基于进程级虚拟机的软件防篡改方法

Software tamper proofing based on process-level virtual machine

分析整理了进程级虚拟机(PVM)保护机制,并提出一种基于进程级虚拟机的软件防篡改方法.该方法将校验和哨兵技术及反调试技术以虚拟指令(VI)的方式融合进来,设计并实现了多种防篡改安全指令(TPI)和反调试安全指令(ADI),并基于哨兵环和随机化的思想植入源程序中.保证被保护程序的内部代码不遭到恶意篡改攻击,且程序在无损环境中执行.最后,通过原型系统VMGuards进行验证,实验结果表明VMGuards的保护粒度与保护后程序的执行性能开销之间能达到很好的平衡.

The mechanism of the PVM（process-level virtual machine）protection was discussed,and a novel method of software tamper proofing was suggested,which combined the idea of checksumming guards and anti-debug technique.Several kinds of tamper proofing instructions（TPI）and anti-debug instructions（ADI）were designed,moreover,they were inserted to the program based on the idea of guards-ring and randomization.By this very design,this method detects and responds to the tamper behavior occurred inside of the program during program execution,and it guarantees that the execution outside environment is unharmed.Finally,aproof-of-concept prototype,VMGuards,was implemented to demonstrate our idea.And the experiments show that the protection granularity and performance overhead can achieve a good balance.