Background task detection method, device, electronic device and storage medium

Abstract

The present invention provides a background task detection method, device, electronic device and storage medium. The method includes: disassembling the symbol table of the project to be detected and obtaining the assembly instructions of each symbol therein; for any target function, obtaining each target symbol containing the address of the target function, and obtaining the class name corresponding to each target symbol through the address information of each target symbol, and obtaining a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task; by comparing the first class name list and the second class name list, obtaining a difference class, so as to detect the code of the difference class and obtain a background task detection result, wherein the first class name list is a class name list corresponding to the function for starting a background task, and the second class name list is a class name list corresponding to the function for ending a background task.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a background task detection method, device, electronic device and storage medium. Background Art

[0002] There are two main ways to analyze background task leaks: Method 1: Search globally in Xcode for the code that starts background tasks, and then manually analyze the code to see if there is a background task leak caused by starting background tasks but not ending them. Method 2: Use Hook to obtain and collect all the codes that start background tasks and end background tasks to see if they appear in pairs, and determine if there is a task leak caused by not ending background tasks.

[0003] However, the transition through Xcode global search relies on manual work, which is time-consuming and laborious. It is also impossible to achieve full coverage in the code. For example, some .m files in the SDK are not exposed to the outside world, so there may be situations where the target function cannot be searched. The Hook method is more dependent on the runtime state, which may result in missed inspections, so there will be incomplete coverage.

[0004] It can be seen that the relevant technical solutions all have problems such as high cost and inaccurate detection results. Summary of the invention

[0005] The embodiments of the present invention provide a background task detection method, device, electronic device and storage medium to solve the problem that the existing background task leakage analysis method has high cost and inaccurate detection results.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides a background task detection method, comprising:

[0008] Disassemble the symbol table of the project to be detected and obtain the assembly instructions of each symbol in it;

[0009] For any target function, obtain each target symbol containing the address of the target function, and obtain the class name corresponding to each target symbol through the address information of each target symbol, and obtain a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task;

[0010] By comparing the first class name list and the second class name list, the difference class is obtained to detect the code of the difference class and obtain the background task detection result. The first class name list is a class name list corresponding to the function of starting the background task, and the second class name list is a class name list corresponding to the function of ending the background task.

[0011] Optionally, the step of acquiring each target symbol including the address of the target function by address matching, and acquiring the class name corresponding to each target symbol by address information of each target symbol, to obtain a class name list corresponding to the target function includes:

[0012] For any symbol, by address matching, the address of the target function is searched in the assembly instruction of the symbol, and all target symbols having the address of the target function in the assembly instruction are obtained;

[0013] For any of the target symbols, the class name corresponding to the target symbol is searched in the string table of the item to be detected through the starting address and the offset address of the target symbol to obtain a class name list corresponding to the target function.

[0014] Optionally, for any symbol, searching the address of the target function in the assembly instruction of the symbol by address matching, and obtaining all target symbols having the address of the target function in the assembly instruction, comprises:

[0015] Obtaining the high-order address and the low-order address of the target function;

[0016] The high-order address and the low-order address of the target function are searched in the assembly instruction of each symbol, and all target symbols having the high-order address and the low-order address of the target function in the assembly instruction are obtained.

[0017] Optionally, the step of searching the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining all target symbols having the high-order address and the low-order address of the target function in the assembly instruction, comprises:

[0018] Searching for the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction;

[0019] Filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol;

[0020] The adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

[0021] Optionally, for any of the target symbols, the step of searching the class name corresponding to the target symbol in the string table of the item to be detected through the starting address and the offset address of the target symbol to obtain a class name list corresponding to the target function includes:

[0022] For any of the target symbols, searching for a class name corresponding to the target symbol in the string table of the item to be detected by using the starting address and the offset address of the target symbol;

[0023] Obtain the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be tested;

[0024] A class name list corresponding to the target function is generated based on each of the class names.

[0025] Optionally, the step of disassembling the symbol table of the project to be detected and obtaining the assembly instruction of each symbol therein comprises:

[0026] Obtain a list of functions called in the project to be detected;

[0027] For any target function, in response to the target function existing in the function list, disassemble the symbol table of the item to be detected to obtain assembly instructions of all symbols;

[0028] For any symbol, the disassembled symbol table is traversed, and the assembly instruction of the symbol is found from all assembly instructions through the starting address and offset address of the symbol.

[0029] In a second aspect, an embodiment of the present invention provides a background task detection device, comprising:

[0030] The disassembly module is used to disassemble the symbol table of the project to be detected and obtain the assembly instructions of each symbol therein;

[0031] Calling a class acquisition module, for obtaining, for any target function, each target symbol containing the address of the target function, and obtaining the class name corresponding to each target symbol through the address information of each target symbol, to obtain a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task;

[0032] The background task detection module is used to obtain the difference class by comparing the first class name list and the second class name list, so as to detect the code of the difference class and obtain the background task detection result. The first class name list is the class name list corresponding to the function of starting the background task, and the second class name list is the class name list corresponding to the function of ending the background task.

[0033] Optionally, the calling class acquisition module includes:

[0034] A target symbol acquisition submodule is used to search for the address of the target function in the assembly instruction of any symbol by address matching, and acquire all target symbols having the address of the target function in the assembly instruction;

[0035] The class acquisition submodule is called to search for the class name corresponding to any of the target symbols in the string table of the item to be detected through the starting address and offset address of the target symbol, and obtain a class name list corresponding to the target function.

[0036] Optionally, the target symbol acquisition submodule includes:

[0037] An address processing unit, used for obtaining a high-order address and a low-order address of the target function;

[0038] The target symbol acquisition unit is used to search the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and acquire all target symbols having the high-order address and the low-order address of the target function in the assembly instruction.

[0039] Optionally, the target symbol acquisition unit is specifically used to:

[0040] Searching for the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction;

[0041] Filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol;

[0042] The adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

[0043] Optionally, the calling class obtains a submodule, specifically for:

[0044] For any of the target symbols, searching for a class name corresponding to the target symbol in the string table of the item to be detected by using the starting address and the offset address of the target symbol;

[0045] Obtain the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be tested;

[0046] A class name list corresponding to the target function is generated based on each of the class names.

[0047] Optionally, the disassembly module includes:

[0048] A calling function acquisition submodule is used to obtain a list of functions called in the project to be detected;

[0049] A disassembly processing submodule is used for disassembling the symbol table of the item to be detected for any target function in response to the target function existing in the function list, to obtain assembly instructions of all symbols;

[0050] The assembly instruction splitting submodule is used to traverse the disassembled symbol table for any symbol and find the assembly instruction of the symbol from all assembly instructions through the starting address and offset address of the symbol.

[0051] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the background task detection method described in the first aspect are implemented.

[0052] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the background task detection method described in the first aspect are implemented.

[0053] In the embodiment of the present invention, by disassembling the contents of the symbol table, all target symbols with target function addresses are found, the contents in the string are calculated by the start address and the offset address, and the class name corresponding to the target symbol is found. Through this operation, the calling class tables of the start task and the end task are found respectively, and the difference classes are found by comparing the two class tables, and then whether there is a real task leakage in the difference class is detected. Thus, the beneficial effect of improving the accuracy, efficiency and comprehensiveness of the detection results is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a flowchart of the steps of a background task detection method in an embodiment of the present invention;

[0055] Figure 2 is a flowchart of another background task detection method in an embodiment of the present invention;

[0056] Figure 3 It is a schematic diagram of all calling classes of starting a background task and ending a background task function in an embodiment of the present invention;

[0057] Figure 4 is a structural diagram of a background task detection device in an embodiment of the present invention;

[0058] Figure 5 It is a structural diagram of another background task detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] Reference Figure 1 , shows a step flow chart of a background task detection method in an embodiment of the present invention.

[0061] Step 110, disassemble the symbol table of the project to be detected, and obtain the assembly instruction of each symbol therein;

[0062] Step 120, for any target function, obtain each target symbol including the address of the target function, and obtain the class name corresponding to each target symbol through the address information of each target symbol, to obtain a class name list corresponding to the target function, wherein the address information includes a start address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task;

[0063] Step 130, by comparing the first class name list and the second class name list, the difference class is obtained to detect the code of the difference class to obtain the background task detection result, the first class name list is the class name list corresponding to the function of starting the background task, and the second class name list is the class name list corresponding to the function of ending the background task.

[0064] In the embodiment of the present invention, in order to achieve full code coverage and make the detection result more comprehensive and accurate, the contents of the symbol table are disassembled, and then all symbols with the target function address are found by address matching, and the content in the string is calculated by the starting address and offset address of the symbol, and the class name corresponding to the symbol is found. Through the above operations, the class tables for starting and ending tasks can be found respectively, and the difference classes can be found by comparing the two class tables, and then whether there is a real task leakage in the difference class can be detected.

[0065] In order to prepare for finding the address of the target function, the symbol table of the item to be detected can be disassembled to obtain the assembly instructions of all symbols, and then the assembly instructions of each symbol can be obtained.

[0066] Then, for any target function among the function of starting background tasks and the function of ending background tasks in the project to be tested, each target symbol containing the address of the target function can be obtained by address matching, and the class name corresponding to each target symbol can be obtained through the address information of each target symbol to obtain a class name list corresponding to the target function, thereby respectively obtaining the class name list corresponding to the function of starting background tasks and the class name list corresponding to the function of ending background tasks.

[0067] The address information of the target function may include but is not limited to the start address and the offset address. Moreover, in the embodiment of the present invention, the function of starting the background task, the function of ending the background task, the address of each function, and the address information of each target symbol may be obtained by any available method, which is not limited by the embodiment of the present invention.

[0068] For example, the function for starting background tasks and the function for ending background tasks can be obtained according to the layout of the project to be tested, and the address of each required function can be found in the function list called by the project to be tested, and the address information of each required symbol can be obtained from the disassembled symbol table of the project to be tested, and so on.

[0069] In addition, in the embodiment of the present invention, the symbol containing the address of the current target function, that is, the target symbol corresponding to the corresponding target function, can also be obtained by any available method, which is not limited by the embodiment of the present invention.

[0070] For example, all symbols containing the target function address can be found through address matching, which are the current target symbols.

[0071] Then for each current target symbol, the corresponding content can be found in the string table of the item to be detected through the starting address and offset address (that is, the starting address and offset address of the target symbol), and the corresponding class name can be found. After obtaining the class name corresponding to each target symbol corresponding to the current target function, a class name list corresponding to the current target function can be constructed.

[0072] After collecting all the call classes of the background task start and end functions, the difference classes are found through comparison. At this time, there is a high probability that there are problems in these difference classes. Then, it is only necessary to check the codes of these difference classes, which is more accurate and has a higher chance of success. In addition, in the embodiment of the present invention, any available method can be used to check whether there are abnormalities in the codes of these difference classes, which is not limited in the embodiment of the present invention.

[0073] It should be noted that the above-mentioned items to be detected, as well as the type and format of the objective function, can be adaptively adjusted according to specific application scenarios, which is not limited in the embodiment of the present invention.

[0074] For example, for the iOS operating system, the item to be detected may be a Mach-O (Machobject) file of a certain program, and the start and end of the background task are both OC (Objective-C) functions, that is, the target function may be a target OC function.

[0075] Reference Figure 2 In the embodiment of the present invention, the step 120 may further include:

[0076] Step 121, for any symbol, by address matching, searching for the address of the target function in the assembly instruction of the symbol, and obtaining all target symbols having the address of the target function in the assembly instruction;

[0077] Step 122, for any of the target symbols, search the class name corresponding to the target symbol in the string table of the item to be detected through the starting address and offset address of the target symbol to obtain a class name list corresponding to the target function.

[0078] In order to obtain the target symbol whose assembly instruction contains or has the address of the current target function, the address of the corresponding target function can be searched in the assembly instruction of each symbol by address matching. If the address is found, it proves that the symbol is a target symbol.

[0079] For each target symbol, in order to obtain its corresponding calling class, the class name corresponding to the target symbol can be further searched in the string table of the item to be detected through the starting address and offset address of the target symbol, and then the class name corresponding to each target symbol corresponding to the current target function can be combined to obtain the class name list corresponding to the current target function.

[0080] The starting address and offset address of the symbol can be obtained by any available method, which is not limited in the embodiment of the present invention. For example, the starting address and offset address of each symbol in the disassembled symbol table can be obtained by traversing the disassembled symbol table, that is, the starting address and offset address of the corresponding symbol, and so on.

[0081] Optionally, in the embodiment of the present invention, step 121 may further include:

[0082] Step 1211, obtaining the high address and low address of the target function;

[0083] Step 1212, searching the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining all target symbols having the high-order address and the low-order address of the target function in the assembly instruction.

[0084] Since the target function such as OC function will be stored in the high address and low address respectively in the assembly instruction, such as: the target function address is 0x3f08c60, which will be represented as 0x3f8000 and 0xc60 in the assembly instruction. Therefore, in the embodiment of the present invention, when searching for the target symbol with the address of the target function in the assembly instruction, it is necessary to find the high address and low address of the target function at the same time. That is, the high address and low address of the target function are searched in the assembly instruction of each symbol, and all the target symbols with the high address and low address of the corresponding target function in the assembly instruction are obtained.

[0085] Optionally, in the embodiment of the present invention, the step 1212 may further include:

[0086] Step S1, searching the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction;

[0087] Step S2, filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol; wherein the adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

[0088] In actual applications, the assembly instructions of a symbol may be multiple lines, and the lines where the high-order address and the low-order address are located are generally adjacent to each other.

[0089] Therefore, in an embodiment of the present invention, in order to prevent the high-order address and the low-order address from not being the same function address, which affects the accuracy and comprehensiveness of the target symbol, the error data can also be filtered by setting adjacent instruction intervals. Specifically, the high-order address and the low-order address of the target function can be searched in the assembly instructions of each symbol first, and the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instructions is obtained, and the error data in the initial symbol is further filtered through the preset adjacent instruction interval conditions to obtain the target symbol; wherein, the adjacent instruction interval conditions can at least include but are not limited to: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address. Of course, generally speaking, the high-order address appears before the low-order address, so in an embodiment of the present invention, according to needs, the adjacent instruction interval conditions can also be set to only include the rows where the high-order address and the low-order address are located are adjacent, and this embodiment of the present invention is not limited to this.

[0090] In addition, in an embodiment of the present invention, error data can be filtered while searching for the high and low addresses of the target function in the assembly instructions of each symbol. That is, while finding the high and low addresses of the target function in the assembly instructions of the symbol, the high and low addresses of the target function can be further compared to see whether they meet the adjacent instruction interval condition. If so, the symbol can be identified as a target symbol. If not, the symbol can be filtered out as abnormal data. This embodiment of the present invention is not limited to this.

[0091] Optionally, in the embodiment of the present invention, step 122 may further include:

[0092] Step 1221, for any of the target symbols, searching the string table of the item to be detected for a class name corresponding to the target symbol through the start address and offset address of the target symbol;

[0093] Step 1222, obtaining the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be tested;

[0094] Step 1223: Generate a class name list corresponding to the target function based on each class name.

[0095] In actual applications, the files of the project to be detected (such as Mach-O files) generally only contain calls to classes in static libraries and system libraries, and cannot obtain calls to classes in dynamic libraries. Therefore, in the embodiment of the present invention, in order to further ensure the comprehensiveness of the detection results, a Hook function can be further added to the target function to collect the classes that call the target function in the dynamic library through the Hook function.

[0096] Because the dynamic library is linked at runtime, it will not appear in the Mach-O binary file. Therefore, it needs to be obtained through Hook. In general, it is possible to obtain in advance where the dynamic library is used, so the required functions can be executed in a targeted manner, and then detected through Hook. At this time, Hook is more targeted, so there is no incomplete acquisition.

[0097] That is to say, Hook can effectively solve the pain point of not being able to obtain the real-time calling class in the dynamic library at this time, and then the class name of the class called by the target function in the static library, system library, and dynamic library can be integrated to generate a class name list of the target function.

[0098] Reference Figure 2 In the embodiment of the present invention, step 110 may further include:

[0099] Step 111, obtaining a list of functions called in the project to be detected;

[0100] Step 112, for any target function, in response to the target function existing in the function list, disassemble the symbol table of the item to be detected to obtain assembly instructions of all symbols;

[0101] Step 113, for any symbol, traverse the disassembled symbol table, and find the assembly instruction of the symbol from all assembly instructions through the starting address and offset address of the symbol.

[0102] In an embodiment of the present invention, before disassembling the symbol table, it is also possible to determine whether the project to be detected calls the current target function, that is, whether it is necessary to detect background task leakage for the project to be detected. Specifically, a list of functions called in the project to be detected can be obtained, and then the target function is detected in the function list. Moreover, in an embodiment of the present invention, the list of functions called in the project to be detected can be obtained by any available method, which is not limited by the embodiment of the present invention.

[0103] For example, in Mach-O, all called OC functions will exist in the selrefs section, so you can get the selrefs section and detect whether the target function name exists in it by traversing it, and so on.

[0104] If any target function exists, the symbol table of the corresponding project to be detected can be disassembled to obtain the assembly instructions of all the symbols therein, so as to prepare for the subsequent search for the target function address.

[0105] Then, in order to obtain the assembly instructions of each symbol, the disassembled symbol table can be further traversed to obtain the starting address and offset address of each symbol therein, and then the assembly instructions of the current symbol can be found from all assembly instructions through the starting address and offset address of the symbol.

[0106] In an embodiment of the present invention, all classes of functions that call to start background tasks and all classes of functions that call to end background tasks in the project to be detected can be collected separately, that is, all calling classes of functions that start background tasks and end background tasks. By comparison, difference classes can be found. At this time, there is a high probability that there will be problems with these difference classes, so the code of the difference classes can be checked in detail.

[0107] like Figure 3 The figure shows a schematic diagram of all call classes for starting and ending background tasks. By comparison, it can be found that the class in the dotted box is the difference class (such as Figure 3 class4, class5, class7, class8), where the difference class under the open task (such as Figure 3 class4, class5) in the task can be the class that may have leakage, and the difference class under the end task is the class that needs to be checked (such as Figure 3 class7, class8 in the example), then the codes of each difference class can be checked to determine whether there is a real task leak or other anomalies. Moreover, in the embodiment of the present invention, any available method can be used to further check the codes of the difference class, which is not limited by the embodiment of the present invention.

[0108] Based on the technical solution in the embodiment of the present invention, the classes in the library can be accurately detected to achieve full code coverage, making the detection results more comprehensive and accurate. Moreover, the inspection scope is more focused, and the location of classes with background task leaks is faster, effectively avoiding the situation where the functions cannot be fully covered. In addition, tooling and process-based are achieved, making background task detection more automated and improving work efficiency.

[0109] Reference Figure 4 , shows a schematic structural diagram of a background task detection device in an embodiment of the present invention.

[0110] The background task detection device of the embodiment of the present invention includes: a disassembly module 210 , a call class acquisition module 220 and a background task detection module 230 .

[0111] The functions of each module and the interactions between them are introduced in detail below.

[0112] The disassembly module 210 is used to disassemble the symbol table of the project to be detected and obtain the assembly instruction of each symbol therein;

[0113] Calling the class acquisition module 220, for obtaining, for any target function, each target symbol including the address of the target function, and obtaining the class name corresponding to each target symbol through the address information of each target symbol, to obtain a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task;

[0114] The background task detection module 230 is used to obtain the difference class by comparing the first class name list and the second class name list, so as to detect the code of the difference class and obtain the background task detection result. The first class name list is the class name list corresponding to the function of starting the background task, and the second class name list is the class name list corresponding to the function of ending the background task.

[0115] Reference Figure 5 In the embodiment of the present invention, the calling class acquisition module 220 may further include:

[0116] The target symbol acquisition submodule 221 is used for searching the address of the target function in the assembly instruction of any symbol by address matching, and acquiring all target symbols having the address of the target function in the assembly instruction;

[0117] The class acquisition submodule 222 is called to search for the class name corresponding to any target symbol in the string table of the item to be detected through the starting address and offset address of the target symbol, and obtain a class name list corresponding to the target function.

[0118] Optionally, in this embodiment of the present invention, the target symbol acquisition submodule 221 may include:

[0119] An address processing unit, used for obtaining a high-order address and a low-order address of the target function;

[0120] The target symbol acquisition unit is used to search the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and acquire all target symbols having the high-order address and the low-order address of the target function in the assembly instruction.

[0121] Optionally, in the embodiment of the present invention, the target symbol acquisition unit may be specifically used to:

[0122] Searching for the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction;

[0123] Filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol;

[0124] The adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

[0125] Optionally, in the embodiment of the present invention, the calling class acquisition submodule 222 may be specifically used for:

[0126] For any of the target symbols, searching for a class name corresponding to the target symbol in the string table of the item to be detected by using the starting address and the offset address of the target symbol;

[0127] Obtain the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be tested;

[0128] A class name list corresponding to the target function is generated based on each of the class names.

[0129] Reference Figure 5 In the embodiment of the present invention, the disassembly module 210 may further include:

[0130] A calling function acquisition submodule 211 is used to acquire a list of functions called in the project to be detected;

[0131] The disassembly processing submodule 212 is used for disassembling the symbol table of the item to be detected for any target function in response to the target function existing in the function list, and obtaining assembly instructions of all symbols;

[0132] The assembly instruction splitting submodule 213 is used for traversing the disassembled symbol table for any symbol, and finding the assembly instruction of the symbol from all assembly instructions through the starting address and offset address of the symbol.

[0133] The background task detection device provided by the embodiment of the present invention can realize Figure 1 to Figure 2 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0134] Preferably, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned background task detection method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0135] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned background task detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0136] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0137] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0138] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0139] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0140] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0141] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0142] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0143] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0144] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0145] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A background task detection method, characterized in that: include: Disassemble the symbol table of the project to be detected and obtain the assembly instructions of each symbol in it; For any target function, obtain each target symbol containing the address of the target function, and obtain the class name corresponding to each target symbol through the address information of each target symbol, and obtain a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task; By comparing the first class name list and the second class name list, a difference class is obtained to detect the code of the difference class and obtain the background task detection result. The first class name list is a class name list corresponding to the function of starting the background task, and the second class name list is a class name list corresponding to the function of ending the background task.

2. The method according to claim 1, characterized in that The step of obtaining, for any target function, each target symbol including the address of the target function, and obtaining the class name corresponding to each target symbol through the address information of each target symbol, to obtain a class name list corresponding to the target function, comprises: For any symbol, by address matching, the address of the target function is searched in the assembly instruction of the symbol, and all target symbols having the address of the target function in the assembly instruction are obtained; For any of the target symbols, the class name corresponding to the target symbol is searched in the string table of the item to be detected through the starting address and the offset address of the target symbol to obtain a class name list corresponding to the target function.

3. The method according to claim 2, characterized in that The step of searching the address of the target function in the assembly instruction of the symbol by address matching for any symbol, and obtaining all target symbols having the address of the target function in the assembly instruction, comprises: Obtaining the high-order address and the low-order address of the target function; The high-order address and the low-order address of the target function are searched in the assembly instruction of each symbol, and all target symbols having the high-order address and the low-order address of the target function in the assembly instruction are obtained.

4. The method according to claim 3, characterized in that The step of searching the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining all target symbols having the high-order address and the low-order address of the target function in the assembly instruction, comprises: Searching for the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction; Filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol; The adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

5. The method according to any one of claims 2 to 4, characterized in that: The step of searching, for any of the target symbols, the class name corresponding to the target symbol in the string table of the item to be detected through the starting address and the offset address of the target symbol, and obtaining a class name list corresponding to the target function includes: For any of the target symbols, searching for a class name corresponding to the target symbol in the string table of the item to be detected by using the starting address and the offset address of the target symbol; Obtain the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be detected; A class name list corresponding to the target function is generated based on each class name.

6. The method according to claim 1, characterized in that The step of disassembling the symbol table of the project to be detected and obtaining the assembly instruction of each symbol therein comprises: Obtain a list of functions called in the project to be detected; For any target function, in response to the target function existing in the function list, disassemble the symbol table of the item to be detected to obtain assembly instructions of all symbols; For any symbol, the disassembled symbol table is traversed, and the assembly instruction of the symbol is found from all assembly instructions through the starting address and offset address of the symbol.

7. A background task detection device, characterized in that: include: The disassembly module is used to disassemble the symbol table of the project to be detected and obtain the assembly instructions of each symbol therein; Calling a class acquisition module, for obtaining, for any target function, each target symbol containing the address of the target function, and obtaining the class name corresponding to each target symbol through the address information of each target symbol, to obtain a class name list corresponding to the target function, wherein the address information includes a starting address and an offset address, and the target function includes a function for starting a background task and a function for ending a background task; The background task detection module is used to obtain the difference class by comparing the first class name list and the second class name list, so as to detect the code of the difference class and obtain the background task detection result. The first class name list is the class name list corresponding to the function of starting the background task, and the second class name list is the class name list corresponding to the function of ending the background task.

8. The device according to claim 7, characterized in that The calling class acquisition module includes: A target symbol acquisition submodule is used to search for the address of the target function in the assembly instruction of any symbol by address matching, and acquire all target symbols having the address of the target function in the assembly instruction; The class acquisition submodule is called to search for the class name corresponding to any of the target symbols in the string table of the item to be detected through the starting address and offset address of the target symbol, and obtain a class name list corresponding to the target function.

9. The device according to claim 8, characterized in that The target symbol acquisition submodule includes: An address processing unit, used for obtaining a high-order address and a low-order address of the target function; The target symbol acquisition unit is used to search the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and acquire all target symbols having the high-order address and the low-order address of the target function in the assembly instruction.

10. The device according to claim 9, characterized in that The target symbol acquisition unit is specifically used for: Searching for the high-order address and the low-order address of the target function in the assembly instruction of each symbol, and obtaining the initial symbol in which the high-order address and the low-order address of the target function exist in the assembly instruction; Filtering the error data in the initial symbol through a preset adjacent instruction interval condition to obtain the target symbol; The adjacent instruction interval condition at least includes: the rows where the high-order address and the low-order address are located are adjacent, and the high-order address appears before the low-order address.

11. The device according to any one of claims 8 to 10, characterized in that The calling class obtains the submodule, which is specifically used for: For any of the target symbols, searching for a class name corresponding to the target symbol in the string table of the item to be detected by using the starting address and the offset address of the target symbol; Obtain the class name of the class that calls the target function in the dynamic library by adding a Hook function for the target function in the project to be detected; A class name list corresponding to the target function is generated based on each class name.

12. The device according to claim 7, characterized in that The disassembly module comprises: A calling function acquisition submodule is used to obtain a list of functions called in the project to be detected; A disassembly processing submodule is used for disassembling the symbol table of the item to be detected for any target function in response to the target function existing in the function list, to obtain assembly instructions of all symbols; The assembly instruction splitting submodule is used to traverse the disassembled symbol table for any symbol and find the assembly instruction of the symbol from all assembly instructions through the starting address and offset address of the symbol.

13. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the background task detection method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the background task detection method according to any one of claims 1 to 6 are implemented.

Images