Patent ID: 8996882
Filing Date: 2015-03-31
Classification: G06F

Abstract:
1. An execution method of .NET program after encryption, characterized in that said method comprises: loading an HOOK engine and a .NET kernel, starting a .NET process, and beginning to run a .NET program module by an operating system; determining, by the HOOK engine, whether a current program module is encrypted; invoking, by the HOOK engine, a decryption module to decrypt the current program module, if the current program module is encrypted; compiling the current program module in real time by the HOOK engine; executing compiled program module by the HOOK engine; and determining whether the current program module invokes a sub-program module by the HOOK engine; obtaining the sub-program module, and determining whether the sub-program module is encrypted, if the sub-program module is invoked, wherein obtaining the sub program module includes locating a beginning address of a PE file of the sub program module in the process space, and invoking API of the operating system to traverse all modules in the current process, retrieving the sub program module, and obtaining information of the sub program module, and wherein locating the beginning address of the PE file of the sub program module in the process space includes moving forward from the beginning address of the sub program module to an address of integer times of 0x1000, decreasing 0x1000 from the address moved forward for traversing by the HOOK engine, and determining whether the current traversed address is the beginning address of the PE file, if yes, obtaining the address; if not, going on decreasing 0x1000 for traversing; invoking the decryption module to decrypt the sub-program module, if the sub-program module is encrypted; compiling the sub-program module in real time; executing compiled sub-program module; invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; compiling the sub-program module and executing compiled sub-program module in real time, if the sub-program module is not encrypted; going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; if the sub-program module is not invoked, going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; and compiling the current program module and executing compiled current program module in real time by the HOOK engine, if the current program module is not encrypted; going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted.