Application detection method and apparatus, computer storage medium, and electronic device

Abstract

The present disclosure relates to the technical field of computer, and particularly relates to an application detection method and device, a storage medium and an electronic device. The method comprises the following steps: adding a hook function based on an Xposed framework to a target function to generate a detection program file; obtaining to-be-detected package information, and if the to-be-detected package information matches current running application information, injecting the detection program file into a running program of the current running application; running the detection program file and the current running application by using different processes respectively, and detecting the calling behavior of the target function in the current running application process by calling the running information of the detection program file running process. The present disclosure can simultaneously detect multiple target functions with privacy calling behavior, and can also detect multiple running applications by running the detection program file and the current running application in a cross-process manner, so that the detection efficiency is high and the code change is small.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to an application testing method, an application testing device, a computer storage medium, and an electronic device. Background Technology

[0002] Android is currently the most popular smartphone software platform, characterized by its openness and customizability. However, due to the openness of Android, the release of applications lacks identity verification and the review process is relatively weak. As a result, malicious Android applications are becoming increasingly rampant, posing a significant challenge to users' personal privacy and property security. Therefore, accurately detecting violations in applications is of great practical significance.

[0003] Violations such as Android applications illegally collecting personal information, excessively requesting permissions, consuming excessive data, stealing privacy, and frequently harassing users are currently detected by program developers through code verification, repeated communication with officials from the Ministry of Industry and Information Technology (MIIT) regarding inspection results, and corresponding preventative measures. There are also detection plugins developed for each type of Android application, but each plugin can only detect specific applications. Therefore, there is a need for a detection method that can detect multiple violations and be applied to multiple applications simultaneously.

[0004] It should be noted that the information in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide an application detection method and apparatus, computer storage medium and electronic device that can simultaneously detect multiple unauthorized calls to user privacy information and is applicable to multiple applications, thereby improving application detection efficiency and reducing development costs.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, an application detection method is provided, comprising: adding a hook function based on the Xposed framework to a target function to generate a detection program file; obtaining information of a package to be inspected; if the information of the package to be inspected matches information of a currently running application, injecting the detection program file into the running program of the currently running application; running the detection program file and the currently running application in different processes respectively, and detecting the calling behavior of the target function in the currently running application process by calling the running information of the running process of the detection program file.

[0008] In one exemplary embodiment of this disclosure, before adding an Xposed framework-based hook function to the target function to obtain the detection program file, the method further includes: obtaining the highest root privileges of the Android system; installing the Xposed module, and replacing the system process zygote file in the Android system with the Xposed module.

[0009] In one exemplary embodiment of this disclosure, the running information of the detection program file is stored in a local file; before matching the information of the package to be inspected with the information of the currently running application, the method further includes: injecting an Xposed file into the currently running application process, wherein the running of the Xposed file depends on the detection program file; and obtaining the information of the package to be inspected stored in the local file by running the Xposed file to reference the detection program file.

[0010] In one exemplary embodiment of this disclosure, the step of running the detection program file and the currently running application in different processes, and detecting the call behavior of the target function in the currently running application process by calling the running information in the running process of the detection program file, includes: running the detection program file injected into the running program of the currently running application, causing the currently running application process to obtain target data from the local file; and detecting whether the target function is called in the currently running program process based on the target data.

[0011] In one exemplary embodiment of this disclosure, the package information to be inspected includes the application package name of the package to be inspected; the step of obtaining the package information to be inspected, and if the package information to be inspected matches the information of a currently running application, then injecting the detection program file into the running program of the currently running application, includes: if there are multiple application package names that match the information of the currently running application, then injecting the detection program file into the running program of the currently running application corresponding to each application package name respectively. Each currently running application has an independent running process.

[0012] In one exemplary embodiment of this disclosure, injecting the detection program into the runtime of the currently running application corresponding to each application package name includes: marking the detection program file injected into the runtime of each currently running application.

[0013] In one exemplary embodiment of this disclosure, the step of running the detection program file and the currently running application in different processes, and detecting the calling behavior of the target function in the currently running application process by calling the running information of the running process of the detection program file, includes: each process running the detection program file and the corresponding currently running application respectively; if the target currently running application process is detected to have calling behavior of the target function, then a warning message carrying the detection program file marking information in the target currently running process is generated.

[0014] In one exemplary embodiment of this disclosure, the step of detecting the call behavior of the target function in the currently running application process by calling the running information of the detection program file includes: detecting and intercepting the call behavior of the target function in the currently running application; processing the privacy item data corresponding to the call behavior of the target function according to preset rules, and using the processed privacy item data as the call result; wherein the privacy item data before and after processing are stored accordingly.

[0015] In one exemplary embodiment of this disclosure, the method further includes: recording the running process of the currently running application and generating a detection result document of the currently running application based on the recording results; storing the detection result document, generating a document link and sending it back to the user so that the user can obtain the detection result document using the document link.

[0016] According to one aspect of this disclosure, an application detection apparatus is provided, the apparatus comprising: a file acquisition module, configured to add a hook function based on the Xposed framework to a target function to generate a detection program file; a file injection module, configured to acquire information of a package to be inspected, and if the information of the package to be inspected matches information of a currently running application, inject the detection program file into the running program of the currently running application; and a detection module, configured to run the detection program file and the currently running application in different processes respectively, and detect the calling behavior of the target function in the currently running application process by calling the running information of the running process of the detection program file.

[0017] According to one aspect of this disclosure, a computer storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the application detection method described in any of the preceding claims.

[0018] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the application detection method described in any one of the preceding claims by executing the executable instructions.

[0019] The application detection method in the exemplary embodiments of this disclosure utilizes the hook framework of Xposed running on the Android operating system to hook the target function that has the behavior of illegally obtaining user privacy, generate a detection program file, and inject the detection program file into the application of the currently running application when the information of the package to be detected matches the information of the currently running application. This allows the detection of the calling behavior of the target function in the process of the currently running application to be detected by running the detection program and the currently running application across processes. On the one hand, by generating a detection program file from the target function with added hook functions and injecting it into the running application, multiple target functions with privacy-related call behaviors can be detected simultaneously, improving detection efficiency. On the other hand, the detection program file and the running application are run in different processes. During the process, the call behavior of the target function is detected by calling the running information of the detection program file's running process, unaffected by the type of the currently running application. It is only necessary to ensure that the information of the package to be inspected matches the information of the currently running application. Thus, different types of applications can be detected based on the same detection program file. The detection program file is reusable, avoiding developers repeatedly modifying code for each application. Furthermore, it is suitable for application developers to use for application inspection before product launch. It can also be used independently by personnel without technical experience, such as application users, by inputting the information of the package to be inspected, to automatically execute the detection of illegal privacy-related call behaviors in the currently running application process, making it widely applicable.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0021] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0022] Figure 1 A flowchart of an application detection method according to an exemplary embodiment of the present disclosure is shown;

[0023] Figure 2 A schematic diagram illustrating user input of the application package name to be inspected according to an exemplary embodiment of the present disclosure is shown;

[0024] Figure 3 This illustration shows a schematic diagram of providing a user with a list of application package names to be inspected according to an exemplary embodiment of this disclosure;

[0025] Figure 4 A schematic diagram illustrating user input of multiple application package names to be inspected according to an exemplary embodiment of the present disclosure is shown;

[0026] Figure 5 A flowchart illustrating the detection of call behavior to a target function in a currently running application process by invoking runtime information of a running process of a detection program file, according to an exemplary embodiment of the present disclosure, is shown.

[0027] Figure 6 A schematic diagram of the structure of an application detection apparatus according to an exemplary embodiment of the present disclosure is shown;

[0028] Figure 7 A schematic diagram of a storage medium according to an exemplary embodiment of the present disclosure is shown; and

[0029] Figure 8 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown.

[0030] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0031] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore their detailed description will be omitted.

[0032] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details described, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known structures, methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, or in one or more software-hardened modules, or in different network and / or processor devices and / or microcontroller devices.

[0034] In accordance with the work plan for improving the conduct and rectifying malpractices in the information and communication industry, the Ministry of Industry and Information Technology has launched a special campaign to rectify APP (Application) infringements on user rights. Android applications that illegally obtain or exceed the scope of personal information from mobile phone users will be subject to strict investigation, warnings, and rectification notices. Failure to rectify within the specified timeframe will result in severe penalties such as public criticism and removal from app stores. Therefore, application development companies are required to test their applications before launch and complete modifications to comply with privacy policies. However, the Ministry of Industry and Information Technology has yet to provide an official testing solution.

[0035] In related technologies in this field, it is possible to avoid violations by having program developers check project code and repeatedly communicate the test results with the Ministry of Industry and Information Technology. However, manual search is cumbersome and prone to omissions when the project code is complex, resulting in low detection efficiency and accuracy. Currently, detection tools or plugins are developed for each application, but these are only applicable to specific applications. To detect multiple applications, the code needs to be modified and the tools or plugins recompiled, resulting in low reusability. Using third-party SDKs (Software Development Kits) for detection is also problematic because the code cannot be viewed or modified, leading to omissions and low detection accuracy. Furthermore, for people without technical experience, such as application users, it is impossible to detect applications running on Android devices, thus limiting the scope of application of the detection methods.

[0036] Based on this, in the exemplary embodiments of this disclosure, an application detection method is first provided, which can be applied to the detection of applications running on smart devices such as mobile phones and tablets with Android systems. (See references) Figure 1 As shown, the application detection method includes the following steps:

[0037] Step S110: Add a hook function based on the Xposed framework to the target function to generate the detection program file;

[0038] Step S120: Obtain the information of the package to be inspected. If the information of the package to be inspected matches the information of the currently running application, inject the detection program file into the running program of the currently running application.

[0039] Step S130: Run the detection program file and the currently running application in different processes respectively. By calling the running information of the running process of the detection program file, detect the calling behavior of the target function in the currently running application process.

[0040] According to the application detection method in this example embodiment, the target function with added hook functions is generated into a detection program file and injected into the running program of the currently running application. This can simultaneously detect multiple target functions with privacy-related call behaviors, improving detection efficiency. Different processes are used to run the detection program file and the currently running application separately. During this process, the call behavior of the target function is detected by calling the running information of the detection program file's running process, unaffected by the type of the currently running application. It only needs to ensure that the obtained package information to be inspected matches the information of the currently running application. Therefore, different types of applications can be detected based on the same detection program file. The detection program file is reusable, avoiding developers repeatedly modifying code for each application. It is suitable for application developers to use for application detection before product launch, and can also be used independently by personnel without technical experience, such as application users, by inputting the package information to be inspected, automatically executing the detection of illegal call behaviors in the currently running application process. Its application scope is wide.

[0041] The following is combined with Figure 1 The application detection method in the exemplary embodiments of this disclosure will be further described.

[0042] In step S110, a hook function based on the Xposed framework is added to the target function to generate a detection program file.

[0043] In the exemplary embodiments disclosed herein, the target function is a system function that obtains user privacy information, such as the user device identifier, MAC (Message Authentication Code), geolocation information, IMEI (International Mobile Equipment Identity), etc. The Xposed framework is an open-source framework service that runs in Android's high-privilege mode. It can affect program execution without modifying the APK (Android application package) file. Based on the Xposed framework, multiple functional modules can run simultaneously without functional conflicts. Based on this framework, by replacing critical components of the Android system (such as the system process zygote file), calls to arbitrary Java functions of the system can be intercepted. Hook functions intercept and monitor the transmission of events before they reach their destination, and can handle pre-defined specific events when an event is hooked. By adding hook functions to the target function, when the target function is called, because it has been hooked, the occurrence of the call behavior can be known before or after the call.

[0044] Specifically, this disclosure registers the target function to be hooked as a Native layer (local service layer) function based on the Xposed framework. Then, the `nativeFunc` property of the registered function is set to a native method implemented by the registered function itself. When the registered function is called, it will invoke this self-implemented native method, thus taking over control. Within the native method corresponding to this registered function, Xposed directly calls a Java method. This Java method calls the target function before registration and inserts hooks before and after the call, thereby hooking the target function.

[0045] Based on this exemplary embodiment, by adding various different target functions to hook functions based on the Xposed framework, a detection program file with multiple target function detection functions is generated, which can simultaneously detect multiple illegal call behaviors of running applications, thereby improving the application detection efficiency.

[0046] In the exemplary embodiments disclosed herein, before adding an Xposed framework-based hook function to the target function to obtain the detection program file, it is necessary to obtain the highest root (superuser) privileges of the Android system to fully control the system's underlying layers and system files. Further, an Xposed module is installed, and the system process zygote file in the Android system is replaced by the Xposed module. Specifically, the system process zygote is the core of Android. For each app running in the Android system, zygote forks a virtual machine instance to run the app. After installing the Xposed framework in the Android system, the framework uses its own implemented app_process to overwrite the native Android app_process file. When the system starts, the process file replaced by the Xposed framework is loaded. Based on this, the replaced app_process first launches the module and then enters the zygote process. Since apps are all created by zygote, the hook based on the Xposed module is global, thereby achieving control over the running processes of all apps on devices with the Android system installed.

[0047] It should be noted that the detection program file obtained by the exemplary embodiments of this disclosure, as a tool with functions for detecting illegal call behavior, can be installed on smart devices with an Android system. At the same time, the Xposed module and the application to be detected also need to be installed on the smart device to further perform application detection.

[0048] In step S120, the information of the package to be inspected is obtained. If the information of the package to be inspected matches the information of the currently running application, the detection program file is injected into the running program of the currently running application.

[0049] In the exemplary embodiments of this disclosure, the information of the package to be tested includes unique identification information such as the application package name and application identifier of the package to be tested, used to identify the application to be tested; optionally, the information of the package to be tested, which needs to be tested, can be manually entered by the user, see [link to relevant documentation]. Figure 2 As shown, the user inputs the application package name to be tested as "com.netesase.cc"; optionally, in response to the user's application testing trigger operation command, a list of packages to be tested can be provided to the user, allowing the user to select the package information to be tested, see [link to relevant documentation]. Figure 3 As shown, a list of application package names to be detected is provided to the user for selection. The currently running application information includes the application package name, application type, identifier, and running data of the currently running application. By installing and running the application to be detected on the smart device, the above-mentioned current application running information can be obtained.

[0050] Furthermore, the information in the package to be inspected is matched with the information of the currently running application. If a match is found, the detection program file is injected into the running program of the currently running application. Specifically, firstly, the target application process, i.e., the currently running application process, is determined based on the matching result between the information in the package to be inspected and the information of the currently running application; secondly, the target function corresponding to the .so library (shared library file) of the currently running application is loaded, thereby allowing the execution flow of the currently running application process to jump to the code execution of the injected detection program file.

[0051] Based on this exemplary embodiment, the information of the package to be inspected input or selected by the user is matched with the information of the currently running application. If the matching result is determined, the detection program file is injected into the running program of the currently running application so that the calling behavior of multiple target functions can be detected simultaneously during the running process of the currently running program, resulting in high detection efficiency.

[0052] In the exemplary embodiments of this disclosure, the execution information of the detection program file's running process is stored in a local file. For example, the execution information of the detection program file's running process can be directly stored on a smart device (such as a mobile phone). Before matching the information of the package to be inspected with the information of the currently running application, the method further includes: injecting an Xposed file into the currently running application process. The execution of the Xposed file depends on the detection program file, and the detection program file is referenced by running the Xposed file to obtain the information of the package to be inspected stored in the local file. In other words, the execution information of the detection program file is stored on the smart device. When the execution code of the Xposed file injected into the current application process is run, the code in the detection program file needs to be referenced, and data, including the information of the package to be inspected, is obtained from the local file by running the code in the detection program file.

[0053] According to this exemplary embodiment, the running information of the detection program file can be stored in a local file through cross-process running and storage. During the running of the currently running application process, the running information of the detection program file process in the local file can be called to obtain the information of the package to be inspected. Furthermore, different processes can be used to detect different running applications, which is not limited to the type of the currently running application and improves the universality of application detection.

[0054] In an exemplary embodiment of this disclosure, if there are multiple application package names that match the information of the currently running application, the detection program file is injected into the running program of the currently running application corresponding to each application package name, wherein each currently running application has an independent running process.

[0055] Specifically, Figure 4 An example diagram is shown illustrating user input of multiple application package names to be detected according to an exemplary embodiment of this disclosure, wherein each application package name can be distinguished by spaces, separators, etc., such as Figure 4 The names com.netease.cc and com.taotao.taotao are separated by the '&' separator. When the user enters multiple application package names, each application package name is matched with the running information of the currently running application. If at least two application package names match the information of the currently running application, meaning that at least two currently running applications need to be detected simultaneously, then each currently running application is run in an independent process for detection.

[0056] Furthermore, the exemplary embodiments of this disclosure can separately label the detection program files injected into the running program of each currently running application. Optionally, package information, such as a package name, can be carried for each detection program file injected into the currently running application; alternatively, a unique identifier, such as a number, a character, or a combination of numbers and characters, can be assigned to each detection program file injected into the currently running application. Based on this, the labeling information is also carried in the detection results during the execution of each currently running application process to distinguish the detection results of each currently running application.

[0057] Furthermore, if a call to the target function is detected by the target's currently running application process, a warning message is generated carrying the detection program file marker information of the target's currently running application process to indicate that the target's currently running application has engaged in unauthorized call behavior.

[0058] In step S130, different processes are used to run the detection program file and the currently running application respectively. By calling the running information of the running process of the detection program file, the calling behavior of the target function in the currently running application process is detected.

[0059] In this exemplary embodiment, different processes run the detection program file and the currently running file respectively, and the runtime data of the detection program file is stored in a local file. During the execution of the currently running application process, the injected detection program file is run, causing the currently running application process to obtain target data from the local file. Based on the target data, the system detects whether there is a call to a target function in the currently running application process. The target data includes, but is not limited to, the application package name, the call information of the target function with the added hook function based on the Xposed framework, and the detection result information such as whether a prompt is triggered.

[0060] In exemplary embodiments of this disclosure, see Figure 5 As shown, detecting the call behavior of the target function in the currently running application process by calling the runtime information of the detection program file can include the following steps:

[0061] In step S510, a call to the target function is detected and intercepted within the currently running application. In this exemplary embodiment, if a call to the target function exists, the call is intercepted. In step S520, the privacy data corresponding to the call to the target function is processed according to preset rules, and the processed privacy data is used as the call result. In this exemplary embodiment, when a call to the target function exists within the currently running application, the privacy data corresponding to the call is processed through deception, forgery, or other means to hide data that could easily expose user privacy information, thereby preventing the leakage of the user's real privacy information without affecting the normal operation of the application. Furthermore, the privacy data before and after processing can be stored accordingly for subsequent verification and correction of the call behavior.

[0062] In an exemplary embodiment of this disclosure, the running process of the currently running application can also be recorded, and a detection result document of the currently running application can be generated based on the recording results. The detection result document is stored, a document link is generated and fed back to the user, so that the user can obtain the detection result document using the document link, thereby making the application detection traceable.

[0063] According to the application detection method in this example embodiment, the target function with added hook functions is generated into a detection program file and injected into the running program of the currently running application. This can simultaneously detect multiple target functions with privacy-related call behaviors, improving detection efficiency. Different processes are used to run the detection program file and the currently running application separately. During this process, the call behavior of the target function is detected by calling the running information of the detection program file's running process, unaffected by the type of the currently running application. It only needs to ensure that the obtained package information to be inspected matches the information of the currently running application. Therefore, different types of applications can be detected based on the same detection program file. The detection program file is reusable, avoiding developers repeatedly modifying code for each application. It is suitable for application developers to use for application detection before product launch, and can also be used independently by personnel without technical experience, such as application users, by inputting the package information to be inspected, automatically executing the detection of illegal call behaviors in the currently running application process. Its application scope is wide.

[0064] In an exemplary embodiment of this disclosure, an application detection device is also provided. (See reference...) Figure 6 As shown, the application detection device 600 may include a file acquisition module 610, a file injection module 620, and a detection module 630. Specifically,

[0065] The file acquisition module 610 is used to add hook functions based on the Xposed framework to the target function and generate a detection program file;

[0066] The file injection module 620 is used to obtain the information of the package to be inspected. If the information of the package to be inspected matches the information of the currently running application, the detection program file is injected into the running program of the currently running application.

[0067] The detection module 630 is used to run the detection program file and the currently running application in different processes, and detect the calling behavior of the target function in the currently running application process by calling the running information of the running process of the detection program file.

[0068] Since the functional modules of the application detection apparatus in the exemplary embodiments of this disclosure are the same as those in the inventive embodiments of the application detection method described above, they will not be described again here.

[0069] It should be noted that although several modules or units of the application detection device have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0070] Furthermore, in exemplary embodiments of this disclosure, a computer storage medium capable of implementing the above-described methods is also provided. A program product capable of implementing the methods described in this specification is stored thereon. In some possible embodiments, various aspects of this disclosure can also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0071] refer to Figure 7 As shown, a program product 700 for implementing the above-described method according to an exemplary embodiment of the present disclosure is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0072] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0073] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0074] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0075] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0076] Furthermore, in exemplary embodiments of this disclosure, an electronic device capable of implementing the above-described methods is also provided. Those skilled in the art will understand that various aspects of this disclosure can be implemented as systems, methods, or program products. Therefore, various aspects of this disclosure can be specifically implemented as entirely hardware embodiments, entirely software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, collectively referred to herein as "circuit," "module," or "system."

[0077] The following reference Figure 8 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0078] like Figure 8 As shown, the electronic device 800 is presented in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including storage unit 820 and processing unit 810), and a display unit 840.

[0079] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this disclosure.

[0080] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 821 and / or cache memory 822, and may further include a read-only memory (ROM) 823.

[0081] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0082] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0083] Electronic device 800 can also communicate with one or more external devices 900 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0084] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0085] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0086] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0087] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. An application detection method, characterized in that, include: Add an Xposed framework-based hook function to the target function to generate the detection program file; The running information of the detection program file is stored in a local file; Obtain the information of the package to be inspected. If the information of the package to be inspected matches the information of the currently running application, inject the detection program file into the running program of the currently running application. The target function corresponding to the shared library file of the currently running application is loaded. The information of the package to be inspected includes the application package name of the package to be inspected. If there are multiple application package names that match the information of the currently running application, inject the detection program file into the running program of the currently running application corresponding to each application package name, and mark the detection program file injected into the running program of each currently running application. The detection program file and the currently running application are run in different processes. By calling the running information of the running process of the detection program file, the calling behavior of the target function in the currently running application process is detected. Each current application has an independent running process. Before matching the information of the package to be inspected with the information of the currently running application, the method further includes: An Xposed file is injected into the currently running application process, and the execution of the Xposed file depends on the detection program file. By running the Xposed file to reference the detection program file, the information of the package to be inspected stored in the local file is obtained; The step of detecting the call behavior of the target function in the currently running application process by calling the running information of the detection program file includes: Detect and intercept calls to the target function from the currently running application; The privacy data corresponding to the call behavior of the target function is processed according to preset rules, and the processed privacy data is used as the call result.

2. The method according to claim 1, characterized in that, Before adding an Xposed framework-based hook function to the target function and generating the detection program file, the method further includes: Obtain root privileges on an Android system; Install the Xposed module and replace the zygote system process file in the Android system with the Xposed module.

3. The method according to claim 1, characterized in that, The method of running the detection program file and the currently running application in different processes, and detecting the call behavior of the target function in the currently running application process by calling the running information of the detection program file's running process, includes: The detection program file injected into the running program of the currently running application is executed, causing the currently running application process to obtain target data from the local file; Based on the target data, detect whether the target function is called in the currently running application process.

4. The method according to claim 1, characterized in that, The method of running the detection program file and the currently running application in different processes, and detecting the call behavior of the target function in the currently running application process by calling the running information of the detection program file's running process, includes: Each process runs the detection program file and the corresponding currently running application respectively; If a call to a target function is detected in the target's currently running application process, an early warning message is generated carrying the detection program file marker information of the target's currently running application process.

5. The method according to claim 1, characterized in that, The privacy data before and after processing are stored accordingly.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: The running process of the currently running application is recorded, and a detection result document of the currently running application is generated based on the recording results; The detection result document is stored, a document link is generated and sent back to the user so that the user can access the detection result document using the document link.

7. An application detection device, characterized in that, The device includes: The file acquisition module is used to add hook functions based on the Xposed framework to the target function to generate a detection program file; the running information of the running process of the detection program file is stored in a local file. The file injection module is used to obtain the information of the package to be inspected. If the information of the package to be inspected matches the information of the currently running application, the detection program file is injected into the running program of the currently running application. The target function of the shared library file corresponding to the currently running application is loaded. The information of the package to be inspected includes the application package name of the package to be inspected. If there are multiple application package names that match the information of the currently running application, the detection program file is injected into the running program of the currently running application corresponding to each application package name, and the detection program file injected into the running program of each currently running application is marked. The detection module is used to run the detection program file and the currently running application in different processes, and to detect the calling behavior of the target function in the currently running application process by calling the running information of the running process of the detection program file. The file injection module is configured to execute: Before matching the information of the package to be inspected with the information of the currently running application, an Xposed file is injected into the process of the currently running application. The execution of the Xposed file depends on the detection program file. By running the Xposed file to reference the detection program file, the information of the package to be inspected stored in the local file is obtained; The detection module is configured to perform: Detect and intercept calls to the target function from the currently running application; The privacy data corresponding to the call behavior of the target function is processed according to preset rules, and the processed privacy data is used as the call result.

8. A storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the application detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the application detection method of any one of claims 1 to 6 by executing the executable instructions.

Images