Method for protecting So file from being subjected to memory Dump based on Android system

Abstract

The invention provides a method for protecting an So file from being subjected to memory Dump based on an Android system, which comprises the following steps of: adjusting an So file memory mapping behavior of an mmap function in a dynamic linker, and not reporting So file memory mapping information to a map file; calling a user-defined function to modify the file head feature information of the So file, and erasing the file head feature information; and hiding the record of the So file in the shared object list so as to complete protection of the So file. According to the method for protecting the So file from being Dumped by the memory based on the Android system, the So file in the Android system can be effectively prevented from being illegally Dumped in the memory, and the running safety of an application program is protected. In addition, due to the fact that balance between safety and performance is considered in the implementation process, the scheme is suitable for Android devices for various commercial and personal purposes.

Description

Technical Field

[0001] The invention belongs to the technical field of computer security, and specifically is a method for protecting a So file from being dumped by a memory based on an Android system. Background Art

[0002] In today's digital age, Android has become one of the most widely used mobile operating systems in the world. With the popularity of various applications based on the Android system, security issues have become increasingly prominent, especially the security of application data. As common binary library files in Android applications, shared object files (SO files) often contain sensitive business logic and data processing functions, becoming one of the main targets of attackers.

[0003] Currently, the main method to prevent So files from being dumped in memory involves encrypting the So files themselves. This method usually involves storing the So files in encrypted form on the device disk and decrypting and loading them into memory at runtime. However, this method has obvious limitations:

[0004] 1. Encryption and performance trade-off: Although encryption prevents SO files from being directly read on disk, they must be decrypted at runtime, a process that can result in significant performance overhead, especially on resource-constrained devices.

[0005] 2. Runtime data exposure: Although the So file is encrypted on disk, it must exist in plain text in memory for the application to run normally. This makes the So file in memory still exposed to malicious programs or memory dump tools with corresponding permissions during runtime.

[0006] 3. Lack of dynamic protection mechanism: Existing technologies often ignore the importance of runtime protection. Once a So file is loaded into memory, its protection usually relies on the general memory protection mechanism of the operating system, which is not enough to prevent advanced persistent threats (APT) or malware with root privileges.

[0007] Therefore, the main problem of the existing technology is that its protection measures mostly remain at the static security level, lacking a comprehensive protection strategy for the dynamic operating environment. Therefore, even if encryption measures are taken, the So file may still be dumped in memory during runtime, thereby leaking the sensitive logic and data contained therein. In addition, the existing methods usually fail to solve the integrity and confidentiality issues of data protection in memory, and fail to form a comprehensive security protection system.

[0008] In order to effectively solve the above problems, there is an urgent need for a more efficient and secure technical solution that can prevent So files from being dumped in memory during runtime. Summary of the invention

[0009] In view of the defects of the prior art, the present invention provides a method for protecting So files from being dumped in memory based on the Android system, which can effectively solve the above problems.

[0010] The technical solution adopted by the present invention is as follows:

[0011] The present invention provides a method for protecting a So file from being dumped in memory based on an Android system, comprising the following steps:

[0012] Step S1, in the Android system, modifying the startup script of the application by introducing a custom library file and a custom code segment into the startup script of the application; the custom library file is an inline hook InlineHook, and the inline hook Inline Hook establishes a redirection relationship between an mmap function in a dynamic linker Linker in the startup script of the application and the custom code segment;

[0013] Step S2, when the application is started, the modified startup script of the application is executed in the following manner: first, the dynamic linker Linker is initialized, and then, the dynamic linker Linker dynamically links the So file required by the application when the application is started; then, when the mmap function in the dynamic linker Linker is executed, the custom code segment is jumped to execute through the inline hook Inline Hook, and the So file memory mapping behavior of the mmap function in the dynamic linker Linker is adjusted through the custom code segment, and the So file memory mapping information is not reported to the maps file, thereby hiding the So file memory mapping information;

[0014] Step S3, after the dynamic linker Linker loads the dynamically linked So file into the memory, it calls the custom function to modify the file header characteristic information of the So file and erases the file header characteristic information;

[0015] Step S4, hiding the record of the So file in the shared object list solist, thereby completing the protection of the So file.

[0016] Preferably, it also includes:

[0017] Monitor the initialized dynamic linker Linker. When the dynamic linker Linker is monitored to link the So file required by the application, determine whether the linked So file is a protected So file; if so, execute the Inline Hook operation and steps S3 and S4; if not, jump to execute the normal execution logic.

[0018] Preferably, the maps file is a maps file located in the proc / [pid] path, and is used to store memory address mapping allocation relationships.

[0019] Preferably, a custom function is called to modify the file header characteristic information of the So file and erase the file header characteristic information, specifically:

[0020] The custom function locates the file header of the So file in the memory, and then replaces or deletes the identifier of the file header feature.

[0021] Preferably, step S4 is specifically:

[0022] Modify the code segment executed by the dynamic linker Linker directly in memory to change the way it handles the shared object list solist and hide the record of the So file in the shared object list solist.

[0023] The method for protecting So files from being dumped in memory based on the Android system provided by the present invention has the following advantages:

[0024] The method for protecting So files from being dumped in memory based on the Android system provided by the present invention can effectively prevent So files in the Android system from being illegally dumped in memory, thereby protecting the running security of the application program. In addition, since the balance between security and performance is considered during the implementation process, the solution is applicable to various Android devices for commercial and personal use. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flow chart of a method for protecting So files from being dumped in memory based on an Android system provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the technical problems, technical solutions and beneficial effects solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0027] The present invention provides a method for protecting So files from memory dump based on Android system. The method adopts the following three core technical innovations to achieve more comprehensive and dynamic memory protection for So files, including: changing the linker function jump through Inline Hook to achieve map hiding, erasing So file header features and hiding itself in the So list (solist).

[0028] See also Figure 1 The present invention provides a method for protecting So files from being dumped in memory based on an Android system, comprising the following steps:

[0029] Step S1, in the Android system, modifying the startup script of the application by introducing a custom library file and a custom code segment into the startup script of the application; the custom library file is an inline hook InlineHook, and the inline hook Inline Hook establishes a redirection relationship between an mmap function in a dynamic linker Linker in the startup script of the application and the custom code segment;

[0030] Step S2, when the application starts, execute the modified startup script of the application, in the following manner: first initialize the dynamic linker Linker, then, the dynamic linker Linker dynamically links the So file required by the application when the application starts; then, when the mmap function in the dynamic linker Linker is executed, the custom code segment is jumped to execute through the inline hook Inline Hook, and the So file memory mapping behavior of the mmap function in the dynamic linker Linker is adjusted through the custom code segment, and the So file memory mapping information is not reported to the maps file, thereby hiding the So file memory mapping information; wherein, the maps file is a maps file located under the proc / [pid] path, and is used to store the memory address mapping allocation relationship.

[0031] In this step, in order to improve the flexibility of the method, the following configuration can be performed: the initialized dynamic linker Linker is monitored, and when the dynamic linker Linker is monitored to link the So file required by the application, it is determined whether the linked So file is a protected So file; if so, the Inline Hook operation and steps S3 and S4 are executed; if not, the normal execution logic is jumped to execute.

[0032] Step S3, after the dynamic linker Linker loads the dynamically linked So file into the memory, it calls the custom function to modify the file header characteristic information of the So file and erases the file header characteristic information;

[0033] In this step, a custom function is called to modify the file header feature information of the So file and erase the file header feature information. Specifically, the custom function locates the file header of the So file in the memory and then replaces or deletes the identifier of the file header feature.

[0034] Step S4, hiding the record of the So file in the shared object list solist, thereby completing the protection of the So file.

[0035] Step S4 is specifically as follows:

[0036] Modify the code segment executed by the dynamic linker Linker directly in memory to change the way it handles the shared object list solist and hide the record of the So file in the shared object list solist.

[0037] The method for protecting So files from being dumped in memory based on the Android system provided by the present invention can effectively prevent So files in the Android system from being illegally dumped in memory, thereby protecting the running security of the application program. In addition, since the balance between security and performance is considered during the implementation process, the solution is applicable to various Android devices for commercial and personal use.

[0038] An embodiment is described below:

[0039] Implementation Environment

[0040] * Operating system: Android 11

[0041] *Processor: ARM64 architecture

[0042] *Target application: Sample application (AppExample)

[0043] 1.Inline Hook settings:

[0044] *When the system starts, modify the Android startup script and introduce a custom library file that contains the code for setting the Inline Hook.

[0045] *Use the Inline Hook technology to change the mmap function of the dynamic linker so that it does not report the mapped So file to the / proc / [pid] / maps file when performing memory mapping. In this way, even if the So file is loaded into memory, its location and attributes will not be displayed.

[0046] Specifically, this step realizes map hiding by changing the linker's function jump through Inline Hook; the present invention adopts Inline Hook technology to accurately modify the function jump instruction of the dynamic linker (linker) of the Android system. This technology adjusts the linker's memory mapping behavior in real time during the So file loading process, effectively hides the memory mapping information, and prevents it from being detected by external programs through system APIs (such as / proc / [pid] / maps). This improvement not only improves security, but also ensures the smoothness and efficiency of system operation by optimizing the hook process.

[0047] 2. File header feature erasure:

[0048] *After the So file is loaded into memory, a custom function is immediately called to modify the characteristic information of the So file header. This function locates the So file header in memory and replaces or deletes identifiers (such as magic numbers, version numbers, etc.) to avoid memory scanning based on these characteristics.

[0049] Specifically, after the So file is loaded into the memory, the present invention implements dynamic erasure or modification of the characteristic information (such as magic number, version information and other identifiers) of the So file header, thereby preventing memory scanning and identification based on file header features, and effectively avoiding malware from locating and dumping So files through standard characteristic recognition technology.

[0050] 3.So list hidden:

[0051] *Hide the existence of the So file by modifying the machine code in the memory of the running dynamic linker. This method does not modify the linker's source code or its static files, but directly modifies the code segment executed by the linker in memory to change the way it handles the shared object list (solist).

[0052] Specifically, the present invention further enhances security by hiding the records of So files in the shared object list (solist) of the system. By modifying the shared object management mechanism of the system, even if the So file of the application is loaded and run in the memory, its existence will not be detected by the standard list and query operation of the system, and its entry will not be displayed in the solist maintained by the system. Through this technology, even if a user or program with high authority tries to query or traverse the solist, it cannot find the protected So file.

[0053] Through the application of the above technology, the present invention effectively improves the confidentiality and security of So files in the Android system, and provides powerful and reliable security protection for applications. This method is not only suitable for preventing conventional memory dump attacks, but also can effectively resist advanced persistent threats and internal threat models, protecting the core logic and sensitive data of applications from being leaked.

[0054] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A method for protecting So files from being dumped in memory based on the Android system, characterized in that: The following steps are involved: Step S1, in the Android system, modifying the startup script of the application by introducing a custom library file and a custom code segment into the startup script of the application; the custom library file is an inline hook, and the inline hook establishes a redirection relationship between an mmap function in a dynamic linker Linker in the startup script of the application and the custom code segment; Step S2, when the application is started, the modified startup script of the application is executed in the following manner: first, the dynamic linker Linker is initialized, and then, the dynamic linker Linker dynamically links the So file required by the application when the application is started; then, when the mmap function in the dynamic linker Linker is executed, the custom code segment is jumped to execute through the inline hook Inline Hook, and the So file memory mapping behavior of the mmap function in the dynamic linker Linker is adjusted through the custom code segment, and the So file memory mapping information is not reported to the maps file, thereby hiding the So file memory mapping information; Step S3, after the dynamic linker Linker loads the dynamically linked So file into the memory, it calls the custom function to modify the file header characteristic information of the So file and erases the file header characteristic information; Step S4, hiding the record of the So file in the shared object list solist, thereby completing the protection of the So file.

2. The method for protecting So files from being dumped in memory based on the Android system according to claim 1, characterized in that: Also includes: Monitor the initialized dynamic linker Linker. When the dynamic linker Linker is monitored to link the So file required by the application, determine whether the linked So file is a protected So file; if so, execute the Inline Hook operation and steps S3 and S4; if not, jump to execute the normal execution logic.

3. The method for protecting So files from being dumped in memory based on the Android system according to claim 1, characterized in that: The maps file is a maps file located in the proc / [pid] path and is used to store memory address mapping allocation relationships.

4. The method for protecting So files from being dumped in memory based on the Android system according to claim 1, characterized in that: Call a custom function to modify the file header feature information of the So file and erase the file header feature information. Specifically: The custom function locates the file header of the So file in the memory, and then replaces or deletes the identifier of the file header feature.

5. The method for protecting So files from being dumped in memory based on the Android system according to claim 1, characterized in that: Step S4 is specifically as follows: Modify the code segment executed by the dynamic linker Linker directly in memory to change the way it handles the shared object list solist and hide the record of the So file in the shared object list solist.

Images