Interface information extraction method, device, electronic device and storage medium

Abstract

The present disclosure provides an interface information extraction method, device, electronic device and storage medium, which relate to the field of computer technology, and in particular to the field of system service technology. The specific implementation scheme is: using a hook function to obtain the write function and inter-process call function when the target application calls the system service; from the obtained write function and inter-process call function, filter out the target write function and target inter-process call function for the target system service; according to the parameter type of each filtered target write function and the order in which each target write function is called, determine the parameter serialization method information; extract the identifier of the inter-process call function from the filtered target inter-process call function. This method can be used to obtain complete interface information.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of system service technology. Background Art

[0002] The terminal's system services provide system control capabilities for applications installed in the terminal. At the same time, system services are also an important target for attackers. Currently, dynamic vulnerability mining methods such as fuzz testing can be used to comprehensively and efficiently mine system service vulnerabilities. Among them, fuzz testing is a method of discovering vulnerabilities by providing unexpected inputs to system services and monitoring abnormal results. Summary of the invention

[0003] The present disclosure provides an interface information extraction method, device, electronic device and storage medium.

[0004] According to a first aspect of the present disclosure, there is provided a method for extracting interface information, comprising:

[0005] Use the hook function to obtain the write function and inter-process call function when the target application calls the system service;

[0006] Filter out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions;

[0007] Determine parameter serialization mode information according to the selected parameter types of each target write function and the order in which each target write function is called;

[0008] The identifier of the inter-process calling function is extracted from the filtered target inter-process calling functions.

[0009] According to a second aspect of the present disclosure, there is provided an interface information extraction device, comprising:

[0010] The first acquisition module is used to use the hook function to acquire the write function and the inter-process call function when the target application calls the system service;

[0011] A screening module is used to screen out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions;

[0012] A first determination module is used to determine parameter serialization mode information according to the parameter types of each screened target writing function and the order in which each target writing function is called;

[0013] The extraction module is used to extract the identifier of the inter-process calling function from the filtered target inter-process calling functions.

[0014] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect above.

[0018] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect above.

[0019] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program implements the method described in the first aspect when executed by a processor.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0022] Figure 1 is a flow chart of an interface information extraction method provided by an embodiment of the present disclosure;

[0023] Figure 2 is a flow chart of another method for extracting interface information provided by an embodiment of the present disclosure;

[0024] Figure 3 is a flow chart of another method for extracting interface information provided by an embodiment of the present disclosure;

[0025] Figure 4 is a flow chart of another method for extracting interface information provided by an embodiment of the present disclosure;

[0026] Figure 5 is an exemplary flow chart of an interface information extraction method provided by an embodiment of the present disclosure;

[0027] Figure 6 is a structural schematic diagram of another interface information extraction device provided by an embodiment of the present disclosure;

[0028] Figure 7 The block diagram is a block diagram of an electronic device used to implement the interface information extraction method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0030] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0031] To facilitate understanding, relevant concepts involved in the present disclosure are first introduced.

[0032] IBinder is an inter-process communication interface in the Android system. The communication between applications and system services is implemented through the transact() function of the IBinder interface.

[0033] When an application communicates with a system service across processes, the data to be transmitted can be packaged in a Parcel object and then delivered through the binder driver.

[0034] In the disclosed embodiment, for one system call, the Parcel object can be shared by the Parcel.write function and the IBinder.transact function.

[0035] The Parcel.write function may be referred to as a write function in the embodiments of the present disclosure. The Parcel.write function may include various types of write functions such as a writeInterfaceToken function, a writeInt function, and a writeString function. Among them, writeInterfaceToken is a write tag function, and the parameter included in writeInterfaceToken is a descriptor of a system service. The writeInt function is used to write a parameter of the Int type, and the writeString function is used to write a parameter of the String type. The IBinder.transact function is an inter-process call function, and the parameter of the IBinder.transact function is a transaction identifier (transact ID).

[0036] In the related art, the interface information of the system service can be extracted, and the interface information includes the transact ID required to call the target system service interface, the descriptor of the target system service, and the parameter serialization method. Test data can be constructed based on the extracted interface information and sent to the system service to test whether the system service has vulnerabilities.

[0037] Currently, you can obtain the IBinder interface of the system service through the system service manager (ServiceManager), and then call the interface descriptor acquisition function (getInterfaceDescriptor) of IBinder to obtain the descriptor of the system service that needs to be tested for vulnerabilities. After obtaining the descriptor of the system service, you can use Java reflection technology to reflect the stub class based on the descriptor to obtain the transact ID of the transact function that calls the system service, as well as the interface parameter type of the system service interface.

[0038] However, in order to construct test data, parameter serialization method information is also required. The parameter serialization method refers to the transmission order of various types of parameters transmitted when calling system services. For system service interfaces that include object type parameters, Java reflection technology is used to obtain the system service code through the system service interface, and the parameter type transmitted by the system service interface is obtained by parsing the system service code. However, for object type parameters, it can only be identified that the type of the parameter is an object type, and the serialization method information of the object type parameter cannot be obtained, resulting in incomplete interface information obtained.

[0039] In order to obtain complete system service interface information, the embodiments of the present disclosure provide an interface information extraction method, device, electronic device and storage medium.

[0040] The interface information extraction method provided in the embodiment of the present disclosure can be executed by an electronic device, and the electronic device can be a smart phone, a tablet computer, a desktop computer, a wearable device, etc.

[0041] The following is a detailed introduction to the interface information extraction method provided by the embodiment of the present disclosure.

[0042] like Figure 1 As shown, the embodiment of the present disclosure provides an interface information extraction method, the method comprising:

[0043] S101. Use a hook function to obtain a write function and an inter-process call function when a target application calls a system service.

[0044] System services are services in the Android system that provide various control capabilities for applications, such as notification management service NotifacationManager, vibration management service Vibrator, battery management service BatteryManager, etc.

[0045] An application can implement various functions by calling these system services. For example, an application can make the electronic device on which the application is installed vibrate by calling the vibration management service Vibrator.

[0046] The hook function is the hook function, and the write function is the Parcel.write function introduced above, for example, the Parecel.writeInt function, the Parecel.writeString function, and the parcel.writeInterfaceToken (write interface token) function.

[0047] The inter-process calling function is the IBinder.transact function introduced above, which will not be repeated here.

[0048] In one implementation, a technician can pre-write a hook script, and specify the write function and inter-process call function that need to be obtained for calling system services through the hook script. When the application is running, the write function and inter-process call function when the target application actually calls the system service can be obtained through the hook script. Optionally, the obtained write function and inter-process call function can be saved in a log file.

[0049] S102: Filter out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions.

[0050] In the disclosed embodiment, the target application will call multiple system services during runtime, including the target system service, so the electronic device can use the hook function to obtain the write functions and inter-process call functions of all system services called by the target application, and then filter out the target write functions and target inter-process call functions from the obtained write functions and inter-process call functions.

[0051] S103: Determine parameter serialization mode information according to the selected parameter types of each target writing function and the order in which each target writing function is called.

[0052] In the embodiment of the present disclosure, the parameter type of the target write function may include basic type parameters and / or object type parameters. For example, the basic type parameters may be int type and string type parameters, and the object type parameters may include multiple basic type parameters.

[0053] The parameter serialization method information includes the parameter type and transmission order of each parameter transmitted by the application to the system service when the application calls the system service.

[0054] S104: extracting the identifier of the inter-process calling function from the screened target inter-process calling functions.

[0055] In the disclosed embodiment, the inter-process calling function is the IBinder.transact function, and the parameter of the IBinder.transact function is the TransactID, which can be captured by the hook function.

[0056] By adopting this method, a hook function can be used to obtain all write functions and inter-process call functions of the system service called by the target application, and the target write function and target inter-process call function of the target system service can be screened out. Because the real parameters of each target write function can be obtained through the hook function, even if the object type parameter is included, the serialization method information of the object type parameter can be obtained by parsing the object type parameter, and the identifier of the inter-process call function can also be extracted from the target process function, so the embodiment of the present disclosure can obtain complete interface information.

[0057] In another embodiment of the present disclosure, Figure 2 As shown, before S101, the method further includes:

[0058] S201. Use a hook function to obtain system service acquisition functions of multiple applications.

[0059] The above-mentioned multiple application programs may be all application programs installed in the electronic device, or may be application programs downloaded by the tester from the application market that may call the target system service.

[0060] The system service acquisition function is the getSystemService function, which is used by an application to request system services.

[0061] The electronic device can use the hook function to obtain the getSystemService functions of multiple applications.

[0062] S202: For each system service acquisition function, if the name of the system service requested by the system service acquisition function is consistent with the service name of the target system service, then determine that the application to which the system service acquisition function belongs is the target application.

[0063] For example, the target system service name is the power management service PowerManager. The electronic device can obtain the system service name requested in the getSystemService function of each application. When the system service name requested in the getSystemService function corresponding to a certain application is the power management service PowerManager, the application is determined to be the target application.

[0064] By adopting this method, the target application that calls the target system service can be accurately and quickly screened out by comparing whether the system service name requested by the application's system service acquisition function is consistent with the target system service name, avoiding subsequent acquisition of functions of applications that do not call the target system service, and improving the efficiency of obtaining interface information.

[0065] In another embodiment of the present disclosure, Figure 3 As shown, based on the above embodiment, S102 can be specifically implemented as follows:

[0066] S1021. Search, from the acquired write functions, for a write interface tag function that takes the descriptor of the target system service as a parameter.

[0067] In the embodiment of the present disclosure, the write interface token function is the writeInterfaceToken function, and the descriptor of the target system service is the parameter of the writeInterfaceToken function in the target system service. The descriptor of each system service is different, that is, the descriptor can be used as a unique identifier of the system service.

[0068] In this step, by searching for the writeInterfaceToken function that takes the descriptor of the target system service as a parameter, you can obtain the writeInterfaceToken function that calls the target system service.

[0069] S1022. Obtain the target parcel object of the write interface marking function.

[0070] It can be understood that the electronic device can obtain the target parcel object of the writeInterToken function in the target service system interface, which is equivalent to obtaining the carrier for parameter transfer between the target application and the target service system.

[0071] S1023. Filter out the target write function and target inter-process call function belonging to the target parcel object from the acquired write functions and inter-process call functions.

[0072] Since the writeInterfaceToken function for calling the target system service has been obtained through the above S1021, and since the Parcel object can be shared by the Parcel.write function and the IBinder.transact function in one system call, the writeInterfaceToken function is also a Parcel.write function. Therefore, the target parcel object of the writeInterfaceToken function can be used as an identifier to filter out the write functions and inter-process call functions belonging to the target parcel object. The filtered functions are the target write functions and target inter-process call functions that call the target system service.

[0073] In the disclosed embodiment, the target application not only calls the target system service, but also calls other system services, so the acquired write function and inter-process calling function include the target write function and target inter-process calling function, and the target parcel object is a carrier for transferring parameters between the target application and the target system service, so the electronic device can filter out the target write function and target inter-process calling function that call the target system service based on the target parcel object in the acquired write function and process calling function, and then can accurately and completely obtain the interface information when calling the target system service, providing data support for subsequent fuzzy testing of the target system service.

[0074] In another embodiment of the present disclosure, Figure 4 As shown, based on the above embodiment, S103 can be implemented as follows:

[0075] S1031. Obtain the acquisition order of each target write function belonging to the target parcel object, and the parameter type of each target write function.

[0076] For example, the write functions included in the target parcel object are writeInt, writeString, and o.writeToParcel, where "o" represents a parameter of the object type. It can be determined that the parameters of the Int, String, and object types need to be transmitted in sequence.

[0077] S1032: If the parameter type of the target write function is an object type, parse the parameter type and order of each parameter included in the object type parameter of the target write function.

[0078] Assuming that the member variables of the above object type parameter include writeInt and writeByte, it can be determined that the object type parameter includes parameters of Int and Byte types in sequence.

[0079] S1033. The acquisition order and parameter types of each target write function included in the target parcel object, as well as the parameter type and order of each parameter included in the object type parameter, are used as parameter serialization method information.

[0080] Combining the examples in S1031 and S1032 above, we can get the parameter serialization method: Int-String-Int-Byte. That is, the int type parameter is written first in the interface, then the String type parameter is written, and then the object type parameter is written. When writing the object type parameter, the int type parameter is written first, and then the Byte type parameter is written.

[0081] By adopting this method, the electronic device can use the hook function to obtain the parameter type and the order of calling of each target write function, and can parse the object type parameter to obtain the type and order of each parameter included in the object type parameter, and thus obtain the parameter serialization method information of the target service system interface, and further, obtain the complete interface information of the target system service.

[0082] See also Figure 5 , Figure 5 An exemplary flow chart of an interface information extraction method provided in an embodiment of the present disclosure is shown below in conjunction with Figure 5 Provide explanation.

[0083] S501. The electronic device uses a hook function to filter target applications.

[0084] In the disclosed embodiment, a technician may download the application program in advance, and then use the hook function to filter the target application program that calls the target system service.

[0085] S502: Obtain the Hook script of the target application.

[0086] The Hook script can be written by a technician, and the Hook script collects the write function and the transact function of the Parcel class required to call the target application.

[0087] S503: Run the target application.

[0088] When the target application runs, it calls multiple system services, including the target system service.

[0089] S504: Run the hook script to capture the write function and the transact function when the application calls the system service.

[0090] S505. Record the caller address of writeInterfaceToken with the DESCRIPTOR of the target system service as a parameter.

[0091] The caller address is the address of the parcel object.

[0092] S506: Filter out the write function and the transact function that call the target system service according to the caller address.

[0093] S507. Obtain TransactID and parameter serialization method information according to the filtered write function and transact function.

[0094] By adopting this method, since the hook script can collect the type and order of the write function of the parcel class of the target system service called by the target application during actual operation, the parameter serialization method can be obtained. Therefore, compared with the prior art, the embodiment of the present disclosure can obtain complete interface information.

[0095] Corresponding to the above method embodiment, the present disclosure embodiment also provides an interface information extraction device, such as Figure 6 As shown, the device comprises:

[0096] The first acquisition module 601 is used to use the hook function to acquire the write function and the inter-process call function when the target application calls the system service;

[0097] A screening module 602 is used to screen out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions;

[0098] A first determination module 603 is used to determine parameter serialization mode information according to the selected parameter types of each target writing function and the order in which each target writing function is called;

[0099] The extraction module 604 is used to extract the identifier of the inter-process calling function from the filtered target inter-process calling functions.

[0100] In another embodiment of the present disclosure, the screening module 602 is specifically used to:

[0101] From the obtained write functions, find the write interface tag function that takes the descriptor of the target system service as a parameter;

[0102] Get the target parcel object of the write interface marker function;

[0103] From the acquired write functions and inter-process call functions, filter out the target write functions and target inter-process call functions belonging to the target parcel object.

[0104] In another implementation of the present disclosure, the first determining module 603 is specifically configured to:

[0105] Get the acquisition order of each target write function belonging to the target parcel object, as well as the parameter type of each target write function;

[0106] If there is a target write function whose parameter type is an object type, then the parameter type and order of each parameter included in the object type parameter of the target write function are parsed;

[0107] The acquisition order and parameter types of each target write function included in the target parcel object, as well as the parameter type and order of each parameter included in the object type parameter, are used as parameter serialization method information.

[0108] In another embodiment of the present disclosure, the device further includes:

[0109] A second acquisition module is used to acquire system service acquisition functions of multiple applications using a hook function;

[0110] The second determination module is used for determining, for each system service acquisition function, if the name of the system service requested by the system service acquisition function is consistent with the service name of the target system service, that the application to which the system service acquisition function belongs is the target application.

[0111] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0112] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0113] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0114] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0115] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the interface information extraction method. For example, in some embodiments, the interface information extraction method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the interface information extraction method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the interface information extraction method by any other appropriate means (e.g., by means of firmware).

[0116] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0118] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0120] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0121] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0122] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0123] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for extracting interface information, comprising: Use the hook function to obtain the write function and inter-process call function when the target application calls the system service; Filter out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions; Determine parameter serialization mode information according to the selected parameter types of each target write function and the order in which each target write function is called; Extracting the identifier of the inter-process calling function from the filtered target inter-process calling functions; Before using the hook function to obtain the write function and the inter-process call function when the target application calls the system service, the method further includes: Use hook functions to obtain system service acquisition functions for multiple applications; For each system service acquisition function, if the name of the system service requested by the system service acquisition function is consistent with the service name of the target system service, the application to which the system service acquisition function belongs is determined to be the target application.

2. The method according to claim 1, wherein: The step of screening out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions includes: From the obtained write functions, find the write interface tag function that takes the descriptor of the target system service as a parameter; Get the target packaged parcel object of the write interface marking function; From the acquired write functions and inter-process call functions, filter out the target write functions and target inter-process call functions belonging to the target parcel object.

3. The method according to claim 2, wherein: Determining parameter serialization mode information according to the selected parameter types of each target write function and the order in which each target write function is called includes: Get the acquisition order of each target write function belonging to the target parcel object, and the parameter type of each target write function; If there is a target write function whose parameter type is an object type, then the parameter type and order of each parameter included in the object type parameter of the target write function are parsed; The acquisition order and parameter types of each target write function included in the target parcel object, as well as the parameter type and order of each parameter included in the object type parameter, are used as the parameter serialization method information.

4. An interface information extraction device, comprising: The first acquisition module is used to use the hook function to acquire the write function and the inter-process call function when the target application calls the system service; A screening module is used to screen out target write functions and target inter-process call functions for target system services from the acquired write functions and inter-process call functions; A first determination module is used to determine parameter serialization mode information according to the parameter types of each screened target writing function and the order in which each target writing function is called; An extraction module is used to extract the identifier of the inter-process calling function from the filtered target inter-process calling functions; The device also includes: A second acquisition module is used to acquire system service acquisition functions of multiple applications using a hook function; The second determination module is used for determining, for each system service acquisition function, if the name of the system service requested by the system service acquisition function is consistent with the service name of the target system service, that the application to which the system service acquisition function belongs is the target application.

5. The device according to claim 4, wherein: The screening module is specifically used for: From the obtained write functions, find the write interface tag function that takes the descriptor of the target system service as a parameter; Get the target packaged parcel object of the write interface marking function; From the acquired write functions and inter-process call functions, filter out the target write functions and target inter-process call functions belonging to the target parcel object.

6. The device according to claim 5, wherein: The first determining module is specifically configured to: Get the acquisition order of each target write function belonging to the target parcel object, and the parameter type of each target write function; If there is a target write function whose parameter type is an object type, then the parameter type and order of each parameter included in the object type parameter of the target write function are parsed; The acquisition order and parameter types of each target write function included in the target parcel object, as well as the parameter type and order of each parameter included in the object type parameter, are used as the parameter serialization method information.

7. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 3.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-3.

9. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 3.

Images