, each interpretation routine is sequentially executed after the execution is started, and after the execution of the interpretation routine of the last virtual bytecode is finished, the control flow jumps to the next interpretation routine in a certain type of jump manner. Based on the decoding interpretation and execution process of the virtual machine bytecode by the current virtual machine interpreter, the embodiment of the invention provides an interpretation routine identification method based on cluster analysis and feature matching. In a large number of virtual machine instruction sequences, the virtual machine will exhibit some inherent characteristic, such as jumping to the instruction fetch location, before completing one interpreted execution. For threaded interpreted execution, it enables the jumping of adjacent interpreted routines in two ways, namely way 1 and way 2, respectively, as shown in assembly language code as follows:
mode 1:
push reg
ret
mode 2:
jmp reg
in the above two ways, the value of reg is the address of the next-hop interpretation routine, and the division and identification of the interpretation routine can be performed by matching the above two cases in the dynamic execution trace record protected by the virtual machine. In addition, before the execution of each interpretation routine is finished, the esp register points to the position of the local variable table, and the constraint can be used as a reinforced condition for the identification of the interpretation routine, so that the success rate of the identification of the interpretation routine is improved. The pseudo-code logic for identifying the interpretation routine algorithm is as follows:
as shown in the above algorithm pseudo code, an example of an interpretation routine (vm _ handler ═ VMHandler ()) is created first, and then a dynamic execution trace record (for line _ num in range) is traversed to determine whether the traversal is completed. If the traversal is complete, the process ends. If not, a new instruction is fetched (Inst ═ Inst (line _ num)), and added to the interpreter routine VMHandler. Next, it is determined whether the feature pattern matching is successful (if (re. search ', inst. text) and local _ var _ table _ addr ═ inst. get _ reg _ in _ chg (' ESP ')) or re. search (r ' \\ bjmp \ b. \ be (ax | bx | cx | dx | di | si | bp | sp) \\\\ b ', inst. text)). If the matching is successful, the current interpretation routine VMHandler is stored in the VMHandler set (vm _ handles. appended (vm _ handler)), and a new interpretation routine is created (vm _ handler ═ VMHandler (index, inst. line _ num +1)), and the traversal of the instruction sequence is continued. If the match is not successful, the sequence of instructions continues to be traversed.
As indicated by the above algorithm pseudocode, the dynamic execution trace records are polled, if the ending characteristics of two interpretation routines are matched, a new instance of an interpretation routine is created, and then the polled subsequent instructions are added to the instance until a new characteristic appears, indicating that the instruction sequence of the instance is ended. By analogy, after the loop is over, a set of instances of all the interpreted routines that are executed can be obtained.
In one embodiment, each interpretation routine to be executed is connected in series according to the execution sequence, each interpretation routine is executed in sequence after the execution is started, and after the execution of the interpretation routine of the last virtual bytecode is finished, the control flow jumps to the next interpretation routine in a matched jump mode.
In one embodiment, in a large number of virtual machine instruction sequences, the virtual machines execute the same action, including jumping to the instruction fetch location, before completing one interpreted execution.
In one embodiment, the division and identification of the interpretation routine is performed using push reg and ret instruction feature matching in the virtual machine dynamic instruction trace record.
In one embodiment, jmp reg instruction feature matching in the virtual machine dynamic instruction trace record is utilized for the partitioning and identification of the interpretation routine.
In one embodiment, the partitioning and identification of interpretation routines is performed by matchline interpretation of execution in virtual machine protected dynamic execution trace records.
In one embodiment, the dynamic execution track record is polled, if the ending characteristic of the interpretation routine is matched, a new interpretation routine instance is created, then the polled subsequent instructions are added into the instance until a new characteristic appears, and the instruction sequence of the instance is ended; by analogy, after the loop is over, a set of instances of all the executed interpretation routines is obtained.
In one embodiment, the esp register points to the location of the table of local variables before each interpretation routine execution ends, with the constraint as a reinforcement condition for the interpretation routine identification.
As shown in fig. 3, an embodiment of the present invention further provides an interpretation routine recognition apparatus for virtual machine protection, including:
an embedding module 71 for embedding the fetch, decode and dispatch code into the end of each interpretation routine;
a partitioning and identifying module 72 for partitioning and identifying the interpretation routines by instruction feature matching in the virtual machine protected dynamic execution trace record;
a transfer module 73 for transferring from one interpretation routine to another interpretation routine for execution.
The embodiment of the invention also provides virtual machine protection interpretation routine identification equipment, which comprises a memory, a processor and a computer program which is stored on the memory and can run on the processor, wherein when the processor executes the program, the virtual machine protection interpretation routine identification method is realized.
The embodiment of the invention also provides a computer-readable storage medium, which stores computer-executable instructions, wherein the computer-executable instructions are used for executing the virtual machine protected interpretation routine identification method.
In this embodiment, the storage medium may include, but is not limited to: a U-disk, a Read Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, or other various media capable of storing program codes.
It will be understood by those of ordinary skill in the art that all or some of the steps of the methods, systems, functional modules/units in the devices disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). The term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, as is well known to those of ordinary skill in the art. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by a computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules or modulated data signals such as a carrier wave or other transport mechanism and includes any information delivery media.
Claims (10)
1. A virtual machine protected interpretation routine identification method is characterized by comprising the following steps:
according to the jump characteristic of program thread type interpretation execution, the virtual machine interpreter is divided into a plurality of different byte codes to interpret the routine, namely:
embedding the fetch, decode and dispatch code into the end of each interpretation routine;
dividing and identifying interpretation routines by matching instruction features in the dynamic execution track record protected by the virtual machine;
thereby being transferred from one interpretation routine to another for execution.
2. The method according to claim 1, wherein each interpretation routine to be executed is serially connected according to the execution sequence, each interpretation routine is sequentially executed after the execution is started, and after the execution of the interpretation routine of the last virtual bytecode is completed, the control flow jumps to the next interpretation routine in a matching jump manner.
3. The method as claimed in claim 1, wherein the virtual machine executes the same action in a plurality of virtual machine instruction sequences before completing one interpretation execution, including jumping to the instruction fetch position.
4. The virtual machine protected interpretation routine recognition method of claim 1, wherein the division and recognition of the interpretation routine are performed by using push reg and ret instruction feature matching in the virtual machine dynamic instruction trace record.
5. The virtual machine protected interpretation routine recognition method of claim 1, wherein the division and recognition of the interpretation routine is performed by using jmp reg instruction feature matching in a virtual machine dynamic instruction trace record.
6. The virtual machine protected interpretation routine identification method of claim 1, wherein the interpretation routine is divided and identified by matching inline interpretation execution conditions in a dynamic execution trace record of virtual machine protection.
7. The virtual machine protected interpretation routine identification method of claim 1, wherein the dynamic execution trace record is polled, if the end feature of the interpretation routine is matched, a new instance of the interpretation routine is created, and then the polled subsequent instructions are added to the instance until a new feature appears, indicating that the instruction sequence of the instance is ended; by analogy, after the circulation is finished, obtaining all instance sets of the executed interpretation routines;
before each interpretation routine execution is complete, the esp register points to the location of the table of local variables, with the constraint as a reinforcement condition for the interpretation routine identification.
8. An interpretation routine recognition apparatus for virtual machine protection, comprising:
an embedding module for embedding the fetch, decode and dispatch code into the end of each interpretation routine;
the dividing and identifying module is used for dividing and identifying the interpretation routine through instruction characteristic matching in the dynamic execution track record protected by the virtual machine;
a transfer module for transferring from one interpretation routine to another interpretation routine for execution.
9. An apparatus for identifying an interpretation routine protected by a virtual machine, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements a method for identifying an interpretation routine protected by a virtual machine according to any one of claims 1 to 7 when executing the program.
10. A computer-readable storage medium having stored thereon computer-executable instructions for performing the virtual machine protected interpretation routine identification method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011110312.XA CN112199158B (en) | 2020-10-16 | 2020-10-16 | Virtual machine protected interpretation routine identification method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011110312.XA CN112199158B (en) | 2020-10-16 | 2020-10-16 | Virtual machine protected interpretation routine identification method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112199158A true CN112199158A (en) | 2021-01-08 |
| CN112199158B CN112199158B (en) | 2021-11-23 |
Family
ID=74009203
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011110312.XA Active CN112199158B (en) | 2020-10-16 | 2020-10-16 | Virtual machine protected interpretation routine identification method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112199158B (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101201883A (en) * | 2007-09-18 | 2008-06-18 | 北京赛柏科技有限责任公司 | Software protection method based on virtual machine |
| US20140040600A1 (en) * | 2011-04-21 | 2014-02-06 | Renesaselectronics Corporation | Data processor |
| CN106529296A (en) * | 2016-11-16 | 2017-03-22 | 武汉工程大学 | Method for attacking software protection virtual machine based on fuzzy clustering |
| CN106874758A (en) * | 2016-08-22 | 2017-06-20 | 阿里巴巴集团控股有限公司 | A kind of method and apparatus for recognizing document code |
| CN108664312A (en) * | 2018-04-04 | 2018-10-16 | 苏州天魂网络科技股份有限公司 | A kind of virtual machine guard method reinforced based on fictitious order collection |
| CN108985014A (en) * | 2018-06-13 | 2018-12-11 | 珠海金山网络游戏科技有限公司 | The method and device of the Python byte code files in game is protected in a kind of export |
| CN109145534A (en) * | 2018-07-24 | 2019-01-04 | 上海交通大学 | For the antialiasing system and method for software virtual machine protection |
| CN109923546A (en) * | 2016-12-19 | 2019-06-21 | 比特梵德知识产权管理有限公司 | The event filtering of virtual machine security application program |
-
2020
- 2020-10-16 CN CN202011110312.XA patent/CN112199158B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101201883A (en) * | 2007-09-18 | 2008-06-18 | 北京赛柏科技有限责任公司 | Software protection method based on virtual machine |
| US20140040600A1 (en) * | 2011-04-21 | 2014-02-06 | Renesaselectronics Corporation | Data processor |
| CN106874758A (en) * | 2016-08-22 | 2017-06-20 | 阿里巴巴集团控股有限公司 | A kind of method and apparatus for recognizing document code |
| CN106529296A (en) * | 2016-11-16 | 2017-03-22 | 武汉工程大学 | Method for attacking software protection virtual machine based on fuzzy clustering |
| CN109923546A (en) * | 2016-12-19 | 2019-06-21 | 比特梵德知识产权管理有限公司 | The event filtering of virtual machine security application program |
| CN108664312A (en) * | 2018-04-04 | 2018-10-16 | 苏州天魂网络科技股份有限公司 | A kind of virtual machine guard method reinforced based on fictitious order collection |
| CN108985014A (en) * | 2018-06-13 | 2018-12-11 | 珠海金山网络游戏科技有限公司 | The method and device of the Python byte code files in game is protected in a kind of export |
| CN109145534A (en) * | 2018-07-24 | 2019-01-04 | 上海交通大学 | For the antialiasing system and method for software virtual machine protection |
Non-Patent Citations (1)
| Title |
|---|
| 章华清: "基于虚拟机的软件动态保护***的设计与实现", 《中国优秀博硕士学位论文全文数据库(硕士)信息科技辑》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112199158B (en) | 2021-11-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11200047B2 (en) | Identifying versions of running programs using signatures derived from object files | |
| JP2002539523A (en) | How to monitor program execution | |
| US10248424B2 (en) | Control flow integrity | |
| CN101884025B (en) | Method and system for accelerating procedure return sequences | |
| CN106547587B (en) | Apparatus and method for generating configuration file of target program | |
| US7624384B2 (en) | Apparatus, system, and method of dynamic binary translation with translation reuse | |
| US9734620B2 (en) | Apparatus and method for graphics state management | |
| US20200133885A1 (en) | Dynamic memory protection | |
| CN104685443A (en) | Pinning boot data for faster boot | |
| CN114385189A (en) | Function address space layout randomization method for deep embedded system | |
| CN111913742B (en) | Program processing method and related equipment | |
| CN107506622A (en) | A kind of software dynamic birthmark and plagiarism detection method based on memory object access sequence | |
| CN112199158B (en) | Virtual machine protected interpretation routine identification method, device, equipment and storage medium | |
| CN117389629B (en) | Branch prediction method, device, electronic equipment and medium | |
| US9639477B2 (en) | Memory corruption prevention system | |
| CN117873483A (en) | Method and device for compiling intelligent contract, electronic equipment and storage medium | |
| CN116627502B (en) | Optimization method of jump instruction, jump method and device of instruction and electronic equipment | |
| US10802854B2 (en) | Method and apparatus for interpreting bytecode instruction stream | |
| CN110515659B (en) | Atomic instruction execution method and device | |
| CN112199116B (en) | Operand stack register identification method, device, equipment and storage medium | |
| CN107817972B (en) | Cache code processing method and device, storage medium and electronic equipment | |
| CN104077173A (en) | Execution method for JAVA program instruction in smart card, and smart card | |
| CN112966258B (en) | Control flow integrity protection method, system and device and readable storage medium | |
| CN114625646A (en) | Method and device for detecting system memory boundary crossing | |
| CN112199160B (en) | Virtual instruction recovery method, device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |