Shared library file simulation method, device, computer equipment and storage medium

Abstract

The present invention discloses a shared library file simulation method, device, computer equipment and storage medium. The method comprises: mapping the shared library file to be simulated into the virtual memory of the simulation execution framework; isolating the virtual memory from the system memory; mapping the access to the virtual file to the system file; modifying the function address of the function to be intercepted; registering the preset function variable name and the preset function name so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name; returning the function to be intercepted in the shared library file to be simulated through the Hook function, and outputting the value returned by the intercepted function through the simulation execution framework, so as to realize the analysis of the shared library file to be simulated. The technical solution of the present invention can dynamically simulate and analyze the shared library file, reducing the difficulty of analyzing the shared library file.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a shared library file simulation method, device, computer equipment and storage medium. Background Art

[0002] With the development of mobile platforms, most commercial Android apps currently use reinforcement technology to varying degrees before being released to the app market.

[0003] Since Java layer programs can be easily restored to source code, most manufacturers choose to write key algorithms into shared library files using C / C++. Mobile security vendors such as Bangbang, iCrypt, Tencent LeGu, and 360 not only pack shared library files, but also use OLLVM obfuscation technology to further strengthen them.

[0004] However, the obfuscated application has a large number of false blocks added, which not only makes the program logic extremely complicated but also makes the disassembled code and flow chart extremely difficult to understand. However, it is easy to be used by malicious applications to harden the application, which hinders the analysis of the application. Summary of the invention

[0005] The embodiment of the present invention provides a shared library file simulation method, device, computer equipment and storage medium to solve the problem that it is difficult to analyze the shared library file.

[0006] A shared library file simulation method, comprising:

[0007] By means of a simulation execution framework, mapping the shared library file to be simulated into the virtual memory of the simulation execution framework;

[0008] Isolating the virtual memory from the system memory through the virtual memory mechanism of the simulation execution framework;

[0009] By simulating a virtual file system in the execution framework, access to virtual files is mapped to system files;

[0010] According to a preset function address, modify the function address of the function to be intercepted, wherein the function to be intercepted is a function in a shared library format file;

[0011] Registering a preset function variable name and a preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name;

[0012] Objdump command is used to obtain dependencies of the shared library file to be simulated, and the function to be intercepted in the shared library file to be simulated is returned through the Hook function, and the value returned by the function to be intercepted is output through the simulation execution framework to analyze the shared library file to be simulated.

[0013] A shared library file simulation device, comprising:

[0014] A file mapping module, used for mapping the shared library file to be simulated into the virtual memory of the simulation execution framework through the simulation execution framework;

[0015] A memory isolation module, used to isolate the virtual memory from the system memory through the virtual memory mechanism of the simulation execution framework;

[0016] An access mapping module, for mapping access to virtual files to system files by simulating a virtual file system in an execution framework;

[0017] An address modification module, used for modifying the function address of the to-be-intercepted function according to a preset function address, wherein the to-be-intercepted function is a function in a shared library format file;

[0018] A function registration module, used to register a preset function variable name and a preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name;

[0019] A data output module is used to obtain the dependencies of the shared library file to be simulated through the Objdump command, and return the function to be intercepted in the shared library file to be simulated through the Hook function, and output the value returned by the function to be intercepted through the simulation execution framework to realize the analysis of the shared library file to be simulated.

[0020] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the shared library file simulation method are implemented.

[0021] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the shared library file simulation method are implemented.

[0022] In the above-mentioned shared library file simulation method, device, computer equipment and storage medium, the shared library file to be simulated is mapped to the virtual memory of the simulation execution framework through the simulation execution framework; the virtual memory is isolated from the system memory through the virtual memory mechanism of the simulation execution framework; the access to the virtual file is mapped to the system file through the virtual file system in the simulation execution framework; the function address of the function to be intercepted is modified according to the preset function address; the preset function variable name and the preset function name are registered so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name; the dependency of the shared library file to be simulated is obtained through the preset command, and the function to be intercepted in the shared library file to be simulated is returned through the Hook function, and the value returned by the intercepted function is output through the simulation execution framework to realize the analysis of the shared library file to be simulated. This enables the dynamic simulation and analysis of the shared library file, reducing the difficulty of analyzing the shared library file. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0024] Figure 1 is a schematic diagram of an application environment of a shared library file simulation method in one embodiment of the present invention;

[0025] Figure 2 is a flow chart of a shared library file simulation method in one embodiment of the present invention;

[0026] Figure 3 is a flow chart of a shared library file simulation method in one embodiment of the present invention;

[0027] Figure 4 is a flow chart of step S10 of a shared library file simulation method in one embodiment of the present invention;

[0028] Figure 5 is a flow chart of step S30 of a shared library file simulation method in one embodiment of the present invention;

[0029] Figure 6 is a flow chart of step S40 of a shared library file simulation method in one embodiment of the present invention;

[0030] Figure 7 is a schematic diagram of a shared library file simulation device in one embodiment of the present invention;

[0031] Figure 8 is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] The shared library file simulation method provided in this application can be applied in Figure 1 In the application environment shown, the application environment includes a server and a client, wherein the server and the client are connected through a network, which can be a wired network or a wireless network, and the client specifically includes but is not limited to various personal computers, laptops, smart phones and tablet computers and portable wearable devices, and the server can be implemented with an independent server or a server cluster composed of multiple servers. The server maps the shared library file to be simulated to the virtual memory of the simulation execution framework through the simulation execution framework; isolates the virtual memory from the system memory through the virtual memory mechanism of the simulation execution framework; maps the access to the virtual file to the system file through the virtual file system in the simulation execution framework; modifies the function address of the function to be intercepted according to the preset function address; registers the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name; obtains the dependency of the shared library file to be simulated through the preset command, and returns the function to be intercepted in the shared library file to be simulated through the Hook function, and outputs the value returned by the intercept function through the simulation execution framework, so as to realize the analysis of the shared library file to be simulated. This enables dynamic simulation and analysis of shared library files, reducing the difficulty of analyzing shared library files.

[0034] In one embodiment, if Figure 2 As shown, a shared library file simulation method is provided, which is applied in Figure 1 The server in the example is used as an example to illustrate, specifically including steps S10 to S60, which are described in detail as follows:

[0035] S10: Mapping the shared library file to be simulated into the virtual memory of the simulation execution framework through the simulation execution framework.

[0036] The shared library file refers to the elf file. The simulation execution framework refers to the cross-platform simulation execution framework Unicorn, which can execute native programs of instruction sets such as Arm, Arm64, M68K, Mips, Sparc, and X86 across platforms. The elf file to be simulated refers to the object to be simulated by the simulation execution framework. The elf file refers to the binary file, executable file, object code, shared library, and core dump format file.

[0037] Through the simulation execution framework, the elf file to be simulated is mapped to the virtual memory of the simulation execution framework. Specifically, the mapping of the elf file to be simulated includes parsing, relocating, symbol parsing, etc. of the elf file to be simulated. Among them, parsing the elf file to be simulated refers to converting the elf file to be simulated into a binary format shared library format so file through the Pyelftools library. The Pyelftools library refers to a python library for parsing and analyzing the elf file to be simulated. Relocating the elf file to be simulated refers to making the link address consistent with the running address before the simulation execution framework executes the elf file to be simulated. Among them, the link address refers to the specified address when the code in the elf file to be simulated links to the corresponding function, and the running address refers to the loading address when the elf file to be simulated is loaded into the memory. Symbol parsing of the elf file to be simulated refers to parsing the initialization function and variables in the elf file to be simulated. Specifically, when the elf file to be simulated is mapped, the elf file to be simulated is automatically parsed and relocated through the Pyelftools library.

[0038] It should be noted that when the elf file to be simulated is symbolically parsed, the elf file to be simulated is parsed through the Pyelftools library to obtain the base address and structure pointer address of the initialization array in the elf file to be simulated, and the address of the initialization array is determined according to the base address and structure pointer address. It should be noted that when the elf file to be simulated is simulated, the function in the initialization array needs to be called, and when the content in the initialization array is detected to be 0, the initialization array address is relocated.

[0039] S20: Isolate virtual memory from system memory by simulating the virtual memory mechanism of the execution framework.

[0040] Among them, the virtual memory mechanism refers to the mechanism for mapping the system's memory through the API in the simulation execution framework. The API in the simulation execution framework includes uc_mem_map, uc_mem_read, and uc_mem_write. Through the virtual memory mechanism of the simulation execution framework, the virtual memory is isolated from the system memory. Specifically, through the API in the simulation execution framework, the system memory is mapped to the virtual memory of the simulation execution framework. It should be noted that before mapping the system memory through uc_mem_map, the base address of the system memory is obtained, and according to the base address of the system memory, the base address of the virtual memory is changed to be consistent with the base address of the system memory, and further, the memory block size in the virtual memory is changed to an integer multiple of the base address of the system memory. Through the address alignment function in the simulation execution framework, the base address of the virtual memory is aligned with the base address of the system memory, and the memory block size in the virtual memory is calculated to obtain the virtual alignment address and the virtual memory size, and the virtual alignment address and the virtual memory size are returned to the simulation execution framework.

[0041] S30: Mapping access to the virtual file to the system file by simulating the virtual file system in the execution framework.

[0042] Wherein, the virtual file system refers to a system that simulates system files. System files refer to file systems created by users. Mapping access to virtual files to system files means that by accessing virtual files in the simulation execution framework, system files can be accessed. Through the virtual file system in the simulation execution framework, access to virtual files is mapped to system files. Specifically, the system files are mapped through the virtual system file interface in the virtual file system, and further, the preset interface call function is intercepted or controlled through the Hook function in the simulation execution framework. Specifically, when the preset interface call function of the virtual file in the virtual file system is detected, the preset interface call function is intercepted through the Hook function in the simulation execution framework, so that the preset interface call function calls the file from the system file. Wherein, the Hook function in the simulation execution framework refers to a preset function that can call back or intercept a function. Preferably, the Hook function in the simulation execution framework can be a syscall_handler.set_handler function. The preset interface call function refers to a function that can access the system file through the interface according to the user's custom settings. The preset interface call function includes but is not limited to read, open, close, writev, fstat64, openat, and fstatat64 functions.

[0043] It should be noted that when accessing a virtual file, first, the system file information is obtained, wherein the system file information includes the directory hierarchy information of the file in the system memory, and the data information corresponding to the directory hierarchy information of the file. According to the directory hierarchy information, the data information corresponding to the directory hierarchy information is stored in a preset virtual file directory. Among them, the preset virtual file directory refers to a file directory created according to user customization for storing system file information. Furthermore, the preset interface call function is parsed through the Hook function in the simulation execution framework, and the calling path of the preset interface function is changed to call from the preset virtual file directory, thereby obtaining the system file information in the preset virtual file directory, so as to realize the mapping of the access to the virtual file to the system memory.

[0044] S40: modifying the address of the function to be intercepted according to a preset function address, wherein the function to be intercepted is a function in a shared library format file.

[0045] Among them, the preset function address refers to the function address set according to the user's custom setting. The function to be intercepted refers to the object executed by the Hook function in the simulation execution framework. It should be noted that the function to be intercepted can be a preset interface call function, which is an initialization function when mapping the elf file to be simulated. According to the preset function address, the address of the function to be intercepted is modified. Specifically, the address of the function to be intercepted is obtained, and the address of the function to be intercepted is changed according to the preset function address.

[0046] S50: registering a preset function variable name and a preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name.

[0047] Among them, the preset function variable name refers to the variable name in the function statement defined by the user. The preset function name refers to the function name defined by the user. The preset function variable name and the preset function name are set through the metaclass in Python. Specifically, the preset function variable name and the preset function name are stored in the database. When the variable name or function name detected by the Hook function in the simulation execution framework is the preset function variable name or preset function name in the database, the value of the function corresponding to the detected variable name or function name is returned.

[0048] For example, the preset function variable names are jvm_name, jvm_method and jvm_fields defined by JavaClassDef; the preset function names are find_method, find_method_by_id and find_field functions. When the variable name detected by the Hook function in the simulation execution framework is jvm_method and the function name is ind_method, the method in ind_method is returned by the Hook function in the simulation execution framework.

[0049] S60: Obtain dependencies of the shared library file to be simulated through the Objdump command, return the function to be intercepted in the shared library file to be simulated through the Hook function, and output the value returned by the intercepted function through the simulation execution framework to analyze the shared library file to be simulated.

[0050] Among them, Objdump refers to a target analysis tool in Linux, which is used to analyze binary files in elf format. The dependency of the elf file to be simulated refers to the binary shared library format file that the binary file in elf format depends on when running in Linux. For example, the dependency of the so format of the elf file to be simulated is libc.so. Specifically, first, the elf file to be simulated is parsed through the arm-linux-gnueabi-Objdump command in Objdump, and further, all the headers in the elf file to be simulated are obtained through the -X instruction, and all the headers in the elf file to be simulated are filtered through the grep instruction to obtain the dependency of the so format of the elf file to be simulated. Finally, the dependency is loaded to obtain the so format file of the elf file to be simulated. Furthermore, the function to be intercepted in the elf file to be simulated is returned through the Hook function, the data obtained by the function to be intercepted is obtained, and the data obtained by the function to be intercepted is output. Among them, the data output obtained by the interception function can be a Logger formatted output. The Logger formatted output refers to outputting the data obtained by the interception function in the form of a log through the Hook function in the simulation execution framework, so as to analyze the shared library format file of the simulated elf file.

[0051] In this embodiment, the elf file to be simulated is mapped to the virtual memory of the simulation execution framework through the simulation execution framework; the virtual memory is isolated from the system memory through the virtual memory mechanism of the simulation execution framework; the access to the virtual file is mapped to the system file through the virtual file system in the simulation execution framework; the function address of the function to be intercepted is modified according to the preset function address; the preset function variable name and the preset function name are registered; the dependency of the elf file to be simulated is obtained through the Objdump command, and the function to be intercepted in the elf file to be simulated is returned through the Hook function, and the logger formatted output is performed through the simulation execution framework to realize the analysis of the elf file to be simulated. The efficiency and accuracy of the analysis of the elf file can be improved, and the analysis of the obfuscated elf file can be simplified.

[0052] In one embodiment, if Figure 3 As shown, before step S60, before obtaining the dependencies of the shared library file to be simulated through a preset command and returning the function to be intercepted in the shared library file to be simulated through the Hook function, it includes:

[0053] S601: Access the register of the simulation execution framework and detect whether there is an unconditional execution instruction, wherein the register includes the number of the function to be intercepted.

[0054] Among them, the unconditional execution instruction refers to the instruction in the ARM instruction set. The number of the function to be intercepted refers to the constant customized by the user in the register of the simulation execution framework, which is used to record the function to be intercepted. Specifically, the register in the simulation execution framework is accessed. When the Hook function intercepts the function to be intercepted that accesses the register, the byte data in the register is detected. When the number of bytes detected is \xE8\xBf, there is an unconditional execution instruction. Among them, the unconditional execution instruction is the IT AL instruction.

[0055] Further, when the number of bytes in the register is detected and the number of bytes is not detected to be \xE8\xBf, there is no unconditional execution instruction, and it is determined that the Hook function has failed to intercept the function to be intercepted, and the function to be intercepted is intercepted again.

[0056] S602: If there is an unconditional execution instruction, read the value in the register.

[0057] Among them, when an unconditional execution instruction is detected, the data in the register is read. If the read value is empty, it is determined that the Hook function has failed to intercept the function to be intercepted, and the function to be intercepted is intercepted again; if the read value is not empty, it is determined that the Hook function has successfully intercepted the function to be intercepted. According to the value in the register, the number of the function to be intercepted is determined, and according to the number of the function to be intercepted, the corresponding function to be intercepted is determined.

[0058] S603: Extract the corresponding target to-be-intercepted function number from the to-be-intercepted function number according to the value in the register.

[0059] The function number to be intercepted refers to a constant corresponding to the value in the register. The target function number to be intercepted refers to a constant corresponding to the function to be intercepted. Specifically, when an unconditional execution instruction is detected, the data in the register is read. When the read value is not empty, the function number to be intercepted is determined according to the value read from the register. Further, the corresponding target function number to be intercepted is extracted from the function number to be intercepted.

[0060] S604: Determine the function to be intercepted according to the target function number to be intercepted.

[0061] Specifically, when the data read from the register is not empty, after determining the function number to be intercepted according to the read value, extract the corresponding target function number to be intercepted from the function number to be intercepted, and further determine the corresponding function to be intercepted according to the target function number to be intercepted.

[0062] In this embodiment, the register of the simulation execution framework is accessed and whether there is an unconditional execution instruction, wherein the register contains the function number to be intercepted; when the unconditional execution instruction exists, the value in the register is read; the corresponding target function number to be intercepted is extracted from the function number to be intercepted according to the value in the register; the function to be intercepted is determined according to the target function number to be intercepted. By judging the interception result of the Hook function on the function to be intercepted, the efficiency of analyzing the simulated elf file can be further improved.

[0063] In one embodiment, if Figure 4 As shown, in step S10, mapping the shared library file to be simulated to the virtual memory of the simulation execution framework through the simulation execution framework includes:

[0064] S11: The shared library file to be simulated is parsed through the Pyelftools library to obtain the base address of the initialized array and the structure pointer address in the shared library file to be simulated.

[0065] Among them, the initialization array is the array when the elf file to be simulated is loaded in the simulation execution framework, and the initialization array includes an initialization function. In the simulation execution framework, the initialization array is init_array. Through the Pyelftools library, the elf file to be simulated is parsed to obtain the base address and structure pointer address of the initialization array in the elf file to be simulated. Specifically, the so format of the elf file to be simulated is parsed through the Pyelftools library to obtain the so file, and the so file is further parsed to obtain the segment part in the so file, and the segment part of the so file is traversed through the function iter_segments, and the size and offset of the initialization array are obtained from the DT_INIT_ARRAYSZ and DT_INIT_ARRAY labels to determine the base address of the initialization array. Further, the structure pointer address is obtained by calculating the offset of the initialization array, the virtual address of the head of the segment in the so file, and the offset of the virtual address of the head of the segment in the so file.

[0066] S12: Determine the initialization array address according to the base address and the structure pointer address.

[0067] The base address of the initialization array and the structure pointer address are calculated to obtain the address of the initialization array. The base address and the structure pointer address are calculated by addition.

[0068] S13: According to the initialization array address, the initialization function in the initialization array is mapped to the virtual memory of the simulation execution framework.

[0069] The initialization function refers to a necessary function that is loaded when the shared library file to be simulated is running. Specifically, after determining the initialization array address by adding the base address and the structure pointer address, further, according to the initialization array address pointer, the location of the initialization array is found, and the initialization function is obtained from the initialization array, and further, the initialization function is mapped to the virtual memory of the simulation execution framework to realize mapping the shared library file to be simulated to the virtual memory of the simulation execution framework.

[0070] In this embodiment, the elf file to be simulated is parsed through the Pyelftools library to obtain the base address and structure pointer address of the initialization array in the elf file to be simulated; the address of the initialization array is determined according to the base address and the structure pointer address; according to the initialization array address, the initialization function in the initialization array is mapped to the virtual memory of the simulation execution framework. The initialization array init_array in the so format of the elf file to be simulated can be obtained to obtain the initialization function in init_array, and further, when simulating the elf file to be simulated, the simulation of the elf file to be simulated can be completed through the initialization function.

[0071] In one embodiment, if Figure 5 As shown, in step S30, the virtual file access is mapped to the system file by simulating the virtual file system in the execution framework, including:

[0072] S31: Allocate the interface call function according to a preset allocation method to obtain a preset interface call function.

[0073] The preset allocation method refers to allocating interface call functions with different functions. For example, according to the functions of the interface call functions, the interface call functions are allocated to read, open, close, writev, fstat64, openat, and fstatat64 functions.

[0074] S32: According to the preset virtual file directory, the calling path of the preset interface calling function is replaced with the preset virtual file directory path through the Hook function.

[0075] Specifically, when accessing a virtual file, first, obtain the system file information, wherein the system file information includes the directory hierarchy information of the file in the system memory, and the data information corresponding to the directory hierarchy information of the file. According to the directory hierarchy information, store the data information corresponding to the directory hierarchy information in a preset virtual file directory. The preset virtual file directory refers to a file directory created according to user customization for storing system file information. Furthermore, the preset interface call function is parsed through the Hook function in the simulation execution framework, and the call path of the preset interface function is changed to be called from the preset virtual file directory.

[0076] It should be noted that by changing the calling path of the preset interface function to call from the preset virtual file directory, when it is detected that the preset interface function accesses the virtual file, the access to the virtual file is directly mapped to the access to the preset virtual file directory according to the change in the calling path, so as to realize the mapping of the access to the virtual file to the system file.

[0077] In this embodiment, the interface call function is allocated by a preset allocation method to obtain a preset interface call function; according to the preset virtual file directory, the call path of the preset interface call function is replaced with the preset virtual file directory path through the Hook function. It is possible to obtain real data information from the system, prevent the simulation of the simulated elf file from jumping out due to data errors, and improve the reliability of the simulated elf simulation.

[0078] In one embodiment, if Figure 6As shown, in step S40, the function address of the function to be intercepted is modified according to the preset function address, including:

[0079] S41: Obtain the address of the function to be intercepted from a preset function address table.

[0080] The preset function address table refers to an address table created by user address table creation function. Exemplarily, the Jni Function Table address table is created by write_function_table function. Further, the address of the function to be intercepted is obtained from the preset function address table. The function to be intercepted may be a preset interface call function, and the address of the function to be intercepted may be a preset interface call function address.

[0081] S42: Modify the address of the function to be intercepted according to the preset function address.

[0082] Specifically, according to a preset function address, the address of the function to be intercepted is modified so that the function to be intercepted executes a corresponding module according to the preset function address.

[0083] It should be noted that after the address of the function to be intercepted is modified, when the function to be intercepted is intercepted or controlled by the Hook function in the simulation execution framework, the module corresponding to the preset function address is executed by the function to be intercepted according to the preset function address.

[0084] Exemplarily, a Jni Function Table address table is created by the write_function_table function. The JniFunction Table address table includes function A. Function A corresponds to module C, and the preset function address is D. Function A corresponds to module C and is changed to obtain function A corresponding to module D. After function A is controlled by the Hook function in the simulation execution framework, function A executes module D first.

[0085] In this embodiment, by obtaining the address of the function to be intercepted from the preset function address table, the address of the function to be intercepted is modified according to the preset function address. When simulating the elf file, the corresponding module data can be found for the user-defined function address according to the user's needs, thereby improving the practicality of the shared library file simulation method.

[0086] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0087] In one embodiment, a shared library file simulation device is provided, and the shared library file simulation device corresponds one-to-one to the shared library file simulation method in the above embodiment. Figure 7 As shown, the shared library file simulation device includes: a file mapping module 10, a memory isolation module 20, an access mapping module 30, an address modification module 40, a function registration module 50, and a data output module 60. The detailed description of each functional module is as follows:

[0088] A file mapping module 10, used for mapping the shared library file to be simulated into the virtual memory of the simulation execution framework through the simulation execution framework;

[0089] A memory isolation module 20, used to isolate the virtual memory from the system memory by simulating the virtual memory mechanism of the execution framework;

[0090] An access mapping module 30, for mapping access to virtual files to system files by simulating a virtual file system in an execution framework;

[0091] An address modification module 40 is used to modify the function address of the to-be-intercepted function according to a preset function address, wherein the to-be-intercepted function is a function in a shared library format file;

[0092] The function registration module 50 is used to register the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can return the intercepted function according to the preset function variable name and the preset function name;

[0093] The data output module 60 is used to obtain the dependencies of the shared library file to be simulated through the Objdump command, return the function to be intercepted in the shared library file to be simulated through the Hook function, and output the value returned by the intercepted function through the simulation execution framework to realize the analysis of the shared library file to be simulated.

[0094] Furthermore, the shared library file simulation device also includes:

[0095] The instruction detection module 601 is used to access the register of the simulation execution framework and detect whether there is an unconditional execution instruction, wherein the register includes the number of the function to be intercepted;

[0096] The value reading module 602 is used to read the value in the register when there is an unconditional execution instruction;

[0097] The function number module 603 is used to extract the corresponding target to-be-intercepted function number from the to-be-intercepted function number according to the value in the register;

[0098] The function determination module 604 is used to determine the function to be intercepted according to the target function number to be intercepted.

[0099] Furthermore, the file mapping module 10 includes:

[0100] The file parsing submodule 11 is used to parse the shared library file to be simulated through the Pyelftools library to obtain the base address of the initialized array and the structure pointer address in the shared library file to be simulated;

[0101] An address determination submodule 12, used to determine the initialization array address according to the base address and the structure pointer address;

[0102] The function mapping submodule 13 is used to map the initialization function in the initialization array to the virtual memory of the simulation execution framework according to the initialization array address.

[0103] Further, the access mapping module 30 includes:

[0104] The function allocation submodule 31 is used to allocate the interface call function according to a preset allocation method to obtain a preset interface call function;

[0105] The path replacement submodule 32 is used to replace the calling path of the preset interface calling function with the preset virtual file directory path through the Hook function according to the preset virtual file directory.

[0106] Furthermore, the address modification module 40 includes:

[0107] The address acquisition submodule 41 is used to acquire the address of the function to be intercepted from a preset function address table;

[0108] The address modification submodule 42 is used to modify the address of the function to be intercepted according to a preset function address.

[0109] The specific definition of the shared library file simulation device can be found in the definition of the shared library file simulation method mentioned above, which will not be repeated here. Each module in the above-mentioned shared library file simulation device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0110] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a shared library file simulation method is implemented.

[0111] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the shared library file simulation method in the above embodiment are implemented, such as steps S10 to S60. Alternatively, when the processor executes the computer program, the functions of each module / unit of the shared library file simulation device in the above embodiment are implemented, such as the functions of modules 10 to 60. To avoid repetition, it will not be described here.

[0112] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the shared library file simulation method in the above method embodiment is implemented, or when the computer program is executed by a processor, the functions of each module / unit in the shared library file simulation device in the above device embodiment are implemented. To avoid repetition, it will not be described here.

[0113] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0114] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0115] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A shared library file simulation method, characterized in that: The shared library file simulation method comprises: By means of a simulation execution framework, mapping the shared library file to be simulated into the virtual memory of the simulation execution framework; Isolating the virtual memory from the system memory through the virtual memory mechanism of the simulation execution framework; By simulating a virtual file system in the execution framework, access to virtual files is mapped to system files; According to a preset function address, modify the function address of the function to be intercepted, wherein the function to be intercepted is a function in a shared library format file; Registering a preset function variable name and a preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name; Obtain the dependencies of the shared library file to be simulated through the Objdump command, return the function to be intercepted in the shared library file to be simulated through the Hook function, and output the value returned by the function to be intercepted through the simulation execution framework to analyze the shared library file to be simulated; The step of mapping the shared library file to be simulated into the virtual memory of the simulation execution framework through the simulation execution framework includes: Parsing the shared library file to be simulated through the Pyelftools library to obtain the base address of the initialized array and the structure pointer address in the shared library file to be simulated; Determine the initialization array address according to the base address and the structure pointer address; According to the initialization array address, mapping the initialization function in the initialization array to the virtual memory of the simulation execution framework; The step of mapping the access to the virtual file to the system file by simulating the virtual file system in the execution framework includes: According to a preset allocation method, the interface call function is allocated to obtain a preset interface call function; According to the preset virtual file directory, the calling path of the preset interface calling function is replaced with the preset virtual file directory path through the Hook function.

2. The shared library file simulation method according to claim 1, characterized in that: Before obtaining the dependencies of the shared library file to be simulated by using the Objdump command and returning the function to be intercepted in the shared library file to be simulated by using the Hook function, the method includes: Accessing the register of the simulation execution framework and detecting whether there is an unconditional execution instruction, wherein the register includes the number of the function to be intercepted; If there is an unconditional execution instruction, the value in the register is read; Extracting the corresponding target to-be-intercepted function number from the to-be-intercepted function number according to the value in the register; The function to be intercepted is determined according to the target function number to be intercepted.

3. The shared library file simulation method according to claim 1, characterized in that: The modifying of the function address of the function to be intercepted according to the preset function address includes: Obtain the address of the function to be intercepted from a preset function address table; According to the preset function address, the address of the function to be intercepted is modified.

4. A shared library file simulation device, characterized in that: The shared library file simulation device comprises: A file mapping module, used for mapping the shared library file to be simulated into the virtual memory of the simulation execution framework through the simulation execution framework; A memory isolation module, used to isolate the virtual memory from the system memory through the virtual memory mechanism of the simulation execution framework; An access mapping module, for mapping access to virtual files to system files by simulating a virtual file system in an execution framework; An address modification module, used for modifying the function address of the to-be-intercepted function according to a preset function address, wherein the to-be-intercepted function is a function in a shared library format file; A function registration module, used to register a preset function variable name and a preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name; A data output module, used for obtaining the dependencies of the shared library file to be simulated through the Objdump command, returning the function to be intercepted in the shared library file to be simulated through the Hook function, and outputting the value returned by the function to be intercepted through the simulation execution framework, so as to realize the analysis of the shared library file to be simulated; Wherein, the file mapping module includes: A file parsing submodule, used for parsing the shared library file to be simulated through the Pyelftools library to obtain the base address of the initialized array and the structure pointer address in the shared library file to be simulated; An address determination submodule, used for determining the initialization array address according to the base address and the structure pointer address; A function mapping submodule, used for mapping the initialization function in the initialization array to the virtual memory of the simulation execution framework according to the initialization array address; Among them, the access mapping module is also used to allocate the interface calling function according to the preset allocation method to obtain the preset interface calling function; according to the preset virtual file directory, the calling path of the preset interface calling function is replaced with the preset virtual file directory path through the Hook function.

5. The shared library file simulation device according to claim 4, characterized in that: The shared library file simulation device also includes: An instruction detection module, used for accessing the register of the simulation execution framework and detecting whether there is an unconditional execution instruction, wherein the register includes the number of the function to be intercepted; A value reading module, used for reading the value in the register when there is an unconditional execution instruction; A function number module, used for extracting a corresponding target to-be-intercepted function number from the to-be-intercepted function number according to the value in the register; The function determination module is used to determine the function to be intercepted according to the target function number to be intercepted.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the shared library file simulation method according to any one of claims 1 to 3 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the shared library file simulation method according to any one of claims 1 to 3 is implemented.

Images