A method, device, computer equipment and storage medium for implementing function hook

Abstract

The present invention discloses a method, device, computer equipment and storage medium for implementing function hook. The method comprises: writing a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset front header file; when a hook condition is met, obtaining the target function address and the identifier from the shared memory; determining a hook function corresponding to the identifier; and injecting the hook function into the target function address to implement function hook. By using this method, the target function address in a static library can be effectively obtained, thereby expanding the scope of hook.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a method, apparatus, computer equipment, and storage medium for implementing a function hook. Background Art

[0002] Generally, a hook function requires two variables, one is the function declaration method, which is used to declare and define the hook function; the other is the address of the hooked function. As for obtaining the address of the function, the existing technology is to obtain the address of the corresponding function in the process by querying the function export symbol table of the dynamic library, and then inject the hook through some hook libraries.

[0003] In the prior art, obtaining the function address by querying the dynamic library export symbol table has great limitations. When the function to be hooked is other non-exported functions in the dynamic library, or a static library function, or an internal function of the application, the corresponding function address cannot be effectively obtained, and thus the function cannot be hooked. Summary of the invention

[0004] The embodiments of the present invention provide a method, an apparatus, a computer device and a storage medium for implementing a function hook, which can effectively obtain the target function address in a static library and expand the scope of the hook.

[0005] In a first aspect, an embodiment of the present invention provides a method for implementing a function hook, including:

[0006] Writing the target function address and an identifier identifying the target function address into the shared memory, wherein the target function address is obtained from a preset front-end header file;

[0007] When a hook condition is met, obtaining the target function address and the identifier from the shared memory;

[0008] Determine the hook function corresponding to the identifier;

[0009] The hook function is injected into the target function address to implement the function hook.

[0010] In a second aspect, an embodiment of the present invention further provides a device for implementing a function hook, including:

[0011] A writing module, used for writing a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset front-end header file;

[0012] An acquisition module, used for acquiring the target function address and the identifier from the shared memory when a hook condition is met;

[0013] A determination module, used to determine the hook function corresponding to the identifier;

[0014] The injection module is used to inject the hook function into the target function address to implement the function hook.

[0015] In a third aspect, an embodiment of the present invention further provides a computer device, including:

[0016] one or more processors;

[0017] A storage device for storing one or more programs;

[0018] The one or more programs are executed by the one or more processors, so that the one or more processors are used to implement the method for implementing the function hook described in any embodiment of the present invention.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for implementing a function hook as provided in any embodiment of the present invention.

[0020] The embodiment of the present invention provides a method, apparatus, computer equipment and storage medium for implementing function hooking. First, the target function address and an identifier identifying the target function address are written into a shared memory, and the target function address is obtained from a preset front header file; then, when the hook condition is met, the target function address and the identifier are obtained from the shared memory; then, the hook function corresponding to the identifier is determined; finally, the hook function is injected into the target function address to implement the function hooking. By using the above technical solution, the target function address in the static library can be effectively obtained, which expands the scope of the hook. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a method for implementing a function hook provided in the first embodiment of the present invention;

[0022] Figure 2 An example flow chart of a method for implementing a function hook provided in Embodiment 2 of the present invention;

[0023] Figure 3 A schematic diagram of the structure of a device for implementing a function hook provided in Embodiment 3 of the present invention;

[0024] Figure 4 A schematic diagram of the structure of a computer device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0025] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0026] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0027] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0028] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0029] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0030] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0031] Embodiment 1

[0032] Figure 1 A flow chart of a method for implementing function hooking provided in Embodiment 1 of the present invention is applicable to the case of hooking functions in a dependent library. The method can be executed by a device for implementing function hooking, wherein the device can be implemented by software and / or hardware and is generally integrated on a computer device.

[0033] like Figure 1 As shown, a method for implementing a function hook provided by Embodiment 1 of the present invention includes the following steps:

[0034] S110. Write a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset prefix header file.

[0035] The target function may be a function that the user wants to hook, and the target function may be an exported function of a dynamic library, an unexported function of a dynamic library, a static member function of a class, a regular function of a class, etc. A class may be an abstract concept of object-oriented programming, which may be understood as an aggregation of data and functions. In this embodiment, there is no specific restriction on the number of target functions.

[0036] The identifier of the target function address can be a symbolic symbol, and the identifier can be a function declaration that identifies the function address, such as an enumeration type. The role of the identifier is to distinguish the specific type of the target function address by the identifier when the function is hooked later. It should be noted that the function signature cannot be identified here only by the target function address, and the function signature is the function declaration.

[0037] In this embodiment, the preset front header file can be a pre-set header file. The main function of the header file is to reuse the global variables of multiple code files, prevent definition conflicts, and give a description of each called function. It does not need to contain the logic implementation code of the program itself. It only plays a descriptive role. The user program only needs to call the relevant functions or variables according to the interface declaration in the header file, and the linker will find the corresponding actual definition code from the library. It should be noted that the preset front header files introduced when hooking different libraries are also different. During the compilation period, the user can actively introduce a preset front header file into the main program, and obtain the target function address exported by other non-dynamic libraries through a preset front header file to cooperate with the subsequent hook operation.

[0038] Furthermore, after obtaining the target function address from the preset front header file, it also includes: declaring a static instance of a singleton class in the preset front header file; when the static instance is initialized, calling the constructor of the singleton class; in the constructor, obtaining the corresponding target function address according to the target function name.

[0039] Among them, after declaring a static instance of a singleton class in the preset front header file, you can rely on the application software to start initializing the global static data, so that you can add some execution logic before the main function in the constructor. It should be explained that static data is a type of code-defined variable. Static data can be initialized at the beginning of the process startup and destroyed at the end of the process shutdown. The constructor is a special function of the class, which can be automatically called when the static instance of the singleton class is initialized.

[0040] In this embodiment, the shared memory can be obtained by applying for a preset front header file. After obtaining the target function address, a piece of shared memory can be applied for through the preset front header file. Among them, the method of applying for shared memory is not limited. Exemplarily, the shared memory can be applied for through the application programming interface of Windows. It should be noted that the shared memory is for sharing the target function address and the identifier of the target function address, and the shared memory can include multiple function addresses.

[0041] In this embodiment, obtaining the corresponding target function address according to the target function name is a conventional method, which will not be elaborated here.

[0042] S120. When a hook condition is met, obtain the target function address and the identifier from the shared memory.

[0043] In this embodiment, the hook condition may be that the user wants to hook a function. When the hook condition is met, that is, the user wants to hook a function, the shared memory is opened at the location where the user wants to hook the function, and the target function address and identifier are obtained from the shared memory. It should be noted that the location where the user wants to hook a function may generally be other dynamic libraries.

[0044] S130: Determine a hook function corresponding to the identifier.

[0045] In this embodiment, the hook function can be a function used to wrap the target function. In some business scenarios, it is necessary to analyze the execution cost of a function, namely the target function, but the code inside the function cannot be changed. In this case, this purpose can be achieved by hooking the function. Hook means wrapping another layer of function outside this function, so that each place where the target function is called will first call the hook function we added, and then call the target function in the hook function.

[0046] Specifically, the process of determining the hook function corresponding to the identifier may be: finding the corresponding function signature, i.e., the corresponding declared hook function, through the identifier of the target function, wherein the hook function and the target function have the same function signature to hook the target function.

[0047] S140, injecting the hook function into the target function address to implement function hook.

[0048] In this embodiment, different declared hook functions are injected into corresponding target function addresses, so that function hook can be implemented.

[0049] A method for implementing function hooking provided in a first embodiment of the present invention first writes a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset prefix header file; then, when a hook condition is met, the target function address and the identifier are obtained from the shared memory; then, the hook function corresponding to the identifier is determined; and finally, the hook function is injected into the target function address to implement function hooking. Using the above method, any function that can be accessed during compilation can be hooked. When a dynamic library does not export the function or a dependent library is not a static library, the target function in the dependent library can still be hooked.

[0050] Furthermore, the shared memory is obtained after applying through the preset front header file.

[0051] In this embodiment, the shared memory can be obtained by applying for a preset front header file, and a shared memory can be applied for by calling the preset front header file.

[0052] Furthermore, the preset front header file is compiled into the executable file of the main program, and the preset front header file is a header file corresponding to the hook library.

[0053] In this embodiment, the preset front header file is compiled into the executable file of the main program. Therefore, the preset front header file can effectively obtain the address of any function accessible during the compilation period.

[0054] Furthermore, the target function address and an identifier identifying the target function address are written into the shared memory, including: identifying the function declaration corresponding to the target function address through the preset front header file to obtain the identifier; and writing the identifier into the shared memory through the preset front header file.

[0055] In this embodiment, marking the function declaration corresponding to the target function address can be understood as bundling the target function address with the declared identifier, i.e., the function signature. For example, if the target function address is A=0x2234, a function type Func_Type, i.e., an identifier, is declared, and the content written into the shared memory is a combination of the target function address and the identifier {0x2234, Func_Type}.

[0056] Furthermore, the target function includes: one or more of a static library function, a dynamic library unexported function, a dynamic library exported function, a global function, a static member function of a class, and a common member function of a class.

[0057] Among them, static library is the opposite of dynamic library. Static library can be added to the executable file at compile time, and the static library code can be packaged into the exe file, so there is no dll file. Dynamic library unexported function is the function that is not declared to be exported in the dynamic library. Global function is a function defined outside the class and can be called by functions in other files.

[0058] In this embodiment, the target function also includes other types of functions besides the dynamic library function. The diversity of the target function types expands the scope of the hook.

[0059] Furthermore, when the application software corresponding to the main program is closed, the applied shared memory is released in the destructor of the singleton class.

[0060] Among them, the destructor is a special function of the class, which can be automatically called when the class instance is destructed.

[0061] In this embodiment, when the application software is closed, the characteristic that the last constructed global static data should be closed can be relied upon, and the applied shared memory can be released in the destructor of the singleton class. This operation can avoid causing system handle leakage.

[0062] The first embodiment of the present invention provides a method for implementing function hooking. The specific execution process of the method is as follows: the target function address is obtained in a preset header file, and then the target function address and a special value that identifies the function address, namely, an identifier, are written into a shared memory. The shared memory is used to share the target function address and the identifier. Then, at the place where the function is desired to be hooked, the shared memory is opened, the target function address and the identifier are taken out, and the hook function of the corresponding function signature is found through the identifier, and the corresponding hook function is injected into the corresponding target function address, so that the function hook can be implemented.

[0063] Embodiment 2

[0064] Figure 2 This is an example flow chart of a method for implementing a function hook provided in the second embodiment of the present invention. The second embodiment of the present invention provides a specific implementation method based on the technical solutions of the above embodiments.

[0065] As a specific implementation method of the present invention, Figure 2 As shown, during the compile time, a static library is introduced into the main application, and a header file is introduced into the main program of the main application; during the run time, the function address, that is, the target function address, can be written into the shared memory, and the function address can be obtained for hooking. The main application can be an application software.

[0066] The specific steps of the above process are as follows:

[0067] 1. The user needs to actively introduce a header file, that is, the preset front header file.

[0068] 2. Declare a static instance of a singleton class in the header file.

[0069] 3. In the class constructor, actively obtain the function address, that is, the target function address, through the function name.

[0070] The function may be a static library function, a function not exported by a dynamic library, or a function exported by a dynamic library.

[0071] 4. After obtaining the corresponding function address, apply for a shared memory, mark the function address, identify the function declaration corresponding to each function address, and write the function address and the corresponding identifier into the applied shared memory.

[0072] 5. When you want to hook a function, open the applied shared memory, read all function addresses from the shared memory, identify the identifiers, and inject the hook functions with different identifiers into the corresponding function addresses, thereby implementing function hooking.

[0073] 6. When the main application is closed, release the requested shared memory in the destructor of the singleton class to avoid system handle leakage.

[0074] The second embodiment of the present invention provides a method for implementing function hooking, which can expand the scope of hooking to any accessible function during compilation by only lightly intruding the user code through the header file actively introduced, thereby breaking through the limitation of the prior art that only dynamic library export functions can be hooked. In addition, the method supports hooking of static libraries, which can provide more imagination space for non-embedded functions such as performance analysis of hook functions.

[0075] Embodiment 3

[0076] Figure 3 A schematic diagram of the structure of a device for implementing function hooking provided in Embodiment 3 of the present invention, wherein the device can be applicable to the case of hooking functions in a dependent library, wherein the device can be implemented by software and / or hardware and is generally integrated on a computer device.

[0077] like Figure 3 As shown, the device includes: a writing module 310 , an acquiring module 320 , a determining module 330 and an injecting module 340 .

[0078] A writing module 310, configured to write a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset header file;

[0079] An acquisition module 320, configured to acquire the target function address and the identifier from the shared memory when a hook condition is met;

[0080] A determination module 330, configured to determine a hook function corresponding to the identifier;

[0081] The injection module 340 is used to inject the hook function into the target function address to implement function hook.

[0082] In this embodiment, the device first writes the target function address and the identifier identifying the target function address into the shared memory through the writing module 310, and the target function address is obtained from the preset prefix header file; secondly, the acquisition module 320 obtains the target function address and the identifier from the shared memory when the hook condition is met; then the determination module 330 determines the hook function corresponding to the identifier; finally, the injection module 340 injects the hook function into the target function address to implement the function hook.

[0083] This embodiment provides a device for implementing function hooking, which can effectively obtain the target function address in the static library and expand the scope of hooking.

[0084] Furthermore, the shared memory is obtained after applying through the preset front header file.

[0085] Furthermore, the preset front header file is compiled into the executable file of the main program, and the preset front header file is a header file corresponding to the hook library.

[0086] Furthermore, after obtaining the target function address from the preset front header file, it also includes: declaring a static instance of a singleton class in the preset front header file; when the static instance is initialized, calling the constructor of the singleton class; in the constructor, obtaining the corresponding target function address according to the target function name.

[0087] Furthermore, the writing module 310 is specifically used to: identify the function declaration corresponding to the target function address through the preset front header file to obtain an identifier; and write the identifier into the shared memory through the preset front header file.

[0088] Furthermore, the target function includes: one or more of a static library function, a dynamic library unexported function, a dynamic library exported function, a global function, a static member function of a class, and a common member function of a class.

[0089] Furthermore, the device for implementing the function hook also includes a release module, which is used to release the applied shared memory in the destructor of the singleton class when the application software corresponding to the main program is closed.

[0090] The above-mentioned device for implementing function hook can execute the method for implementing function hook provided by any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0091] Embodiment 4

[0092] Figure 4 This is a schematic diagram of the structure of a computer device provided by Embodiment 4 of the present invention. Figure 4 As shown, the computer device provided by the fourth embodiment of the present invention includes: one or more processors 41 and a storage device 42; the processor 41 in the computer device can be one or more, Figure 4 A processor 41 is taken as an example; the storage device 42 is used to store one or more programs; the one or more programs are executed by the one or more processors 41, so that the one or more processors 41 implement the method for implementing a function hook as described in any one of the embodiments of the present invention.

[0093] The computer device may further include: an input device 43 and an output device 44 .

[0094] The processor 41, storage device 42, input device 43 and output device 44 in the computer device may be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0095] The storage device 42 in the computer device is a computer-readable storage medium, which can be used to store one or more programs, and the program can be a software program, a computer executable program, and a module, such as a program instruction / module corresponding to a method for implementing a function hook provided in Embodiment 1 or 2 of the present invention (for example, the attached Figure 3 The modules in the device for implementing function hook shown include: a writing module 310, an acquisition module 320, a determination module 330 and an injection module 340). The processor 41 executes various functional applications and data processing of the computer device by running the software programs, instructions and modules stored in the storage device 42, that is, the method for implementing function hook in the above method embodiment is implemented.

[0096] The storage device 42 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the computer device, etc. In addition, the storage device 42 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the storage device 42 may further include a memory remotely arranged relative to the processor 41, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0097] The input device 43 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the computer device. The output device 44 may include display devices such as a display screen.

[0098] Furthermore, when one or more programs included in the above-mentioned computer device are executed by the one or more processors 41, the program performs the following operations:

[0099] Writing the target function address and an identifier identifying the target function address into the shared memory, wherein the target function address is obtained from a preset front-end header file;

[0100] When a hook condition is met, obtaining the target function address and the identifier from the shared memory;

[0101] Determine the hook function corresponding to the identifier;

[0102] The hook function is injected into the target function address to implement the function hook.

[0103] Embodiment 5

[0104] Embodiment 5 of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it is used to execute a method for implementing a function hook. The method includes:

[0105] Writing the target function address and an identifier identifying the target function address into the shared memory, wherein the target function address is obtained from a preset front-end header file;

[0106] When a hook condition is met, obtaining the target function address and the identifier from the shared memory;

[0107] Determine the hook function corresponding to the identifier;

[0108] The hook function is injected into the target function address to implement the function hook.

[0109] Optionally, when the program is executed by a processor, it can also be used to execute a method for implementing a function hook provided by any embodiment of the present invention.

[0110] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable CD-ROM, an optical storage device, a magnetic storage device, or any suitable combination thereof. The computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device.

[0111] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to: electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0112] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the above.

[0113] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0114] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for implementing a function hook, characterized in that: The method comprises: Writing the target function address and an identifier identifying the target function address into the shared memory, wherein the target function address is obtained from a preset front-end header file; When a hook condition is met, obtaining the target function address and the identifier from the shared memory; Determine the hook function corresponding to the identifier; Inject the hook function into the target function address to implement function hook; Wherein, the preset front header file is compiled into the executable file of the main program, and the preset front header file is a header file corresponding to the hook library; After obtaining the target function address from the preset header file, the method further includes: Declare a static instance of a singleton class in the preset front header file; When the static instance is initialized, the constructor of the singleton class is called; In the constructor, the corresponding target function address is obtained according to the target function name.

2. The method according to claim 1, characterized in that The shared memory is obtained after applying through the preset front header file.

3. The method according to claim 1, characterized in that Writing the target function address and an identifier identifying the target function address into a shared memory includes: Identify the function declaration corresponding to the target function address through the preset front header file to obtain an identifier; The identifier is written into the shared memory through the preset prefix header file.

4. The method according to claim 1, characterized in that The target function includes: one or more of a static library function, a dynamic library unexported function, a dynamic library exported function, a global function, a static member function of a class, and a common member function of a class.

5. The method according to claim 1, characterized in that Also includes: When the application software corresponding to the main program is closed, the applied shared memory is released in the destructor of the singleton class.

6. A device for implementing a function hook, characterized in that: The device comprises: A writing module, used for writing a target function address and an identifier identifying the target function address into a shared memory, wherein the target function address is obtained from a preset front-end header file; An acquisition module, used for acquiring the target function address and the identifier from the shared memory when a hook condition is met; A determination module, used to determine the hook function corresponding to the identifier; An injection module, used for injecting the hook function into the target function address to implement function hook; Wherein, the preset front header file is compiled into the executable file of the main program, and the preset front header file is a header file corresponding to the hook library; After obtaining the target function address from the preset header file, the method further includes: Declare a static instance of a singleton class in the preset front header file; When the static instance is initialized, the constructor of the singleton class is called; In the constructor, the corresponding target function address is obtained according to the target function name.

7. A computer device, characterized in that: include: one or more processors; A storage device for storing one or more programs; The one or more programs are executed by the one or more processors, so that the one or more processors are used to execute the method for implementing function hook according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for implementing a function hook as described in any one of claims 1 to 5 is implemented.

Images