Android system injection detection method, device, equipment and computer storage medium

Abstract

The embodiment of the present invention relates to the field of Android technology, and discloses an Android system injection detection method, which includes: after the application is started, obtaining the binary file corresponding to the system startup process of the application in the target Android system; parsing the binary file to obtain at least one target segment; the type of the target segment is a string type; querying whether the at least one target segment includes a preset feature string, and determining whether the application is injected into the system modification framework according to the query result to determine whether the application is safe. Through the above method, the embodiment of the present invention improves the accuracy of injection detection in the Android system.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Android technology, and specifically to an Android system injection detection method, device, equipment and computer storage medium. Background Art

[0002] Currently, in order to modify the return of system interfaces and simulate some system functions, the system modification framework Xposed is often injected into the Android system to hook some system interfaces. However, Xposed has a great impact on the security of the Android system, so it is necessary to detect whether Xposed is injected into the Android system.

[0003] The inventors discovered the following problem during the implementation of the present invention: the existing injection detection methods for Xposed in the Android system are not very secure and accurate. Summary of the invention

[0004] In view of the above problems, the embodiments of the present invention provide an Android system injection detection method, device, equipment and computer storage medium, which are used to solve the problem of low accuracy in the prior art.

[0005] According to one aspect of an embodiment of the present invention, there is provided an Android system injection detection method, the method comprising:

[0006] After the application is started, obtaining a binary file corresponding to the system startup process of the application in the target Android system;

[0007] Parsing the binary file to obtain at least one target segment; the type of the target segment is a string type;

[0008] It is queried whether the at least one target segment includes a preset characteristic character string, and it is determined whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0009] In an optional manner, the method is implemented based on the native layer of the target Android system; the binary file includes a plurality of optional fragments; and the method further includes:

[0010] Reading file header information included in the binary file;

[0011] Determine the fragment header table information according to the file header information;

[0012] The target segment is determined from the multiple optional segments according to the segment header table information.

[0013] In an optional manner, the method further includes:

[0014] Determine the segment header offset position corresponding to each optional segment according to the segment header table information;

[0015] Determine the segment header information corresponding to each of the optional segments according to the segment header offset position;

[0016] Determining a segment type of each optional segment according to the segment header information;

[0017] The optional segment whose segment type is a character string type is determined as the target segment.

[0018] In an optional manner, the method further includes:

[0019] Matching the characteristic character string in the target segment and determining the number of successful matches;

[0020] Determine the total number of segment headers according to the file header information;

[0021] Comparing the number of successful matches with the total number of segment headers;

[0022] When the number of successful matches is greater than the total number of segment headers, the injection detection result is determined as injection is detected.

[0023] In an optional manner, the target segment stores function description strings corresponding to a plurality of optional functions; wherein the optional functions are functions included in the target Android system; and the method further includes:

[0024] Matching the characteristic character string with each of the function description character strings respectively;

[0025] Whenever a function description string is matched, the number of successful matches is increased by one.

[0026] In an optional manner, the method further includes:

[0027] When the number of successful matches is less than the total number of segment headers, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently being queried;

[0028] Matching the characteristic character string with the function description character string in the to-be-matched segment;

[0029] When the matching is completed, the first file pointer is updated according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset positions corresponding to the target segments of the historical query.

[0030] In an optional manner, the feature character string includes an Xposed feature function character string; and the method further includes:

[0031] Matching the Xposed feature function string with each of the function description strings respectively;

[0032] When the function string is matched, the injection detection result is determined as injection is detected.

[0033] According to another aspect of an embodiment of the present invention, there is provided an Android system injection detection device, comprising:

[0034] An acquisition module, used for acquiring a binary file corresponding to the system startup process of the application in the target Android system after the application is started;

[0035] A parsing module, used for parsing the binary file to obtain at least one target segment; the type of the target segment is a string type;

[0036] The determination module is used to query whether the at least one target segment includes a preset characteristic string, and determine whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0037] According to another aspect of an embodiment of the present invention, an Android system injection detection device is provided, comprising:

[0038] A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0039] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations such as the Android system injection detection method.

[0040] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a device to perform operations as described in the Android system injection detection method.

[0041] The embodiment of the present invention obtains the binary file corresponding to the system startup process of the application in the target Android system after the application is started; parses the binary file, reads out at least one string type segment in the binary file as a target segment; then queries whether the at least one target segment includes a preset feature string, and determines whether the application is injected into the system modification framework according to the query result, so as to determine whether the application is safe.

[0042] This is different from the solution in the prior art that uses a detection function to detect whether the current Java environment has loaded the relevant class library of Xposed. The detection function may also be hooked by the Xposed framework, resulting in low accuracy and security of injection detection. The embodiments of the present invention can improve the accuracy and security of injection detection in the Android system by detecting injection traces at the level of binary files that are not easy to modify and forge.

[0043] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation mode of the present invention is specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings:

[0045] Figure 1 A schematic diagram of the process of an Android system injection detection method provided by an embodiment of the present invention is shown;

[0046] FIG. 2( a ) shows a schematic diagram of a system before Xposed injection in an Android system injection detection method provided by an embodiment of the present invention;

[0047] FIG. 2( b ) shows a schematic diagram of a system after Xposed injection in the Android system injection detection method provided by an embodiment of the present invention;

[0048] Figure 3 A structural schematic diagram of an Android system injection detection method provided by another embodiment of the present invention is shown;

[0049] Figure 4 A schematic diagram of the structure of an Android system injection detection device provided by an embodiment of the present invention is shown;

[0050] Figure 5 A schematic structural diagram of an Android system injection detection device provided in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0051] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0052] Before describing the Android system injection detection method according to the embodiment of the present invention, the following related terms are explained:

[0053] Xposed: A dynamic hijacking project for the Android platform developed by rovo89. It is a framework service that can affect the running of programs without modifying the APK. Xposed controls the Zygote process by replacing the / system / bin / app_process program, so that the app_process loads the XposedBridge.jar jar package during the startup process, thereby hijacking the Zygote process and the Dalvik virtual machine it creates.

[0054] app_process: An important compiled executable file in the target Android system. This executable file is responsible for starting the Android core processes Zygote and system_server during the boot process. app_process can also be used to run executable Java programs.

[0055] ELF: Executable and Linkable Format, part of the Unix / Linux system ABI (Application Binary Interface) specification. Executable binary files, object code files, shared library files, and core dump files under Unix / Linux are all ELF files. From the perspective of the assembler and linker, an ELF file is a collection of a series of sections described by a Section Header Table. The first few dozen words of an ELF file are the ELF Header, or ELF file header.

[0056] ELF file header: ELF Header, a few dozen words at the beginning of the ELF file. It records basic information such as the architecture and operating system corresponding to the ELF file, including the location of the Section Header Table in the file, the size and number of the included Section tables, etc.

[0057] Section: The unit of the content of the target code file. The information in the section is used by the linker to relocate the code. The sections in the target code will be organized into segments of the executable file by the linker. In the ELF file, a section must have a section header to describe it, but a section header does not necessarily have a corresponding section in the file, because some sections do not occupy file word segments.

[0058] Section Header Table: The section header table describes the information of each section, such as the section name, length, offset in the file, read and write permissions, and other attributes of the section. The structure of the section header table is an array with Elf32_Shdr structures (section descriptors) as elements.

[0059] String type: String Section. In ELF files, many strings are used, such as symbols such as function names and global variable names defined and referenced in the program, as well as information related to the symbols. String types are saved in the ELF file in the form of segments, and common segment names are ".strtab" or ".shstrtab". The two string tables are the string table (String Table) and the header string table (Header String Table). The string table saves ordinary strings, while the header string table is used to save strings used in the segment table, such as segment names.

[0060] Native layer: Local service layer, mainly used to implement some local services and store some link libraries. The characteristics of the Native layer are that it is implemented in C and C++ languages, and its code running efficiency and reverse engineering and debugging difficulty are higher than the Java layer. Native can communicate with the Java layer through the Jni mechanism.

[0061] JNI (Java Native Interface) provides Java with the ability to call C and C++ code. While JAVA is cross-platform, it can also interact with dynamic libraries of other languages ​​(such as C, C++), giving other languages ​​the opportunity to play their advantages.

[0062] Figure 1 The flowchart of the Android system injection detection method provided by the embodiment of the present invention is shown, and the method is executed by a computer processing device. The computer processing device may include a mobile phone, a laptop computer, etc. Figure 1 As shown, the method comprises the following steps:

[0063] Step 101: After the application is started, a binary file corresponding to the system startup process of the application in the target Android system is obtained.

[0064] In one embodiment of the present invention, the application refers to an application program in the target Android system, and the system startup process refers to the app_process process in the Android system, that is, the Zygote process.

[0065] Binary files refer to ELF format files in the target Android system.

[0066] Among them, the Zygote process is the core process of the Android system to create a new process. It is responsible for starting the Dalvik virtual machine, loading some necessary system resources and system classes, starting the system_server process, and then waiting to process app application requests.

[0067] In another embodiment of the present invention, in order to improve the system security of the target Android system, after detecting that the application is started, step 101 and subsequent steps can be executed to complete the injection detection in time, and perform corresponding system protection operations according to the injection detection results.

[0068] Step 102: Parse the binary file to obtain at least one target segment; the type of the target segment is a string type.

[0069] The ELF file includes multiple optional segments, where a segment is a section in the ELF file. In one embodiment of the present invention, the string type refers to a section whose section type (segment type) is STRTAB or whose section name is .strtab.

[0070] In one embodiment of the present invention, the injection process of the Xposed framework refers to Figure 2, the Zygote process before injection is shown in (a) of Figure 2, and the Zygote process after injection is shown in (b) of Figure 2. Combining Figure 2 (a) and Figure 2 (b), the normal startup process of the Android system that has not been injected generally includes: Linux system startup, Init (initialization) process startup, and Zygote process startup with service / system / bin / app_process, wherein the startup of the Zygote process generally includes starting a virtual machine, configuring a Java environment, loading a default jar file package, and finally calling the Java main (zygoteInit.main()) function to complete the startup of the Zygote process.

[0071] After the Android system is injected with Xposed, when the Linux system is started and the Init process is started, the startup process of the Zygote process becomes: start the injected Zygote process with service / system / bin / app_process. In addition to the normal startup process mentioned above, the startup of the injected Zygote process also includes adding XposedBridge.jar and other Xposed related jar packages to the CLASSPATH file path, and finally calling java main (xposedBridge.main()) to bridge the main function to complete the startup of the injected Zygote process.

[0072] Among them, the process of calling the java main (xposedBridge.main ()) function includes: Zygote process initialization, loading the Xposed hook module, calling the Orign source function and calling the zygoteInit.main () (originmain) function, thereby completing the injection of Xposed into the Zygote process.

[0073] That is to say, if Xposed needs to be hooked or injected into the Android system, it must first replace the cornerstone process app_process of the target Android system. Since the replaced app_process' is different from the original app_process of Android, if the original app_process of Android in the target Android system is replaced with app_process', in the underlying Linux system of the target Android system, that is, at the binary level, the injection traces of Xposed will be left on app_process'.

[0074] Among them, the injection trace of Xposed includes the existence of Xposed related function string identifiers in the ELF file, so whether there is injection can be determined by reading the ELF file to find out whether there is Xposed related function string identifier.

[0075] Considering that in ELF files, string type data is stored in string type, it is meaningless to search for Xposed related function string identifiers in other types of segments. Therefore, in order to improve the efficiency of injection detection, the string type section can be determined from the binary file as the target segment.

[0076] Considering that the related methods of injection detection in the prior art are implemented based on the Java layer of the Android system, and the security of the Java layer data is not high, it is easy to be reversed and debugged, which affects the accuracy of injection detection, and Xposed has no ability to hook the API interface of the underlying system for the time being, therefore, in another embodiment of the present invention, the method is implemented based on the native layer of the target Android system. That is, the code implementation corresponding to the detection process in steps 102-103 is placed in the native layer of the target Android system, and the interface of the detection function of the Linux system is called for detection. After the detection is completed, the detection result is directly obtained from the native layer to the Java layer through the jni interface, thereby improving the security and accuracy of injection detection.

[0077] In yet another embodiment of the present invention, step 102 further includes at least:

[0078] Step 1021: Read the file header information included in the binary file.

[0079] The file header information is the ELF Header information of the ELF file. In one embodiment of the present invention, the readelf -h instruction can be used to determine the ELF header information of the binary file.

[0080] Step 1022: Determine the fragment header table information according to the file header information.

[0081] In one embodiment of the present invention, the fragment header table message is located according to the offset position of the section header recorded in the ELF Header information.

[0082] Step 1023: Determine the target segment from the multiple optional segments according to the segment header table information.

[0083] The segment type information of each optional segment in the ELF file is determined according to the segment header table information, and screening is performed according to the segment type information, and the optional segment of the character string type is determined as the target segment.

[0084] In yet another embodiment of the present invention, step 1023 further includes:

[0085] Step 231: Determine the fragment header offset position corresponding to each optional fragment according to the fragment header table information.

[0086] The segment header offset position is used to determine the starting position of the segment header of each segment, so as to locate the segment header corresponding to each segment.

[0087] Step 232: Determine the fragment header information corresponding to each of the optional fragments according to the fragment header offset position.

[0088] Step 233: Determine the segment type of each optional segment according to the segment header information.

[0089] In one embodiment of the present invention, the segment type of each optional segment is determined by reading the field value under the sh_type field in the segment header table information of each optional segment.

[0090] In another embodiment of the present invention, the segment type can also be determined by reading the segment name in the segment header table information of each optional segment and searching the preset name table by the segment name. For example, when the segment name includes .strtab, the segment type is the string type.

[0091] Step 234: Determine the optional segment whose segment type is a character string type as the target segment.

[0092] In yet another embodiment of the present invention, when no string type fragment is detected in the ELF file, a prompt message such as "Current detection is abnormal, please check whether the system is loaded normally" may be returned.

[0093] Step 103: query whether the at least one target segment includes a preset characteristic string, and determine whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0094] In one embodiment of the present invention, the characteristic string is used to characterize the Xposed-related function, that is, the function-related string that only exists in the system where the Xposed injection exists, and the function-related string can be a function identifier, a function description string, etc. Since the function-related string is generally stored in the target segment according to its data type, therefore, in one embodiment of the present invention, step 103 also includes:

[0095] Step 1031: Match the characteristic character string in the target segment to determine the number of successful matches.

[0096] When the characteristic character string exists in the target segment, it is determined that the target segment is matched successfully.

[0097] In another embodiment of the present invention, the target segment stores function description strings corresponding to multiple optional functions; wherein the optional functions are functions included in the target Android system; and step 1031 further includes:

[0098] Step 311: Match the characteristic character string with each of the function description character strings respectively.

[0099] In order to improve the accuracy of injection detection, the characteristic string is matched with all target segments separately until all target segments are traversed.

[0100] It should be noted that, in another embodiment of the present invention, in order to improve the speed of injection detection, the method of traversing all target segments may not be adopted, that is, as long as there is one successful match, it is determined that injection exists.

[0101] In another embodiment of the present invention, the characteristic string includes an Xposed characteristic function string. The injection detection for the Android system may also include:

[0102] Step 312: Match the Xposed feature function string with each of the function description strings respectively.

[0103] Step 313: When the function string is matched, the injection detection result is determined as injection detected.

[0104] In yet another embodiment of the present invention, step 311 further includes:

[0105] Step 3111: when the number of successful matches is less than the total number of segment headers, determine the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently being queried.

[0106] In one embodiment of the present invention, when the number of successful matches is less than the total number of segment headers, the matching of the next unmatched target segment is continued by moving the first file pointer.

[0107] Step 3112: Match the feature character string with the function description character string in the to-be-matched segment.

[0108] In one embodiment of the present invention, when the to-be-matched segment includes a characteristic character string, the two are considered to be matched.

[0109] Step 3113: When the matching is completed, the first file pointer is updated according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset positions corresponding to the target segments of the historical query.

[0110] In one embodiment of the present invention, the updating of the first file pointer can be to determine the fragment header offset position corresponding to the unmatched target fragment based on the fragment header offset position corresponding to the second file pointer and all target fragments, and determine the first file pointer by selecting any one of the unmatched fragment header offset positions or in the progressive order of the offset positions.

[0111] In yet another embodiment of the present invention, each target segment may be read and matched with a characteristic character string in sequence according to the segment header offset position sequence of each target segment.

[0112] Step 314: Whenever a function description string is matched, the number of successful matches is increased by one.

[0113] Step 1032: Determine the total number of segment headers according to the file header information.

[0114] In one embodiment of the present invention, the number of Section Headers in the ELF Header is used as the total number of segment headers.

[0115] Step 1033: Compare the number of successful matches with the total number of segment headers.

[0116] Step 1034: When the number of successful matches is greater than the total number of segment headers, the injection detection result is determined as injection detection.

[0117] In yet another embodiment of the present invention, Figure 3 As shown, the injection detection method of step 101-step 103 can also be encapsulated into a detection entry function of a native layer, and a flag value is set in the native layer. The flag value is used to store the detection result. The detection entry function can be called by the java layer of the target Android system through the jni interface, and directly returns the flag value to the java layer when called, thereby hiding the specific injection detection code logic in the more secure native layer, thereby improving the efficiency and security of injection detection.

[0118] The Android system injection detection method of the embodiment of the present invention obtains the binary file corresponding to the system startup process of the application in the target Android system after the application is started; parses the binary file and reads out at least one string type segment in the binary file as the target segment; then searches in the target segment according to a preset feature string, and determines the injection detection result of the target Android system according to the query result.

[0119] This is different from the solution in the prior art that uses a detection function to detect whether the current Java environment has loaded the relevant class library of Xposed. The detection function may also be hooked by the Xposed framework, resulting in low accuracy and security of injection detection. The Android system injection detection method of the embodiment of the present invention detects injection traces from the binary file level that is not easy to modify and forge, thereby improving the accuracy and security of injection detection in the Android system.

[0120] Figure 4 FIG. 1 is a schematic diagram showing the structure of an Android system injection detection device provided by an embodiment of the present invention. Figure 4 As shown, the device 200 includes: an acquisition module 201, a parsing module 202 and a determination module 203.

[0121] The acquisition module 201 is used to acquire the binary file corresponding to the system startup process of the application in the target Android system after the application is started;

[0122] The parsing module 202 is used to parse the binary file to obtain at least one target segment; the type of the target segment is a string type;

[0123] The determination module 203 is used to query whether the at least one target segment includes a preset characteristic string, and determine whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0124] In an optional manner, the binary file includes a plurality of optional segments; the parsing module 202 is further used for:

[0125] Reading file header information included in the binary file;

[0126] Determine the fragment header table information according to the file header information;

[0127] The target segment is determined from the multiple optional segments according to the segment header table information.

[0128] In an optional manner, the parsing module 202 is further configured to:

[0129] Determine the segment header offset position corresponding to each optional segment according to the segment header table information;

[0130] Determine the segment header information corresponding to each of the optional segments according to the segment header offset position;

[0131] Determining a segment type of each optional segment according to the segment header information;

[0132] The optional segment whose segment type is a character string type is determined as the target segment.

[0133] In an optional manner, the determination module 203 is further configured to:

[0134] Matching the characteristic character string in the target segment and determining the number of successful matches;

[0135] Determine the total number of segment headers according to the file header information;

[0136] Comparing the number of successful matches with the total number of segment headers;

[0137] When the number of successful matches is greater than the total number of segment headers, the injection detection result is determined as injection is detected.

[0138] In an optional manner, the target segment stores function description strings corresponding to multiple optional functions; wherein the optional functions are functions included in the target Android system; and the determination module 203 is further used to:

[0139] Matching the characteristic character string with each of the function description character strings respectively;

[0140] Whenever a function description string is matched, the number of successful matches is increased by one.

[0141] In an optional manner, the determination module 203 is further configured to:

[0142] When the number of successful matches is less than the total number of segment headers, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently being queried;

[0143] Matching the characteristic character string with the function description character string in the to-be-matched segment;

[0144] When the matching is completed, the first file pointer is updated according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset positions corresponding to the target segments of the historical query.

[0145] In an optional manner, the characteristic character string includes an Xposed characteristic function character string; the determination module 203 is further used for:

[0146] Matching the Xposed feature function string with each of the function description strings respectively;

[0147] When the function string is matched, the injection detection result is determined as injection is detected.

[0148] The Android system injection detection device of the embodiment of the present invention obtains the binary file corresponding to the system startup process of the application in the target Android system after the application is started; parses the binary file and reads out at least one string type segment in the binary file as the target segment; then searches in the target segment according to a preset feature string, and determines the injection detection result of the target Android system according to the query result.

[0149] This is different from the solution in the prior art that uses a detection function to detect whether the current Java environment has loaded the relevant class library of Xposed. The detection function may also be hooked by the Xposed framework, resulting in low accuracy and security of injection detection. The Android system injection detection device of the embodiment of the present invention detects injection traces from the binary file level that is not easy to modify and forge, thereby improving the accuracy and security of injection detection in the Android system.

[0150] Figure 5 A schematic diagram of the structure of an Android system injection detection device provided in an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the Android system injection detection device.

[0151] like Figure 5 As shown, the Android system injection detection device may include: a processor (processor) 302, a communication interface (Communications Interface) 304, a memory (memory) 306, and a communication bus 308.

[0152] The processor 302, the communication interface 304, and the memory 306 communicate with each other via the communication bus 308. The communication interface 304 is used to communicate with other devices such as a client or other server network elements. The processor 302 is used to execute the program 310, which can specifically execute the relevant steps in the above-mentioned embodiment of the method for detecting injection in the Android system.

[0153] Specifically, the program 310 may include program code including computer executable instructions.

[0154] The processor 302 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the Android system injection detection device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0155] The memory 306 is used to store the program 310. The memory 306 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0156] Program 310 can be specifically called by processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0157] After the application is started, obtaining a binary file corresponding to the system startup process of the application in the target Android system;

[0158] Parsing the binary file to obtain at least one target segment; the type of the target segment is a string type;

[0159] It is queried whether the at least one target segment includes a preset characteristic character string, and it is determined whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0160] In an optional manner, the binary file includes a plurality of optional segments; the program 310 is called by the processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0161] Reading file header information included in the binary file;

[0162] Determine the fragment header table information according to the file header information;

[0163] The target segment is determined from the multiple optional segments according to the segment header table information.

[0164] In an optional manner, the program 310 is called by the processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0165] Determine the segment header offset position corresponding to each optional segment according to the segment header table information;

[0166] Determine the segment header information corresponding to each of the optional segments according to the segment header offset position;

[0167] Determining a segment type of each optional segment according to the segment header information;

[0168] The optional segment whose segment type is a character string type is determined as the target segment.

[0169] In an optional manner, the program 310 is called by the processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0170] Matching the characteristic character string in the target segment and determining the number of successful matches;

[0171] Determine the total number of segment headers according to the file header information;

[0172] Comparing the number of successful matches with the total number of segment headers;

[0173] When the number of successful matches is greater than the total number of segment headers, the injection detection result is determined as injection is detected.

[0174] In an optional manner, the target segment stores function description strings corresponding to multiple optional functions; wherein the optional functions are functions included in the target Android system; the program 310 is called by the processor 302 to enable the Android system injection detection device to perform the following operations:

[0175] Matching the characteristic character string with each of the function description character strings respectively;

[0176] Whenever a function description string is matched, the number of successful matches is increased by one.

[0177] In an optional manner, the program 310 is called by the processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0178] When the number of successful matches is less than the total number of segment headers, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently being queried;

[0179] Matching the characteristic character string with the function description character string in the to-be-matched segment;

[0180] When the matching is completed, the first file pointer is updated according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset positions corresponding to the target segments of the historical query.

[0181] In an optional manner, the feature string includes an Xposed feature function string; the program 310 is called by the processor 302 to enable the Android system to inject the detection device to perform the following operations:

[0182] Matching the Xposed feature function string with each of the function description strings respectively;

[0183] When the function string is matched, the injection detection result is determined as injection is detected.

[0184] The Android system injection detection device of the embodiment of the present invention obtains the binary file corresponding to the system startup process of the application in the target Android system after the application is started; parses the binary file, and reads out at least one string type segment in the binary file as the target segment; then searches in the target segment according to a preset feature string, and determines the injection detection result of the target Android system according to the query result.

[0185] This is different from the solution in the prior art that uses a detection function to detect whether the current Java environment has loaded the relevant class library of Xposed. The detection function may also be hooked by the Xposed framework, resulting in low accuracy and security of injection detection. The Android system injection detection device in the embodiment of the present invention detects injection traces from the binary file level that is not easy to modify and forge, thereby improving the accuracy and security of injection detection in the Android system.

[0186] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on an Android system injection detection device, the Android system injection detection device executes the Android system injection detection method in any of the above method embodiments.

[0187] The executable instructions can be used to enable the Android system to inject the detection device to perform the following operations:

[0188] After the application is started, obtaining a binary file corresponding to the system startup process of the application in the target Android system;

[0189] Parsing the binary file to obtain at least one target segment; the type of the target segment is a string type;

[0190] It is queried whether the at least one target segment includes a preset characteristic character string, and it is determined whether the application is injected into the system modification framework according to the query result to determine whether the application is safe.

[0191] In an optional manner, the binary file includes a plurality of optional segments; the executable instruction enables the Android system injection detection device to perform the following operations:

[0192] Reading file header information included in the binary file;

[0193] Determine the fragment header table information according to the file header information;

[0194] The target segment is determined from the multiple optional segments according to the segment header table information.

[0195] In an optional manner, determining a fragment header offset position corresponding to each optional fragment according to the fragment header table information;

[0196] Determine the segment header information corresponding to each of the optional segments according to the segment header offset position;

[0197] Determining a segment type of each optional segment according to the segment header information;

[0198] The optional segment whose segment type is a character string type is determined as the target segment.

[0199] In an optional manner, the executable instruction enables the Android system injection detection device to perform the following operations:

[0200] Matching the characteristic character string in the target segment and determining the number of successful matches;

[0201] Determine the total number of segment headers according to the file header information;

[0202] Comparing the number of successful matches with the total number of segment headers;

[0203] When the number of successful matches is greater than the total number of segment headers, the injection detection result is determined as injection is detected.

[0204] In an optional manner, the target segment stores function description strings corresponding to multiple optional functions; wherein the optional functions are functions included in the target Android system; and the executable instructions enable the Android system injection detection device to perform the following operations:

[0205] Matching the characteristic character string with each of the function description character strings respectively;

[0206] Whenever a function description string is matched, the number of successful matches is increased by one.

[0207] In an optional manner, the executable instruction enables the Android system injection detection device to perform the following operations:

[0208] When the number of successful matches is less than the total number of segment headers, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently being queried;

[0209] Matching the characteristic character string with the function description character string in the to-be-matched segment;

[0210] When the matching is completed, the first file pointer is updated according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset positions corresponding to the target segments of the historical query.

[0211] In an optional manner, the feature string includes an Xposed feature function string; and the executable instruction enables the Android system injection detection device to perform the following operations:

[0212] Matching the Xposed feature function string with each of the function description strings respectively;

[0213] When the function string is matched, the injection detection result is determined as injection is detected.

[0214] The computer-readable storage medium of an embodiment of the present invention obtains a binary file corresponding to the system startup process of the application in the target Android system after the application is started; parses the binary file, reads out at least one string type segment in the binary file as a target segment; then searches in the target segment according to a preset feature string, and determines the injection detection result of the target Android system according to the query result.

[0215] This is different from the solution in the prior art that uses a detection function to detect whether the current Java environment has loaded the relevant class library of Xposed. The detection function may also be hooked by the Xposed framework, resulting in low accuracy and security of injection detection. The computer-readable storage medium of the embodiment of the present invention detects injection traces from the binary file level that is not easy to modify and forge, thereby improving the accuracy and security of injection detection in the Android system.

[0216] An embodiment of the present invention provides an Android system injection detection device, which is used to execute the Android system injection detection method.

[0217] An embodiment of the present invention provides a computer program, which can be called by a processor to enable an Android system injection detection device to execute the Android system injection detection method in any of the above method embodiments.

[0218] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are run on a computer, the computer executes the Android system injection detection method in any of the above method embodiments.

[0219] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other equipment. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description made to specific languages ​​above is for disclosing the best mode of the present invention.

[0220] In the description provided herein, a large number of specific thin segments are described. However, it is understood that embodiments of the present invention can be practiced without these specific thin segments. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0221] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than those expressly recited in each claim.

[0222] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0223] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. An application security detection method, characterized in that: The method comprises: After the application is started, obtaining a binary file corresponding to the system startup process of the application in the target Android system; Parse the binary file to obtain at least one target segment; the type of the target segment is a string type; the target segment stores function description strings corresponding to multiple optional functions; the optional functions are functions included in the target Android system; Querying whether the at least one target segment includes a preset feature string, and determining whether the application is injected into a system modification framework according to the query result to determine whether the application is safe, including: matching the feature string with each of the function description strings respectively, and determining the number of successful matches; The method of matching the characteristic character string with each of the function description character strings respectively to determine the number of successful matches includes: when the number of successful matches is less than the total number of segment headers of the target segment, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently queried; matching the characteristic character string with the function description character string in the segment to be matched; when the matching is completed, updating the first file pointer according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset position corresponding to the target segment of the historical query; The querying whether the at least one target segment includes a preset feature string, and determining whether the application is injected into the system modification framework based on the query result to determine whether the application is safe, further includes: matching the feature string in the target segment to determine the number of successful matches; determining the total number of segment headers based on file header information; comparing the number of successful matches with the total number of segment headers; when the number of successful matches is greater than the total number of segment headers, determining the injection detection result as injection detected.

2. The method according to claim 1, characterized in that The method is implemented based on the native layer of the target Android system; the binary file includes a plurality of optional segments; the binary file is parsed to obtain the target segment, further comprising: Reading file header information included in the binary file; Determine the fragment header table information according to the file header information; The target segment is determined from the multiple optional segments according to the segment header table information.

3. The method according to claim 2, characterized in that The step of determining the target segment from the optional segments according to the segment header table information further comprises: Determine the segment header offset position corresponding to each optional segment according to the segment header table information; Determine the segment header information corresponding to each of the optional segments according to the segment header offset position; Determining a segment type of each optional segment according to the segment header information; The optional segment whose segment type is the character string type is determined as the target segment.

4. The method according to claim 1, characterized in that: The step of matching the characteristic character string in the target segment and determining the number of successful matches further includes: Whenever a function description string is matched, the number of successful matches is increased by one.

5. The method according to claim 1, characterized in that The characteristic string includes an Xposed characteristic function string; the querying whether the at least one target segment includes a preset characteristic string, and determining whether the application is injected into the system modification framework according to the query result to determine whether the application is safe, further includes: Matching the Xposed feature function string with each of the function description strings respectively; When the function string is matched, the injection detection result is determined as injection is detected.

6. An Android system injection detection device, characterized in that: The device comprises: An acquisition module, used for acquiring a binary file corresponding to the system startup process of the application in the target Android system after the application is started; A parsing module, used to parse the binary file to obtain at least one target segment; the type of the target segment is a string type; the target segment stores function description strings corresponding to multiple optional functions; the optional functions are functions included in the target Android system; A determination module, used to query whether the at least one target segment includes a preset feature string, and determine whether the application is injected into the system modification framework according to the query result to determine whether the application is safe, including: matching the feature string with each of the function description strings respectively, and determining the number of successful matches; The method of matching the characteristic character string with each of the function description character strings respectively to determine the number of successful matches includes: when the number of successful matches is less than the total number of segment headers of the target segment, determining the segment to be matched from the target segment according to the first file pointer; the first file pointer is used to store the segment header offset position corresponding to the target segment currently queried; matching the characteristic character string with the function description character string in the segment to be matched; when the matching is completed, updating the first file pointer according to the second file pointer and the segment header offset positions corresponding to all the target segments; the second file pointer is used to store the segment header offset position corresponding to the target segment of the historical query; The querying whether the at least one target segment includes a preset feature string, and determining whether the application is injected into the system modification framework based on the query result to determine whether the application is safe, further includes: matching the feature string in the target segment to determine the number of successful matches; determining the total number of segment headers based on file header information; comparing the number of successful matches with the total number of segment headers; when the number of successful matches is greater than the total number of segment headers, determining the injection detection result as injection detected.

7. An Android system injection detection device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the application security detection method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction. When the executable instruction is executed on the Android system injection detection device, the Android system injection detection device executes the operation of the application security detection method according to any one of claims 1 to 5.

Images