Api detection method and apparatus, electronic device, and readable medium

Abstract

Embodiments of the present application provide an API detection method, device, electronic equipment and readable medium, the method comprises: obtaining the executable file of the application program to be detected; extracting a first API set from the executable file; the first API set includes the API written by the OC development language and / or the API written by mixing the OC development language and the swift development language; determining whether there is an intersection between the first API set and the preset private API library, if yes, prompting the API in the intersection as a private API. The embodiments of the present application can extract and detect the API for the application program written by the OC development language and / or mixing the OC development language and the swift development language, and improve the API detection accuracy of the application program.

Description

TECHNICAL FIELD

[0001] The embodiment of the application relates to the development technical field, in particular to an API detection method, an API detection device, an electronic device and a computer readable medium. BACKGROUND

[0002] The private API (Application Programming Interface) refers to an API in an IOS system (an official operating system of Apple) that is not disclosed.

[0003] In a specific implementation, when an application (APP) of the IOS system is developed, the application needs to be submitted to the official Apple for auditing, if the official Apple finds that the submitted application uses the private API, the official Apple will reject the application using the private API to ensure data security, if the official Apple still hopes to allow the application to be online, then the developer needs to redevelop the application, it can be understood that the development efficiency of the application will be greatly reduced, and the development cost of the application is increased.

[0004] In order to solve the above problems, the API of the application is detected in the related art, however, the API detection of the application is a black box operation at present, specified strings are exported and are matched and screened in an artificial manner, and the API written by the swift development language can hardly be detected, so the API detection accuracy of the application is not high. SUMMARY

[0005] The embodiment of the application provides an API detection method, device, electronic device and computer readable storage medium, so as to solve the problem of low API detection accuracy of the application.

[0006] The embodiment of the application discloses an API detection method, comprising:

[0007] An executable file of an application to be detected is acquired;

[0008] A first API set is extracted from the executable file; the first API set comprises an API written by an oc development language and / or an API written by mixing the oc development language and the swift development language;

[0009] It is determined whether there is an intersection between the first API set and a preset private API library, if yes, an API in the intersection is prompted as a private API.

[0010] In an example embodiment, after the first API set is extracted from the executable file, the method further comprises:

[0011] extracting API combination corresponding to user privacy permission from the first API set as a second API set;

[0012] obtaining an Info.plist file of the application program;

[0013] when detecting that an API in the second API set is not in the info.plist file, prompting that the API not in the info.plist file is not declared.

[0014] In an exemplary embodiment, after the first API set is extracted from the executable file, the method further comprises:

[0015] determining whether there is an intersection between the APIs in the first API set and a preset sensitive field library, and if so, prompting that the APIs in the intersection have sensitive fields.

[0016] In an exemplary embodiment, the private API library is generated by the following way:

[0017] extracting all APIs from a framework file of the application program, the all APIs including APIs in a header file and implementation files of the header file;

[0018] obtaining APIs I in the all APIs except the APIs in the header file, and saving as a private API library.

[0019] In an exemplary embodiment, the first API set is extracted from the executable file, comprising:

[0020] when the application program is written in Objective-C development language, extracting APIs from a __TEXT segment of the executable file of the application program and saving to a first API set.

[0021] In an exemplary embodiment, further comprising:

[0022] when the application program is written in mixed Objective-C development language and Swift development language, extracting first APIs from a __TEXT segment of the executable file of the application program;

[0023] extracting second APIs from a specified segment of the application program;

[0024] reversely rearranging the second APIs to obtain third APIs

[0025] saving the first APIs and the third APIs to a first API set.

[0026] In an example embodiment, the executable file is a MachO file of an IOS system.

[0027] The embodiment of the present application further discloses an API detection device, comprising:

[0028] An executable file obtaining module is configured to obtain an executable file of an application program to be detected.

[0029] An API extracting module is configured to extract a first API set from the executable file; the first API set comprises an API written in an OC development language and / or an API written in a mixed OC development language and Swift development language.

[0030] A private API detecting module is configured to determine whether there is an intersection between the first API set and a preset private API library, and if yes, prompt the APIs in the intersection as private APIs.

[0031] In an example embodiment, the device can further comprise a user privacy permission detecting module configured to extract an API combination corresponding to user privacy permission from the first API set as a second API set; obtain an Info.plist file of the application program; and when detecting that the APIs in the second API set are not in the Info.plist file, prompt the APIs not in the Info.plist file as not declared.

[0032] In an example embodiment, the device further comprises a sensitive field detecting module configured to determine whether there is an intersection between the APIs in the first API set and a preset sensitive field library, and if yes, prompt the APIs in the intersection as having sensitive fields.

[0033] In an example embodiment, the device can further comprise a private API library generating module configured to extract all APIs from a framework file of the application program, wherein the all APIs comprise APIs in a header file and implementation files of the header file; obtain the APIs in the all APIs except the APIs in the header file, and save the APIs as a private API library.

[0034] In an example embodiment, the executable file obtaining module is configured to extract APIs from a __TEXT segment of the executable file of the application program and save the APIs into a first API set when the application program is written in an OC development language.

[0035] In an example embodiment, the executable file obtaining module is further configured to extract a first API from a __TEXT segment of the executable file of the application program when the application program is written in a mixed manner of the OC development language and the Swift development language; extract a second API from a designated segment of the application program; perform inverse rearrangement on the second API to obtain a third API; and save the first API and the third API into a first API set.

[0036] In an example embodiment, the executable file can be a MachO file of an IOS system.

[0037] The embodiment of the application further discloses an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus.

[0038] The memory is used for storing a computer program.

[0039] The processor is used for executing the program stored on the memory, and realizes the method as described in the embodiment of the application.

[0040] The embodiment of the application further discloses one or more computer readable media, which store instructions, and when the instructions are executed by one or more processors, the processors execute the method as described in the embodiment of the application.

[0041] The embodiment of the application has the following advantages:

[0042] In the embodiment of the application, the executable file of the application program to be detected is obtained, and a first API set is extracted from the executable file, wherein the first API set includes an API written in the OC development language and an API written in a mixed manner of the OC development language and the Swift development language. By comparing the first API set with a preset private API library, if the first API set has a matched API in the preset API library, it can be determined that the application program contains a private API, and it is prompted that there is a private API. The embodiment of the application can extract and detect the API for the application program written in the OC development language and / or written in a mixed manner of the OC development language and the Swift development language, and therefore the API detection accuracy of the application program is improved. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 is a step flowchart of an API detection method provided in the embodiment of the application;

[0044] Figure 2 is a structure schematic diagram of a MachO file provided in the embodiment of the application;

[0045] Figure 3 is a search demonstration provided by an API in a MachO file in an embodiment of the present application;

[0046] Figure 4 is a structural block diagram of an API detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0048] At present, in the related art, the API detection of the application program includes:

[0049] I. Private API detection:

[0050] At present, when the API detection of the application program is performed, the black box operation is adopted, specifically, the specific string field is exported through the terminal instruction, and then the fields are screened and matched in an artificial manner to determine the private API, and the screening is only for the detection of the API developed by the oc development language, and the detection of the API developed by the swift development language has almost no substantial effect, because the API in the application program developed by the swift development language uses the NameMangling (name mangling) processing to rearrange the name (for example, the method name) of the API, so that the name of the API becomes random code and cannot be normally read and investigated, and it is also impossible to screen and match the private API in an artificial manner.

[0051] II. User privacy permission detection:

[0052] At present, there is no tool related to the user privacy permission detection, and of course, the API used in the application program without declaration cannot be detected.

[0053] In view of the above problems, the API detection method provided in an embodiment of the present application extracts the API developed by the oc development language and / or the API developed by the mixed coding of the oc development language and the swift development language by scanning the executable file of the application program, and then the API is detected, so that before the application program is submitted to the Apple official (App Store), it can be found in advance whether the application program uses the private library, whether the private API is used, whether the sensitive field is used, whether the user privacy permission is used without declaration, and the like, the problems existing in the application program can be found in advance and the prompt is given, the relevant personnel can be prewarned, and the relevant personnel can adaptively modify and adjust the application program to prevent the application program from being unable to be normally online or from appearing abnormally online.

[0054] With reference to Figure 1 , a step flow chart of an API detection method provided in an embodiment of the present application is shown, and can specifically include the following steps:

[0055] Step 102, obtaining an executable file of an application program to be detected.

[0056] The executable file refers to a MachO file of an application program IOS system. Specifically, the MachO file is an executable file in an iOS system and a Mac OS system (also including other formats, such as.a,.o, framework, etc.). With reference to Figure 2 , a structure diagram of a MachO file provided in an embodiment of the present application is shown, and the MachO file mainly includes a Header part and a Data part, wherein the Header part can be understood as a directory, and the data part is understood as a specific storage location of data.

[0057] In the embodiment of the present application, before the application program is submitted to the official Apple, the application program can be taken as an application program to be detected, and the MachO file of the application program to be detected is obtained, and the API detection is performed on the MachO file in advance to determine whether the code of the application program needs to be modified and adjusted.

[0058] Step 104, extracting a first API set from the executable file; the first API set includes an API written in an oc development language and / or an API written in a mixed oc development language and swift development language.

[0059] The API is a pre-defined parameter, such as a method / function (method), a class (class), etc., and the purpose is to provide the ability of the application program and the developer to access a set of routines based on a certain software or hardware without accessing the source code or understanding the details of the internal working mechanism.

[0060] In the embodiment of the present application, the application program can be written in an oc development language or a mixed oc development language and swift development language, wherein if the mixed oc development language and swift development language are used, the API written in the oc development language and the API written in the mixed swift development language will be included in the code of the application program, and the key information can be extracted from the MachO file by scanning the MachO file, and specifically, the key information can include the API in the oc code written in the oc development language and the API in the swift code written in the swift development language, and these APIs can be saved into the first API set.

[0061] It should be noted that the embodiment of the present application is self-analyzing the key information in the MachO file, and does not depend on a third-party tool. Moreover, since the key information in the MachO file is self-analyzed, the key information obtained by the analysis is more complete and accurate. Of course, based on the complete and accurate key information, the detection result (for example, whether the private API is used) obtained by the API detection is also more accurate. In addition, since the embodiment of the present application can self-analyze the key information in the MachO file, the embodiment has strong expansibility and is easy to maintain.

[0062] Step 106, determining whether there is an intersection between the first API set and the preset private API library, and if yes, prompting the API in the intersection as a private API.

[0063] The private API library is a database about the private API, and the private API library can store the API that is not disclosed in the IOS system.

[0064] In the embodiment of the present application, it is determined whether there is an intersection between the first API set and the private API library, and if yes, the API in the intersection is determined as the private API of the application program. The developer is prompted that the private library is used in the application program or the private API is used. The developer will modify the code of the application program based on the prompt, so as to avoid that the private API exists in the application program and cannot be online.

[0065] In the above API detection method, the executable file of the application program to be detected is obtained, and the first API set is extracted from the executable file. The first API set includes the API written in the OC development language and / or the API written in the mixed OC development language and swift development language. By comparing the first API set with the preset private API library, if the first API set has a matched API in the preset API library, it can be determined that the application program contains the private API, and the existence of the private API is prompted. The embodiment of the present application can extract the API and perform API detection for the application program written in the OC development language and / or the mixed OC development language and swift development language. Therefore, the API detection accuracy of the application program is improved.

[0066] On the basis of the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description brief, only the differences from the above embodiment are described in the variant embodiment.

[0067] In an exemplary embodiment, the private API library can be generated in the following way:

[0068] extracting all APIs from a framework file of the application program, the all APIs including APIs in a header file and APIs in an implementation file of the header file;

[0069] obtaining the APIs in the all APIs except the APIs in the header file and saving as a private API library.

[0070] The header file refers to a.h file, the.h file discloses definition of member variables and methods of a class and the like, and is visible to the outside. The implementation file refers to a.m file, the.m file is an implementation of the methods and the like in the.h file, and is invisible to the outside.

[0071] The framework file refers to a framework file. Specifically, the framework file is a static library or a dynamic library of IOS, and can store all APIs in the IOS system.

[0072] In the embodiment of the application, all APIs are extracted from a framework file of an application program, the all APIs including all APIs in.h files and.m files. After the APIs except the APIs in the.h files are removed, private APIs are obtained, and the private APIs can be saved as a private API library. Alternatively, since the data amount of the private API library is large, the private API library can be used for API detection, and the embodiment of the application does not need to be limited in this aspect.

[0073] In the above exemplary embodiment, the private API library is constructed based on the framework file of the application program, more and more complete key information can be obtained, for example, the information can be refined based on methods, and the application program can be detected based on the methods. It can be understood that, since the dimension of the method detection is small, the API detection based on the methods in the private API library can obtain more accurate API detection results.

[0074] In an exemplary embodiment, the step 102 of extracting the first API set from the executable file can include the following steps:

[0075] When the application program is written in the OC development language, the APIs are extracted from the __TEXT segment of the executable file of the application program and saved into the first API set.

[0076] Reference Figure 2The MachO file can include multiple segments, and each segment includes one or more sections. In the embodiment of the present application, the fields related to the API, including class, method, and cstring, are extracted from the MachO file. The fields exist in the segment named __TEXT, and specifically, the fields exist in the sections __TEXT, __objc_methname, __TEXT, objc_cstring, __TEXT, __objc_clasname.

[0077] In the embodiment of the present application, if the application program is written in pure oc, the API can be directly extracted from the section in the __TEXT segment of the MachO file and saved to the first API set for API detection. Since the reverse rearrangement process is not required, the API detection efficiency is high.

[0078] In an exemplary embodiment, the step 102 of extracting the first API set from the executable file can further include the following steps.

[0079] When the application program is written in a mixed manner of oc and swift, the first API is extracted from the __TEXT segment of the executable file of the application program.

[0080] The second API is extracted from the designated segment of the application program.

[0081] The second API is rearranged reversely to obtain the third API.

[0082] The first API and the third API are saved to the first API set.

[0083] If the MachO file is written in a mixed manner of oc and swift, the MachO file includes swift code and oc code. Since there is a large difference between the storage of the swift code and the oc code, the swift code needs to be further parsed to obtain the API of the MachO file when the API in the swift code is extracted.

[0084] The specified segment can include swift5_types, swift5_protos, and a String Table. In the embodiment of the application, if the MachO file is written in a mixed manner using the oc development language and the swift development language, since the swift development language performs name rearrangement processing on the names of APIs, the names of the APIs in the swift code are random codes, and therefore, after the fields related to the APIs are extracted, the APIs need to be further parsed to obtain the API.

[0085] With reference to Figure 3 The application provides a search demonstration of an API in a MachO file, and the extraction manners of class and method in the swift code are as follows:

[0086] For the class: the class in the swift code is not directly stored as a string, and the pointer of the class can be found through the section of swift5_types and swift5_protos, then the specific storage position of the class is obtained by adding the file offset of the pointer to the pointer, and then the address of the name of the class represented by the third 4 bytes is parsed through the storage format of the swift code, and finally the name of the class is found.

[0087] For the method: the method of the swift code is different from that of the oc code, and is not stored through the method list, and therefore, in the embodiment of the application, the method of the class in the swift code is indirectly obtained through the String Table, specifically, all the String Tables in the MachO file are traversed to obtain a string, and then it is judged whether the string is a class of the swift code, if the string is a class of the swift code, the original swift method is parsed from the class through demangled (demangling), and thus the final method name is obtained.

[0088] In the above embodiment, the embodiment of the application can extract and detect the API from the application program written in the pure oc development language and the mixed manner using the oc development language and the swift development language, and has a wide application range.

[0089] In an example embodiment, after the step 104 of extracting the first API set from the executable file, the method can further include the following steps:

[0090] Extracting the API combination corresponding to the user privacy permission from the first API set as a second API set;

[0091] Obtaining an Info.plist file of the application program;

[0092] When it is detected that the API in the second API set is not in the info.plist file, prompting that the API not in the info.plist file is not declared.

[0093] Among them, the main function of the user permission detection is to detect that the code of the application program uses the undeclared user privacy permission.

[0094] Among them, the Info.plist file is used to provide important information about the application program framework to the IOS system, and the Info.plist file specifies how an application program should start, privacy permission and the like, and the Info.plist file is an XML file defined by the official schema of Apple. Through the Info.plist file, the user privacy permission commonly used in the development of the application program can be determined.

[0095] In the embodiment of the application, the user privacy permission detection principle of the embodiment of the application is that if the application program wants to use the user privacy permission, the code related to the user privacy permission needs to be called, such as the class, method and the like related to the user privacy permission, so when the user privacy permission is detected, the app package of the application program is first obtained, the Info.plist file is obtained from the app package, then the first API set is extracted from the MachO file, and the API related to the user privacy permission is extracted from the first API set and saved to the second API set. Among them, if it is detected that the API in the second API set is not in the Info.plist file, it means that there is an undeclared API in the second API set, and the developer can be prompted that the API not in the info.plist file is not declared.

[0096] In the above exemplary embodiment, the user privacy permission of the application program is detected based on the Info.plist file. Since the user privacy permission of the application program is configured in the Info.plist file, the user privacy permission is detected based on the Info.plist file, which has high detection accuracy and matches the official Apple, and is beneficial to improve the accuracy of the user privacy permission detection of the application program and improve the pass rate of the official Apple.

[0097] In an exemplary embodiment, after the step 104 of extracting the first API set from the executable file, the method can further include the following steps:

[0098] Determine whether there is an intersection between the API in the first API set and the preset sensitive field library, and if so, prompt the API in the intersection to have a sensitive field.

[0099] In actual application, the official apple does not allow hot update of the application program, if the sensitive field is detected in the application program, the official apple will let the application program be taken off the market or not pass the audit.

[0100] For the above problems, the embodiment of the application can collect the sensitive fields which are not allowed to be used by the official apple in advance, and then include these sensitive fields in the preset sensitive field library, when detecting the API of the application program, whether there is an intersection between the API of the first API set and the preset sensitive field library can be determined, if there is an intersection, it can be prompted that there is a sensitive field in the application program, and the developer will modify the code of the application program based on the prompt, so as to avoid that there is a sensitive field in the application program and cannot be normally online.

[0101] For example, there is a three-party library called JSPatch which is not allowed to be used by the official apple, and the name JSPatch of the three-party library is a sensitive field, if the field exists in the API of the first API set, it is determined that the sensitive field is detected, and the developer is prompted that there is a sensitive field JSPatch in the application program.

[0102] In the above example embodiment, when detecting the API of the application program, in addition to detecting the private library, the private API and the user privacy permission, the detection of the sensitive field can also be performed, through the comprehensive and complete API detection of the application program, the accuracy of the API detection of the application program is improved, the developer can adjust and modify the application program before submitting to the official apple, the re-development times of the application program are reduced, and the development cost of the application program is reduced.

[0103] It should be noted that for the method embodiment, in order to simply describe, it is expressed as a series of action combinations, but those skilled in the art should know that the embodiment of the application is not limited by the described action sequence, because according to the embodiment of the application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily necessary for the embodiment of the application.

[0104] Referring to Figure 4 , a structure block diagram of an API detection device provided in the embodiment of the application is shown, which can specifically include the following modules:

[0105] An executable file obtaining module 402 is configured to obtain an executable file of an application to be detected.

[0106] An API extracting module 406 is configured to extract a first API set from the executable file; the first API set includes APIs written in an OC development language and / or APIs written in a mixed OC development language and Swift development language.

[0107] A private API detecting module 408 is configured to determine whether there is an intersection between the first API set and a preset private API library, and if yes, prompt the APIs in the intersection as private APIs.

[0108] In an example embodiment, the apparatus can further include a user privacy permission detecting module configured to extract, from the first API set, a combination of APIs corresponding to user privacy permissions as a second API set; obtain an Info.plist file of the application; and when detecting that an API in the second API set is not in the Info.plist file, prompt that the API not in the Info.plist file is not declared.

[0109] In an example embodiment, the apparatus can further include a sensitive field detecting module configured to determine whether there is an intersection between the APIs in the first API set and a preset sensitive field library, and if yes, prompt that the APIs in the intersection have sensitive fields.

[0110] In an example embodiment, the apparatus can further include a private API library generating module configured to extract all APIs from a framework file of the application, the all APIs including APIs in a header file and implementation files of the header file; obtain the APIs in the all APIs except the APIs in the header file, and save as a private API library.

[0111] In an example embodiment, the executable file obtaining module is configured to, when the application is written in the OC development language, extract APIs from a __TEXT segment of the executable file of the application and save the APIs into a first API set.

[0112] In an example embodiment, the executable file obtaining module is further configured to, when the application is written in the mixed OC development language and Swift development language, extract first APIs from a __TEXT segment of the executable file of the application; extract second APIs from a designated segment of the application; obtain third APIs by inversely rearranging the second APIs; and save the first APIs and the third APIs into a first API set.

[0113] In an example embodiment, the executable file is a MachO file of an IOS system.

[0114] To sum up, in the embodiment of the present application, the executable file of the application to be detected is acquired, and a first API set is extracted from the executable file, wherein the first API set includes APIs written in the OC development language and / or APIs written in the mixed OC development language and swift development language. By comparing the first API set with the preset private API library, if the first API set has a matched API in the preset API library, it can be determined that the application contains a private API, and it is prompted that there is a private API. The embodiment of the present application can extract APIs for API detection for the application written in the OC development language or the mixed OC development language and swift development language, and thus the API detection accuracy for the application is improved.

[0115] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts refer to the part of the method embodiment.

[0116] Preferably, the embodiment of the present application further provides an electronic device, which comprises a processor, a memory, a computer program stored in the memory and executable on the processor, and the computer program realizes each process of the above-mentioned API detection method embodiment and achieves the same technical effects when executed by the processor. To avoid repetition, it will not be repeated here.

[0117] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program realizes each process of the above-mentioned API detection method embodiment and achieves the same technical effects when executed by the processor. To avoid repetition, it will not be repeated here. The computer readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0118] It should be noted that in this paper, the term "include", "contain" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0119] Those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, air conditioner, or network device) execute the method described in each embodiment of the present application.

[0120] The embodiments of the present application are described above with reference to the accompanying drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative, not restrictive. Those skilled in the art can make many forms without departing from the purpose of the present application and the scope protected by the claims under the inspiration of the present application, which all belong to the protection of the present application.

[0121] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the embodiments of the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solutions. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0122] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-mentioned system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0123] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0125] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit.

[0126] The functions, if realized in the form of software functional units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the technical scheme of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical scheme can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various storage media that can store program codes, such as a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk.

[0127] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An API detection method, characterized by, The method comprises the following steps: obtaining an executable file of an application to be detected; the executable file comprises a plurality of segments, and the segments contain one or more sections; extracting a first API set from the executable file; the first API set comprises an API written in an OC development language and / or an API written in a mixed OC development language and a Swift development language; determining whether there is an intersection between the first API set and a preset private API library, and if yes, prompting that the APIs in the intersection are private APIs; wherein the step of extracting the first API set from the executable file comprises: extracting a first API from the sections in a __TEXT segment of the executable file; the sections comprise __TEXT, __objc_methname, __TEXT, objc_cstring, and __TEXT, __objc_clasname; extracting a class name from swift5_types and swift5_protos of the application; extracting a string from a String Table of the application, and determining whether the string is a class of Swift code; if yes, parsing a method name from the class through reverse rearrangement; taking the class name and the method name as third APIs; when the application is written in the OC development language, saving the first APIs into the first API set; when the application is written in the mixed OC development language and the Swift development language, saving the first APIs and the third APIs into the first API set.

2. The method of claim 1, wherein, After the step of extracting the first API set from the executable file, the method further comprises: extracting, from the first API set, an API combination corresponding to a user privacy permission as a second API set; obtaining an Info.plist file of the application; when detecting that an API in the second API set is not in the info.plist file, prompting that the API not in the info.plist file is not declared.

3. The method according to claim 1 or 2, characterized in that, After the step of extracting the first API set from the executable file, the method further comprises: determining whether there is an intersection between the APIs in the first API set and a preset sensitive field library, and prompting that the APIs in the intersection have sensitive fields.

4. The method of claim 1, wherein, The private API library is generated in the following manner: extracting all APIs from a framework file of the application; the all APIs comprise APIs in a header file and implementation files of the header file; obtaining the APIs in the all APIs except the APIs in the header file, and saving the APIs as the private API library.

5. The method of claim 1, wherein, The executable file is a MachO file of an IOS system.

6. An API detection apparatus characterized by comprising: The method comprises the following steps: an executable file obtaining module is configured to obtain an executable file of an application to be detected; the executable file comprises a plurality of segments, and the segments contain one or more sections; An API extraction module is configured to extract a first API set from the executable file; the first API set includes APIs written in an OC development language and / or APIs written in a mixed OC development language and a Swift development language; A private API detection module is configured to determine whether there is an intersection between the first API set and a preset private API library, and if yes, prompt the APIs in the intersection as private APIs; The first API set is extracted from the executable file, including: The first API is extracted from the section in the __TEXT segment of the executable file; the section includes __TEXT, __objc_methname, __TEXT, objc_cstring, __TEXT, __objc_clasname; The class name is extracted from the swift5_types and swift5_protos of the application program; The string is extracted from the String Table of the application program, and it is determined whether the string is a class of Swift code; if yes, the method name is parsed from the class through reverse rearrangement; The class name and the method name are taken as third APIs; When the application program is written in the OC development language, the first API is saved into the first API set; when the application program is written in the mixed OC development language and the Swift development language, the first API and the third API are saved into the first API set.

7. An electronic device, comprising: A processor, a communication interface, a memory and a communication bus are included, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus; The memory is configured to store a computer program; The processor is configured to execute the program stored on the memory, and implement the method in any one of claims 1-5.

8. One or more computer readable media having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method of any one of claims 1-5.

Images