Specify the processing method, intelligent terminal, and storage medium of the hooked function

Abstract

The present invention discloses a processing method, intelligent terminal, and storage medium for a designated function being hooked. The present invention relates to the field of communication technology. The method comprises: obtaining a pre-loading address and a post-loading address of a designated function, and determining the address change state of the designated function before and after loading according to the pre-loading address and the post-loading address; determining the hook state of the designated function according to the address change state; and performing protection processing on the designated function according to the hook state. In the embodiment of the present invention, the core function in the system can be detected to be hooked, and the protection of the hooked core function is achieved by processing the hooked state of the core function, which protects the core function and saves resources.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method for hooking a specified function, an intelligent terminal, and a storage medium. Background Art

[0002] With the development of network informatization, people pay more and more attention to data security. In order to protect computer software data from being destroyed, changed and leaked due to accidental and malicious reasons, some measures need to be taken to ensure the availability, integrity and confidentiality of network data.

[0003] Traditional function protection methods are generally based on the entire application or code segment. In practice, some applications or code segments may be very important. Therefore, these applications or code segments are at risk when attacked and need to be protected, while other applications or code segments do not need to be protected. If all applications and code segments are protected, it will cause a waste of resources.

[0004] Therefore, the existing technology still needs to be improved and developed. Summary of the invention

[0005] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, a processing method for specifying a function to be HOOKed is provided, aiming to solve the problem in the prior art that all applications and code segments are protected, resulting in a waste of resources.

[0006] The technical solution adopted by the present invention to solve the problem is as follows:

[0007] In a first aspect, an embodiment of the present invention provides a method for processing a specified function being HOOKed, wherein the method comprises:

[0008] Obtaining a pre-loading address and a post-loading address of a specified function, and determining an address change state before and after loading of the specified function according to the pre-loading address and the post-loading address;

[0009] Determine the HOOK state of the specified function according to the address change state;

[0010] The designated function is protected according to the HOOK state.

[0011] In one implementation, obtaining the pre-load address of the specified function includes:

[0012] Before the program is run, obtaining the first address of the class object containing the specified function in the executable file;

[0013] Obtain data information of the class object according to the first address;

[0014] The pre-load address of the specified function is obtained based on the data information.

[0015] In one implementation, obtaining the loaded address of the specified function includes:

[0016] Obtaining the base address of the specified function generated during program execution;

[0017] Extracting a second address containing the specified function during the program execution;

[0018] According to the second address, the base address is subtracted from the second address to obtain the loaded address.

[0019] In one implementation, determining the address change state of the specified function before and after loading according to the pre-loading address and the post-loading address includes:

[0020] Get the initial value of the address change status flag;

[0021] When the pre-loading address and the post-loading address are equal, changing the initial value to 0;

[0022] When the pre-loading address and the post-loading address are not equal, the initial value is changed to 1.

[0023] In one implementation, determining the HOOK state of the specified function according to the address change state includes:

[0024] When the initial value is 1, it is determined that the specified function is HOOKed;

[0025] When the initial value is 0, it is determined that the specified function is not HOOKed.

[0026] In one implementation, the performing protection processing on the designated function according to the HOOK state includes:

[0027] When the specified function is hooked, the specified function is monitored;

[0028] When the specified function is not HOOKed, the operation instruction is not executed.

[0029] In one implementation, monitoring the specified function includes:

[0030] When the HOOK state of the specified function is an internal HOOK state, the monitoring state is set to 0;

[0031] When the HOOK state of the designated function is an external HOOK state, the monitoring state is set to 1.

[0032] In one implementation, the performing protection processing on the designated function according to the HOOK state further includes:

[0033] When the monitoring status is 0, the operation instruction is not executed;

[0034] When the monitoring status is 1, the anti-HOOK operation is performed.

[0035] In a second aspect, an embodiment of the present invention further provides a processing device for specifying a function to be HOOKed, wherein the device comprises:

[0036] An address acquisition unit, used to acquire a pre-load address and a post-load address of a specified function, and determine an address change state before and after the loading of the specified function according to the pre-load address and the post-load address;

[0037] A HOOK state acquisition unit, used for determining the HOOK state of the specified function according to the address change state;

[0038] A protection processing unit is used to perform protection processing on the specified function according to the HOOK state.

[0039] In a third aspect, the present invention also provides an intelligent terminal comprising a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors, wherein the one or more programs include a processing method for executing a specified function as described in any one of the above items being HOOKed.

[0040] In a fourth aspect, an embodiment of the present invention further provides a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute a processing method in which a specified function is HOOKed as described in any one of the above.

[0041] Beneficial effects of the present invention: The embodiment of the present invention first obtains the pre-load address and the post-load address of the specified function, and determines the address change status of the specified function before and after loading according to the pre-load address and the post-load address; then, determines the HOOK status of the specified function according to the address change status; finally, performs protection processing on the specified function according to the HOOK status. It can be seen that in the embodiment of the present invention, the core function in the system can be detected to be HOOKed, and the protection of the HOOKed core function is achieved by processing the HOOKed status of the core function, which not only protects the core function but also saves resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of a method for processing a designated function being HOOKed provided in an embodiment of the present invention.

[0044] Figure 2 A flowchart of obtaining the pre-loading address of a specified function in a processing method for a specified function being HOOKed provided in an embodiment of the present invention.

[0045] Figure 3 A flowchart of obtaining the loaded address of a specified function in a processing method for a specified function being HOOKed provided in an embodiment of the present invention.

[0046] Figure 4 A flowchart of determining the address change state of the specified function before and after loading according to the pre-loading address and the post-loading address in the processing method for the specified function being HOOKed provided in an embodiment of the present invention.

[0047] Figure 5 A flowchart of step S200 in the method for processing a designated function being HOOKed provided in an embodiment of the present invention.

[0048] Figure 6 A flowchart of step S300 in the method for processing a designated function being HOOKed provided in an embodiment of the present invention.

[0049] Figure 7 A flowchart of monitoring a designated function in a method for processing a designated function being HOOKed provided in an embodiment of the present invention.

[0050] Figure 8 A flowchart of a method for processing a designated function being HOOKed provided in an embodiment of the present invention, for performing protection processing on the designated function according to the HOOK state.

[0051] Fig. 9 It is a principle block diagram of a processing device in which a designated function is HOOKed provided by an embodiment of the present invention.

[0052] Fig.10 A block diagram of the internal structure of an intelligent terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention discloses a processing method, an intelligent terminal, and a storage medium for specifying a function to be hooked. In order to make the purpose, technical solution, and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0054] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0055] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0056] In the prior art, traditional function protection methods are generally based on the entire application or code segment. In practice, some applications or code segments may be very important. Therefore, these applications or code segments are at risk when attacked and need to be protected, while other applications or code segments do not need to be protected. If all applications and code segments are protected, it will cause a waste of resources.

[0057] In order to solve the problems of the prior art, this embodiment provides a processing method for a designated function being HOOKed, through which the protection of some core functions in an application or code segment can be realized, thereby saving resources. In practice, the designated function is run on the IOS system, which is a mobile operating system developed by Apple. The HOOK is also called a hook function. Before the system calls the function, the hook program first captures the message, and the hook function first obtains control. At this time, the hook function can process (change) the execution behavior of the function and force the end of the message transmission. In simple terms, it is to pull out the system program and turn it into our own execution code fragment. In specific implementation, first obtain the pre-load address and post-load address of the designated function, and determine the address change state before and after the loading of the designated function according to the pre-load address and the post-load address; then, determine the HOOK state of the designated function according to the address change state; finally, perform protection processing on the designated function according to the HOOK state. Therefore, in the embodiment of the present invention, the core function in the IOS system can be detected as being hooked, and the hooked core function can be protected by protective processing of the hooked state of the core function, which not only protects the core function but also saves resources.

[0058] For example, obtain the address of the specified function before loading; before the program runs, obtain the address of the specified function, the specified function is an important function in the class object stored in the __objc_data segment, the class object in the __objc_data segment is a large data structure, the structure contains a Data field, that is, a Data pointer, pointing to an element in the class object, this element can be a constant, constants cannot be modified, usually used in global variables; this element can also be a variable, its value can be modified, usually used in local variables; in this embodiment, the element is a constant, the above Data pointer points to the __objc_const segment, that is, the constant in the class object. The __objc_const segment stores the data of the class object, such as methods, protocols, instance variables, etc. The Data pointer points to the data in the class object, and the array / list contained in the data in the class object can be obtained. The array / list stores the addresses and data of each method (function), and the function data contains the Data field of the pointer, pointing to the address of each function. The address and data of the array / list in the class object are obtained by pointing to the Data pointer in the class object in the __objc_data segment, and the address of the specified function is obtained according to the Data pointer contained in the array / list. This address is also the address of the specified function before loading. After the application or code segment is running, its address will accumulate a base address. If the application or code segment is not HOOKed, the new address generated during the program running can be determined. However, if the application or code segment is HOOKed, FISHHOOK will modify the function address pointed to by the pointer in the mapping table to achieve the purpose of HOOK, that is, the address generated during the program running is tampered with. Therefore, by obtaining the address obtained by the specified function during the program running and subtracting the base address, the post-loading address of the specified function can be obtained. By comparing the pre-loading address of the specified function with the post-loading address of the specified function, it can be determined whether the specified function is HOOKed. When the specified function is HOOKed, it is necessary to continue to determine whether the HOOK is internal HOOK or external HOOK. Once an external malicious HOOK is detected, the HOOK of the specified function needs to be protected, thereby protecting the core function.

[0059] Exemplary Methods

[0060] This embodiment provides a method for processing a specified function being HOOKed, which can be applied to a smart terminal for data security protection. Figure 1 As shown, the method includes:

[0061] Step S100: Obtain a pre-loading address and a post-loading address of a specified function, and determine the address change state of the specified function before and after loading according to the pre-loading address and the post-loading address.

[0062] When an application or code is running in a program, the addresses of the functions are different before and after the program is running. In order to obtain the pre-loading address of a specified function, it is necessary to find the corresponding address in the class object in the application or code. If the class object is regarded as a large structure, it has a position offset, that is, an address, in the executable file in the application or code. The address of the class object can be obtained by querying the address of the executable file where the class name is located in the class object. The data corresponding to the address can be found through the address of the class object. The data is a set of arrays or lists, and the arrays or lists are further subdivided to store the addresses and data of each function. Then, the pre-loading address of the specified function can be obtained by searching the array or list contained in the class object where the class name is located.

[0063] Since each program needs to open up space during the operation of the IOS system, this space will be different depending on the number and order of programs running in the current system. The variable address we see is actually the offset relative to the starting address of the program process. For example, you wrote a.exe program. This time, the system assigns the starting memory space address of a.exe program to 4012FF00. When this variable is opened up, some variables or other structures may have been defined before, occupying 7C of space. In this case, the variable address is 4012FF7C, and the offset address is 0012FF7C. If you close the program and open it again, the process address may become 5012FF00, so the physical address of the variable is 5012FF00, and the offset address is still 0012FF7C. But it does not mean that the offset address is immutable. This involves whether the variable is always fixed in a certain order when it is created. For example, if I write a function like this: void aa(int m){if(m>5){int x=2;int y=3;int z=0;z=x+z;}else{int z=2;int x=3;int y=0;y=x+z;}}, then it is obvious that the creation time of the variable x depends on the size of the variable m, and the order of creation also determines the address of the variable x, so these variables are dynamically changing. From the above, we can see that we need to obtain the address of the specified function after loading.

[0064] According to the pre-loading address and the post-loading address of the specified function, the address change status before and after the loading of the specified function can be determined.

[0065] In one embodiment, Figure 2As shown, the method of obtaining the pre-loading address of a specified function in this embodiment includes the following steps:

[0066] Step S101, before the program is run, obtaining the first address of the class object containing the specified function in the executable file;

[0067] Step S102: obtaining data information of the class object according to the first address;

[0068] Step S103: obtaining the pre-load address of the specified function based on the data information.

[0069] Considering that the specified function is located in a class object in an application or code segment, it is necessary to first determine the location information of the class object in the executable file before the program runs, and obtain the first address of the class object in the executable file. The first address can be the location information, or the location offset pointed to by the Data pointer. Then, based on the first address, the pre-load function data information of the class object containing the specified function can be found. The pre-load function data information can be an array, a list, or any other situation that may occur in practice. Since the pre-load function data information contains the address and data of the function, the pre-load address in the pre-load function data information can be obtained based on the pre-load function data information. The pre-load address is prepared for the subsequent detection of HOOK.

[0070] In one embodiment, Figure 3 As shown, the method of obtaining the loaded address of a specified function in this embodiment includes the following steps:

[0071] Step S111, obtaining the base address generated by the specified function during program execution;

[0072] Step S112, extracting a second address containing the specified function during the program running process;

[0073] Step S113: According to the second address, subtract the base address from the second address to obtain the loaded address.

[0074] Since the IOS system supports random base addresses, the base address of each function during program execution is different. Therefore, it is necessary to obtain the base address generated by the specified function during program execution. In practice, the process base address of the function can be obtained by inputting a NULL to the acquisition function module, or by loading a snapshot of the module for the process queue of the function, or by finding the process base address of the corresponding function in the process status library.

[0075] During the program running process, the function data information stored in the class object containing the specified function can be obtained in the memory block loaded by the application program, and the function data information before loading can be an array, a list, or any other situation that may appear in practice. According to the function data information stored in the class object, the second address of the specified function can be obtained.

[0076] Specifically, according to the second address and the base address of the designated function, the second address of the designated function is subtracted from the base address to obtain the loaded address of the designated function. In one embodiment, for example, if the function parameter directly passes a pointer type, the loaded address of the designated function is obtained by changing the pointer in the function; in another embodiment, the loaded address of the designated function can also be obtained by subtracting the base address value from the address variable in the function.

[0077] Considering that the change of the address of the specified function before and after the program is run is the premise for the specified function to be detected by HOOK, this embodiment needs to determine the change state of the address of the specified function before and after loading, such as Figure 4 As shown, in this embodiment, determining the address change state before and after loading of the specified function according to the pre-loading address and the post-loading address includes the following steps:

[0078] Step S121, obtaining an initial value of the address change status identifier;

[0079] Step S122, when the pre-loading address and the post-loading address are equal, changing the initial value to 0;

[0080] Step S123: When the pre-loading address and the post-loading address are not equal, the initial value is changed to 1.

[0081] In this embodiment, the initial value of the address change status identifier is first obtained; when the obtained pre-load address of the specified function and the post-load address of the specified function are equal, the initial value is set to 0; at this time, it indicates that the address of the specified function has not been attacked by the network FISHHOOK, so the address of the specified function has not changed. When the pre-load address of the specified function and the post-load address of the specified function are not equal, the initial value is set to 1; at this time, it indicates that the address of the specified function has been attacked by the network FISHHOOK, so the address of the specified function has been modified.

[0082] After the address change status is obtained, the HOOK status of the specified function can be determined and executed. Figure 1In step S200, the HOOK state of the specified function is determined according to the address change state.

[0083] In practice, there are two situations for the above address change status. When the address before loading and the address after loading are equal, the specified function is not hooked. Only when the address before loading and the address after loading are not equal, the specified function is hooked. Therefore, it is necessary to further judge the hook status of the specified function to prepare for the subsequent monitoring of whether it is internal hook or external hook.

[0084] In order to determine whether the specified function is hooked, it is necessary to identify the address change status flag. Figure 5 As shown, in this embodiment, determining the HOOK state of the specified function according to the address change state includes the following steps:

[0085] Step S201: When the initial value is 1, it is determined that the specified function is hooked;

[0086] Step S202: When the initial value is 0, it is determined that the specified function is not hooked.

[0087] Specifically, when the initial value is 1, the address of the specified function changes, the specified function is attacked by FISHHOOK, and the specified function is at risk. When the initial value is 0, the address of the specified function does not change, the specified function is not attacked by FISHHOOK, and the specified function is safe.

[0088] Considering that if the specified function is HOOKed, there is a risk in the specified function. In order to protect the specified function, the HOOK needs to be protected. Specifically, Figure 1 As shown, the method also includes:

[0089] Step S300: Perform protection processing on the designated function according to the HOOK state.

[0090] In practice, when the designated function is HOOKed, there is a security risk in the designated function, and further processing is required for the designated function. There are many ways to process it, including killing the program, reporting to the upper-level server, or counterattacking the HOOK phishing program.

[0091] In one embodiment, Figure 6 As shown, the protection processing of the specified function according to the HOOK state in this embodiment includes the following steps:

[0092] Step S301: When the designated function is hooked, monitor the designated function;

[0093] Step S302: When the designated function is not hooked, the operation instruction is not executed.

[0094] When it is detected that the designated function is HOOKed, there are two possibilities, one is internal HOOK and the other is external HOOK. Once the designated function is HOOKed externally, it will cause security risks to the designated function. Therefore, it is necessary to monitor the designated function. When the designated function is not HOOKed, the designated function is safe and no operation instructions are executed.

[0095] In practice, the essence of HOOK is to inject code, that is, to replace the original function of the program. All HOOKs are divided into internal HOOKs and external HOOKs. Since the reflector plug-in reflexil itself can inject classes, methods, variables, properties, etc. into DLLs, HOOKs in this way are internal HOOKs. External HOOKs are to HOOK this DLL in other DLLs, or even any other files not written in C#. Therefore, it is necessary to monitor the HOOK of the specified function, such as Figure 7 As shown, the monitoring of the specified function in this embodiment includes the following steps:

[0096] Step S3011, when the hooked state of the designated function is an internal hooked state, the monitoring state is set to 0;

[0097] Step S3012: When the HOOK state of the designated function is an external HOOK state, the monitoring state is set to 1.

[0098] Considering that the designated function is generally a core function that users need to protect, once it is maliciously hooked by external users, it will cause security risks such as leakage. Therefore, it is necessary to further deal with this situation, such as Figure 8 The protection processing of the designated function according to the HOOK state in this embodiment also includes the following steps:

[0099] Step S311: When the monitoring state is 0, the operation instruction is not executed;

[0100] Step S312: When the monitoring state is 1, perform an anti-HOOK operation.

[0101] When the HOOK state of the designated function is the internal HOOK state, at this time, because it is an internal HOOK, the HOOK does not affect the security of the designated function, so the HOOK is not processed; when the HOOK state of the designated function is the external HOOK state, at this time, it is very likely that the external user is for the purpose of stealing information and other ulterior motives to attack the designated function and tamper with the address of the designated function. At this time, the HOOK needs to be processed. When the HOOK state of the designated function is the external HOOK state, at this time, it is very likely that the external user is for the purpose of stealing information and other ulterior motives to attack the designated function and tamper with the address of the designated function. At this time, the HOOK needs to be processed. In one embodiment, the processing method can be to kill the program, that is, the user exits the application or exits the code segment. In another embodiment, the processing method can be to report to the superior server, and the server analyzes the situation of the HOOK and then sends the processing method to the server in the form of instructions for corresponding processing. In the third embodiment, the processing method can be to reversely track the original attack address of the IP of the FISHHOOK, issue an alarm to the user, and report to the server at the same time. In a third implementation manner, the processing method may be to reversely attack FISHHOOK after detecting that the designated function is HOOKed, and clear the content in its file.

[0102] Exemplary Devices

[0103] like Fig. 9 As shown in , an embodiment of the present invention provides a processing device for a designated function being HOOKed, the device comprising: an address acquisition unit 901, a HOOK state acquisition unit 902, and a protection processing unit 903. Specifically, the address acquisition unit 901 acquires the pre-load address and the post-load address of the designated function, and determines the address change state before and after the loading of the designated function according to the pre-load address and the post-load address; the HOOK state acquisition unit 902 is used to determine the HOOK state of the designated function according to the address change state; the protection processing unit 903 performs protection processing on the designated function according to the HOOK state.

[0104] Based on the above embodiments, the present invention further provides an intelligent terminal, whose principle block diagram can be shown as follows: Fig.10As shown. The intelligent terminal includes a processor, a memory, a network interface, a display screen, and a temperature sensor connected through a system bus. Among them, the processor of the intelligent terminal is used to provide computing and control capabilities. The memory of the intelligent terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the intelligent terminal is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a processing method for implementing a specified function being HOOKed is implemented. The display screen of the intelligent terminal can be a liquid crystal display screen or an electronic ink display screen, and the temperature sensor of the intelligent terminal is pre-set inside the intelligent terminal to detect the operating temperature of the internal device.

[0105] Those skilled in the art will understand that Fig.10 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the smart terminal to which the scheme of the present invention is applied. The specific smart terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0106] In one embodiment, a smart terminal is provided, comprising a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors, and the one or more programs include instructions for performing the following operations:

[0107] Obtaining a pre-loading address and a post-loading address of a specified function, and determining an address change state before and after loading of the specified function according to the pre-loading address and the post-loading address;

[0108] Determine the HOOK state of the specified function according to the address change state;

[0109] The designated function is protected according to the HOOK state.

[0110] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0111] In summary, the present invention discloses a method, a smart terminal, and a storage medium for processing a designated function being HOOKed. The method includes: obtaining the pre-loading address and the post-loading address of the designated function, and determining the address change status of the designated function before and after loading according to the pre-loading address and the post-loading address; determining the HOOK status of the designated function according to the address change status; and performing protection processing on the designated function according to the HOOK status. In the embodiment of the present invention, the core function in the IOS system can be detected to be HOOKed, and the protection of the HOOKed core function is achieved by processing the HOOK status of the core function, which protects the core function and saves resources.

[0112] It should be understood that the present invention discloses a It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, it can be improved or transformed according to the above description, and all these improvements and transformations should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for processing a specified function being HOOKed, characterized in that: The method comprises: Obtaining a pre-loading address and a post-loading address of a specified function, and determining an address change state before and after loading of the specified function according to the pre-loading address and the post-loading address; Determine the HOOK state of the specified function according to the address change state; Performing protection processing on the designated function according to the HOOK state; The obtaining of the pre-loading address of the specified function comprises: Before the program is run, a first address of the class object containing the specified function in the executable file is obtained, where the first address is location information, or the first address is a location offset pointed to by a Data pointer; Obtain data information of the class object according to the first address; Obtaining a pre-load address of a specified function based on the data information; The step of obtaining the loaded address of the specified function includes: Acquire the base address of the designated function generated during the program running process, wherein the base address is acquired by inputting NULL into the acquisition function module, loading a snapshot of the module for the process, and searching in the process status library; Extracting a second address containing the specified function during the program execution; According to the second address, subtracting the base address from the second address to obtain the loaded address; The protection processing of the designated function according to the HOOK state includes: According to the HOOK status, the designated function is subjected to an anti-HOOK operation, wherein the anti-HOOK operation includes exiting the program running mode, reporting to the superior server mode, and issuing an alarm mode, wherein the alarm mode is to reversely trace the IP original attack address of FISHHOOK, report the IP original attack address to the server, and issue an alarm to the user.

2. The method for processing a designated function being HOOKed according to claim 1, characterized in that: Determining the address change state before and after loading of the specified function according to the pre-loading address and the post-loading address includes: Get the initial value of the address change status flag; When the pre-loading address and the post-loading address are equal, changing the initial value to 0; When the pre-loading address and the post-loading address are not equal, the initial value is changed to 1.

3. The method for processing a designated function being HOOKed according to claim 2, characterized in that: Determining the HOOK state of the specified function according to the address change state includes: When the initial value is 1, it is determined that the specified function is HOOKed; When the initial value is 0, it is determined that the specified function is not HOOKed.

4. The method for processing a designated function being HOOKed according to claim 3, characterized in that: The protection processing of the designated function according to the HOOK state includes: When the specified function is hooked, the specified function is monitored; When the specified function is not HOOKed, the operation instruction is not executed.

5. The method for processing a designated function being HOOKed according to claim 4, characterized in that: The monitoring of the specified function comprises: When the HOOK state of the specified function is an internal HOOK state, the monitoring state is set to 0; When the HOOK state of the designated function is an external HOOK state, the monitoring state is set to 1.

6. The method for processing a designated function being HOOKed according to claim 5, characterized in that: The protection processing of the designated function according to the HOOK state also includes: When the monitoring status is 0, no operation instruction is executed; When the monitoring state is 1, the anti-HOOK operation is performed.

7. An intelligent terminal, characterized in that: The device comprises a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors, and the one or more programs include being used to execute the method according to any one of claims 1 to 6.

8. A non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method as claimed in any one of claims 1 to 6.

Images