Using security compiler to realize the middle layer based on LLVM compiler. The protection scheme based on LLVM needs to change the existing compilation environment, replace the compiler and adjust the compilation options. It has a great impact on the development environment and is not easy to use. From the perspective of protection effect, the protection scheme based on LLVM is limited by the compiler framework, and the generated code can only be confused and logically converted, and can still be decompiled, which has limited confusing effect on control flow, clear boundary and easier analysis.

Decompilation effect after OLLVM protection, decompilation effect:

A kind of virtualization protection using VirboxProtector. ARM virtualization is a virtual machine protection method introduced by Virbox Protector according to the instruction of ARM architecture. By translating the original ARM instruction into a customized virtual machine instruction, it will be executed in the customized virtual machine at runtime. Virbox Protector implements a virtual machine protection tool for ARM instructions, supports the translation of instruction sets above armv7 (including thumb and thumb2) and armv8, and has high security strength, which is suitable for code protection requirements with high security requirements. Code protected by virtualization cannot be decompiled.

Decompilation effect after virus box protector protection;