一种基于增强型调度器的虚拟机软件保护方法

A VIRTUAL MACHINE SOFTWARE PROTECTION METHOD BASED ON ENHANCED DISPATCHER

考虑到现有虚拟机的软件保护方法一般是通过改进虚拟指令处理函数(Handler)来提升保护强度,而调度器(Dispatcher)是除了Handler之外构成虚拟机保护框架的重要模块,为逆向分析者的重点攻击目标。针对Dispatcher模块易受静动态逆向攻击的问题,提出一种基于增强型Dispatcher的虚拟机软件保护方法。对Dispatcher模块中的指令序列进行多样化,切分所有指令序列。随机选择不同的指令片段进行控制流迭代混淆和加密。采用随机函数对指令片段进行连接,形成新的Dispatcher模块。实验表明,该方法在给受保护程序引入部分时间和空间开销下,能有效提升整体虚拟机保护框架的安全性。

The existing software protection method for virtual machine enhances protection strength by improving the virtual instruction handler.Dispatcher is an important module in the virtual machine protection framework besides Handler,which is the key attack target for reverse analysts.Aiming at the problem that dispatcher module was vulnerable to static and dynamic reverse attacks,we proposed a software protection method for virtual machine based on enhanced dispatcher.The method diversified instruction sequences in dispatcher module.All the instruction sequences were segmented and different instruction segments were randomly selected for control flow iterative confusion and encryption.Random functions were adopted to connect the instruction segments to form a new dispatcher module.The experiment shows that the proposed method can effectively improve the security of the overall virtual machine protection framework by introducing some time and space overhead to the protected program.