A data capture method, device, equipment and storage medium

Abstract

The present application relates to the field of data processing, and more particularly to a data capture method, device, equipment and storage medium for simplifying the packet capture process. In the present application, a first startup entry of a target application can be obtained. A subprocess of the main process of the packet capture application is created. According to the first startup entry, the target application is started in the subprocess of the packet capture application. The message transmitted by the target application running in the subprocess is obtained through the packet capture application. Since the target application is started in the subprocess of the packet capture application, the packet capture application has the highest authority over the target application, so the packet capture application can capture the message transmitted by the target application based on the highest authority obtained. It can be seen that in this scheme, the data of the target application can be captured without using a laptop computer, and the process is relatively simple.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data processing, and in particular to a data capture method, device, equipment and storage medium. Background Art

[0002] When the application is developed, it is usually necessary to test the application to ensure that it is normal and available. When testing the application, the communication needs to capture the messages transmitted by the application for analysis.

[0003] There is currently a solution for capturing messages transmitted by applications. This solution requires installing a hypertext transfer protocol (HTP) proxy software on a laptop and setting a proxy port (such as 8888). The mobile phone to be tested and the laptop are then connected to the same local area network, and the Internet Protocol (IP) address of the proxy server is set on the mobile phone to the IP address of the laptop, and the proxy port is set to the port set in the laptop (such as 8888). After that, it is necessary to download the certificate from the proxy software of the laptop and install the certificate in the mobile phone. Finally, run the target application that needs to be captured. At this time, if the target application does not perform HTTPs certificate verification, the HTTP message can be captured in the proxy software.

[0004] It can be seen from the above scheme that in the current scheme, the laptop is connected to the same network as the mobile phone and uses proxy software to capture packets, which is a cumbersome, time-consuming and labor-intensive process. Summary of the invention

[0005] The embodiments of the present application provide a data capture method, device, equipment and storage medium for simplifying the packet capture process.

[0006] On the one hand, an embodiment of the present application provides a data capture method, the method comprising: obtaining a first startup entry of a target application, creating a subprocess of a main process of a packet capture application, starting the target application in the subprocess of the packet capture application according to the first startup entry, and obtaining a message transmitted by the target application running in the subprocess through the packet capture application.

[0007] Since the target application is started in the subprocess of the packet capture application, the packet capture application has the highest authority over the target application, so the packet capture application can capture the messages transmitted by the target application based on the highest authority obtained. It can be seen that in this solution, the data of the target application can be captured without using a laptop, and the process is relatively simple.

[0008] In a possible implementation, starting the target application in a subprocess of the packet capture application according to the first startup entry includes:

[0009] Hijack the local proxy interface of the target application's system end on the client;

[0010] Based on the hijacked local proxy interface and the first startup entry, the target application is started in the subprocess of the packet capture application.

[0011] In a possible implementation, based on the hijacked local proxy interface and the first startup entry, starting the target application in the subprocess of the packet capture application includes:

[0012] Obtain the second startup entry configured in the manifest file of the packet capture application;

[0013] Requesting the system to start a second startup entry in the subprocess of the packet capture application;

[0014] After the system-side verification is passed, the first startup entry of the target application is started in the subprocess of the packet capture application.

[0015] In a possible implementation, requesting the system end to start the second start entry in the subprocess of the packet capture application includes:

[0016] Send a second system call request to the system end through the hijacked local proxy interface;

[0017] The second system call request is used to request to start a second startup entry in the packet capture application.

[0018] In a possible implementation, after the system end verifies, starting the first startup entry of the target application in the subprocess of the packet capture application includes:

[0019] Receiving a second system verification pass message returned by the system end through the hijacked local proxy interface, wherein the second system verification pass message indicates that the system end is allowed to start the second startup entry in the packet capture application;

[0020] Through the hijacked local proxy interface, based on the received second system verification pass message, a first system verification pass message is sent to the client of the target application, and the first system verification pass message indicates that the system end allows the first startup entry to be started in the packet capture application.

[0021] In a possible implementation, before sending the first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, the method further includes:

[0022] Sending a first system call request to the local proxy interface through a client of the target application;

[0023] The first system call request is used to request to start a first start entry in the packet capture application.

[0024] In a possible implementation, obtaining a message transmitted by a target application running in a child process by using a packet capture application includes:

[0025] A first HTTP message sent by a client of a target application to a system end is captured at a Hypertext Transfer Protocol (HTTP) layer; and / or a second HTTP message sent by a system end to a client of a target application is captured at a HTTP layer.

[0026] In a possible implementation, capturing at the HTTP layer a first HTTP message sent by a client of a target application to a system end; and / or capturing at the HTTP layer a second HTTP message sent by a system end of a target application to a client end includes:

[0027] Hijack the system's HTTP module;

[0028] Based on the hijacked HTTP module, the first HTTP message and / or the second HTTP message is captured.

[0029] In a possible implementation, obtaining startup information of a target application includes:

[0030] Get the manifest file of the target application;

[0031] Obtain the first startup entry of the target application from the manifest file of the target application.

[0032] On the one hand, an embodiment of the present application provides a data capture device, which includes a processing module and a packet capture module. The processing module is used to obtain a first startup entry of a target application, create a subprocess of a main process of the packet capture application, and start the target application in the subprocess of the packet capture application according to the first startup entry. The packet capture module is used to obtain messages transmitted by the target application running in the subprocess through the packet capture application.

[0033] Since the target application is started in the subprocess of the packet capture application, the packet capture application has the highest authority over the target application, so the packet capture application can capture the messages transmitted by the target application based on the highest authority obtained. It can be seen that in this solution, the data of the target application can be captured without using a laptop, and the process is relatively simple.

[0034] In a possible implementation, the processing module is specifically used to: hijack the local proxy interface of the system end of the target application on the client; based on the hijacked local proxy interface and the first startup entry, start the target application in the subprocess of the packet capture application.

[0035] In a possible implementation, the processing module is specifically used to: obtain the second startup entry configured in the manifest file of the packet capture application; request the system end to start the second startup entry in the sub-process of the packet capture application; after the system end verifies, start the first startup entry of the target application in the sub-process of the packet capture application.

[0036] In a possible implementation, the processing module is specifically used to: send a second system call request to the system end through the hijacked local proxy interface; wherein the second system call request is used to request to start a second startup entry in the packet capture application.

[0037] In a possible implementation, the processing module is specifically used to: receive a second system verification pass message returned by the system end through a hijacked local proxy interface, wherein the second system verification pass message indicates that the system end allows the second startup entry to be started in the packet capture application; send a first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, wherein the first system verification pass message indicates that the system end allows the first startup entry to be started in the packet capture application.

[0038] In a possible implementation, the processing module is further used to: send a first system call request to the local proxy interface through a client of the target application; wherein the first system call request is used to request to start a first start entry in the packet capture application.

[0039] In a possible implementation, the packet capture module is specifically used to: capture a first HTTP message sent by a client of a target application to a system end at a Hypertext Transfer Protocol (HTTP) layer; and / or capture a second HTTP message sent by the system end of the target application to a client at the HTTP layer.

[0040] In a possible implementation, the packet capture module is specifically used to: hijack the HTTP module of the system; and capture the first HTTP message and / or the second HTTP message based on the hijacked HTTP module.

[0041] In a possible implementation, the processing module is specifically used to: obtain a manifest file of the target application; and obtain a first startup entry of the target application from the manifest file of the target application.

[0042] On the one hand, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of any one of the above-mentioned data capture methods.

[0043] On the one hand, an embodiment of the present application provides a computer storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the steps of any one of the above-mentioned data capture methods.

[0044] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program / instructions. When the computer program / instructions are executed on a computer, the computer executes the steps of any one of the above-mentioned data capture methods.

[0045] Since the embodiment of the present application adopts the above technical solution, it has at least the following technical effects:

[0046] Since the target application is started in the subprocess of the packet capture application, the packet capture application has the highest authority over the target application, so the packet capture application can capture the messages transmitted by the target application based on the highest authority obtained. It can be seen that in this solution, the data of the target application can be captured without using a laptop, and the process is relatively simple.

[0047] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 A possible system architecture diagram provided for an embodiment of the present application;

[0050] Figure 2 A flowchart of a data capture method provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of the Android system sandbox mechanism provided in an embodiment of the present application;

[0052] Figure 4 A possible method flow chart of starting a target application in a subprocess of a packet capture application provided in an embodiment of the present application;

[0053] Figure 5A flowchart of another possible method for starting a target application in a subprocess of a packet capture application provided in an embodiment of the present application;

[0054] Figure 6 A schematic diagram of the location of a message transmitted by a target application captured by a packet capture application in an embodiment of the present application;

[0055] Figure 7 A structural block diagram of a data capture device provided in an embodiment of the present application;

[0056] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0058] refer to Figure 1 , which is a possible system architecture diagram applicable to the embodiment of the present application, and the system architecture at least includes a terminal device 100. The terminal device 100 can run a packet capture application and a target application.

[0059] The terminal device 100 may adopt the Android system, and the terminal device 100 may adopt a C / S architecture, that is, a client / server architecture. In the C / S architecture, the operation of applications and access to system resources may be achieved through a local agent provided by a system service. Each application may initialize a local agent of a system service in its own process, and realize communication of the system service through inter-process communication or inter-process communication (IPC) technology.

[0060] like Figure 1 As shown, the terminal device 100 may include a client 101 and a system server 102. The client 101 and the system server 102 may perform signaling interaction via a local proxy interface 103. The local proxy interface 103 may be understood as a local proxy provided by the above-mentioned system service, and may also be referred to as a local proxy interface of the system server at the client.

[0061] Among them, any one of the client 101 , the system end 102 , and the local proxy interface 103 can be understood as a module, a unit, a chip or a circuit in the terminal device 100 .

[0062] The terminal device 100 may include a handheld device with a wireless connection function, or a processing device connected to a wireless modem. The terminal device 100 may include a mobile phone, a tablet computer, a notebook computer, or other device that can run applications.

[0063] In the embodiment of the present application, the terminal device 100 can run a packet capture application, and run the target application in a subprocess of the packet capture application, so that the packet capture application has the highest authority over the target application, and the packet capture application can capture messages transmitted by the target application based on the acquired highest authority. It can be seen that in this solution, the data of the target application can be captured without using a laptop, and the process is relatively simple.

[0064] The embodiments of the present application are further described below in conjunction with the accompanying drawings. The word "exemplary" used hereinafter means "used as an example, embodiment or illustrative". Any embodiment described as "exemplary" is not necessarily to be interpreted as being superior or better than other embodiments.

[0065] The terms "first" and "second" in this document are used for descriptive purposes only and should not be understood as explicitly or implicitly indicating relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0066] based on Figure 1 System architecture diagram, Figure 2 The following is a flow chart of a data capture method provided by an embodiment of the present application. Figure 2 As shown, the process of this method is Figure 1 The terminal device 100 shown is executed, for example, a unit, module, circuit or chip inside the terminal device may be executed. The method includes the following steps:

[0067] S201, obtaining a first startup entry of a target application.

[0068] S202, creating a child process of the main process of the packet capture application.

[0069] S203: Start the target application in the subprocess of the packet capture application according to the first startup entry.

[0070] S204, obtaining a message transmitted by the target application running in the child process through a packet capture application.

[0071] From the above scheme, it can be seen that since the target application is started in the subprocess of the packet capture application, the packet capture application has the highest authority over the target application, so the packet capture application can capture the messages transmitted by the target application based on the highest authority obtained. It can be seen that in this scheme, the data of the target application can be captured without using a laptop, and the process is relatively simple.

[0072] It should be noted that the packet capture application in the embodiment of the present application refers to an application used to capture data corresponding to the target application, and the application may also be called by other names, such as a test application, a data capture application, or a first application, etc. The target application in the embodiment of the present application refers to a test application, and the target application may be one of one or more applications installed on the terminal device, and the target application may also be called by other names, such as a tested application or a second application, etc.

[0073] In the above S201, the first startup entry of the target application may be obtained based on the Android system sandbox mechanism. For example, the manifest file of the target application may be obtained, and the first startup entry of the target application may be obtained from the manifest file of the target application.

[0074] Figure 3 The schematic diagram of the Android system sandbox mechanism is shown as an example. Figure 3 As shown, applications in the Android system (such as Figure 3 The application_1 and application_2 shown in the figure can be based on four components as the running unit, and the processes in which they are located can be specified in the manifest file (such as Androidmainfest.xml). In addition, the components of the application that need to be run also need to be configured in the manifest file.

[0075] The startup of an Android application can be understood as: running a startup entry (also called activity) configured in the manifest file in a specified process.

[0076] Based on the above content, in the above S201, the terminal device (such as the processing module in the packet capture application of the terminal device) can parse the manifest file of the target application through the XML protocol, and obtain the startup entry of the target application from the manifest file of the target application. For the purpose of distinction, the startup entry of the target application is referred to as the first startup entry in the embodiment of the present application.

[0077] The Android system is a user operating system based on Linux. The system can assign a unique identifier to each installed application. This identifier can be called UID, which can be generated based on the user identifier and application identifier. For example Figure 3The uid of application_1 is 1111, and the uid of application_2 is 2222. Different applications are isolated from each other and do not affect each other, so applications with different uids cannot access each other's resources (including files in memory, memory data, disk data, application components, etc.) (Note: except for applications with root permissions). Figure 3 Application_1 and Application_2 cannot access each other's files and components in memory, but the main process of Application_1 can access the files and components in memory of each sub-process under the main process. Figure 3 Here are just two applications as examples. Figure 3 In the example, application_1 and application_2 both fork n child processes. n is a positive integer. In actual applications, the number of child processes forked by the two applications can be the same or different. Each child process can correspond to a piece of memory. Multiple processes can be forked under the same uid, and the main process can operate the memory data of the forked child processes. Based on this, when the target application runs in the child process forked by the packet capture application, the target application can operate the memory data of the target application running in the child process, and the packet capture application can have the highest authority over the target application.

[0078] For the above S203, for example, one or more of the multi-process mechanism, application operation mechanism, reflection, dynamic proxy technology, sandbox mechanism or class loading mechanism of the Android system can be used to run the target application in the sub-process of the main process of the packet capture application. A possible implementation method of starting the target application in the sub-process of the packet capture application is provided below. In this implementation method, the terminal device can hijack the local proxy interface of the system end of the target application on the client side through the packet capture application. For example, the local proxy interface of the system end of the target application on the client side can be hijacked through the reflection technology. Java reflection technology can support obtaining object instances and runtime data through class names and method names, and provide the ability to modify these data contents. Since the signaling transmitted by the client and system end of the target application is transmitted through the local proxy interface, the target application can be started in the sub-process of the packet capture application based on the hijacked local proxy interface and the first startup entry.

[0079] In a possible implementation, since a prerequisite for the Android system to start a component in an application is that the component is configured in the manifest file of the application, when the first startup entry of the target application is configured in the manifest file of the packet capture application, the system end can start the first startup entry in the subprocess of the packet capture application, thereby achieving the purpose of starting the target application in the subprocess of the packet capture application.

[0080] In another possible implementation, the first startup entry of the target application may not be configured in advance in the manifest file of the packet capture application. For this situation, the terminal device can obtain the second startup entry configured in the manifest file of the packet capture application, and request the system end to start the second startup entry in the subprocess of the packet capture application through the packet capture application. Since the second startup entry has been configured in the manifest file of the packet capture application, the packet capture application requests the system end to start the second startup entry in the subprocess of the packet capture application, and the system end can verify it. Further, the packet capture application can start the first startup entry of the target application in the subprocess of the packet capture application after the system end verifies it, for example, the second startup entry in the subprocess can be modified to the first startup entry after the system verifies it. For example, Java dynamic proxy technology can support dynamic proxying of interfaces in Java, replace the original implementation logic when the program is running, and then based on this principle, the second startup entry in the subprocess can be modified to the first startup entry after the system verifies it, thereby achieving the purpose of starting the target application in the subprocess of the packet capture application.

[0081] Figure 4 A possible method flow chart of starting a target application in a subprocess of a packet capture application is shown as an example. Figure 4 As shown, the method includes:

[0082] S401: Send a first system call request to a local proxy interface through a client of a target application.

[0083] The first system call request is used to request to start a first start entry in the packet capture application.

[0084] S402, receiving a first system call request through the hijacked local proxy interface; and sending a second system call request to the system end based on the received first system call request;

[0085] The second system call request is used to request to start a second startup entry in the packet capture application.

[0086] S403, receiving a second system verification pass message returned by the system end through the hijacked local proxy interface, wherein the second system verification pass message indicates that the system end allows the second startup entry to be started in the packet capture application;

[0087] S404, through the hijacked local proxy interface, based on the received second system verification pass message, a first system verification pass message is sent to the client of the target application, and the first system verification pass message indicates that the system side allows the first startup entry to be started in the packet capture application.

[0088] Figure 5 A schematic diagram of another possible method flow for starting a target application in a subprocess of a packet capture application is shown as follows: Figure 5 As shown, the method includes:

[0089] S501, the main process of the packet capture application can copy the target application.

[0090] S502, capturing the main process of the application and parsing the manifest file of the target application, thereby obtaining the first startup entry of the target application.

[0091] S503, the main process of the packet capture application can also create (fork) a child process p1.

[0092] Since the main process of the packet capture application can create one or more sub-processes, for the purpose of distinction, the sub-process can be called sub-process p1. The sub-process p1 is the sub-process used to start the target application.

[0093] S504: The packet capture application may start the second start entry preconfigured in the manifest file of the packet capture application, and configure its process as the sub-process p1.

[0094] S505, the subprocess of the packet capture application hijacks the local proxy interface.

[0095] S506, when the system verification is passed, the packet capture application can intercept the startup callback of the child process p1 and modify it to the real first startup entry of the target application.

[0096] In the embodiment of the present application, since the second startup entry is configured in advance in the manifest file of the packet capture application, when the system is requested to start the second startup entry in the subprocess p1 of the packet capture application, the system can verify it. After the system verification is passed, the packet capture application can intercept the startup callback of the subprocess p1 and modify it to the real first startup entry of the target application, that is, modify the second startup entry that should be started in the subprocess p1 to the first startup entry of the target application, so as to achieve the effect of starting the target application in the subprocess p1 of the packet capture application.

[0097] Furthermore, in order to create other components of the correct target application, the system method can be called to start the related components of the first startup entry after the second startup entry is modified to the first startup entry. At this time, the target application will run in the child process p1 of the packet capture application. Since the child process p1 is forked by our packet capture application, the packet capture application has the highest authority over the target application running in the child process p1.

[0098] In the above S204, since the packet capture application has the highest authority over the target application running in the subprocess p1, the packet capture application can obtain the message transmitted by the target application. In one possible implementation, the terminal device can capture the first HTTP message sent by the client of the target application to the system end at the HTTP layer through the packet capture application. The first HTTP message may also be referred to as a first HTTP message. In another possible implementation, the terminal device may capture the second HTTP message sent by the system end of the target application to the client at the HTTP layer through the packet capture application. The second HTTP message may also be referred to as a second HTTP message.

[0099] In a possible implementation, the packet capture application can hijack the HTTP module of the system. Based on the hijacked HTTP module, the first HTTP message and / or the second HTTP message can be captured. For example, one or more of the sandbox mechanism or reflection technology of the Android system can be used to hijack and / or replace the HTTP module of the target application, so as to obtain the message transmitted based on the HTTP protocol from the target application.

[0100] It can be seen from the above content that in the embodiment of the present application, based on the highest authority of the target application obtained by the packet capture application, and combined with the implementation method of the HTTP module in Android, the packet capture application can hijack (or replace) the HTTP module of the system through reflection technology. Since the first HTTP message sent by the target application will be sent to the HTTP module of the system, and the packet capture application hijacks the HTTP module of the system, the packet capture application can hijack the first HTTP message sent by the target application. Furthermore, the packet capture application can also format and output the hijacked first HTTP message to achieve the purpose of capturing the first HTTP message.

[0101] On the other hand, since the second HTTP message sent by the system to the client will be first transmitted to the HTTP module of the system, the packet capture application can hijack the second HTTP message sent by the system to the client. Further, the packet capture application can also format and output the hijacked second HTTP message to achieve the purpose of capturing the second HTTP message.

[0102] Figure 6 A schematic diagram exemplarily shows the location of a message transmitted by a target application captured by a packet capture application in an embodiment of the present application.

[0103] like Figure 6As shown, the first HTTP request sent by the client is handed over to the HTTP processing stack for adding HTTP protocol headers and other processing, and then handed over to the Secure Sockets Layer (SSL) processing stack. The SSL processing stack can add an SSL header to the first HTTP request and encrypt the first HTTP request. The processed first HTTP request is handed over to the transmission controln protocol / internet protocol (TCP / IP) processing stack for further processing. The TCP / IP processing stack can add a TCP / IP protocol header to the received first HTTP request, and hand the processed first HTTP request over to the network layer processing stack. The network layer processing stack further sends it to the system end.

[0104] from Figure 6 It can be seen that the first HTTP request sent by the client is hijacked by the packet capture application before being handed over to the HTTP processing stack for processing. Since the packet capture application hijacks the first HTTP message at an early stage, that is, the first HTTP message is hijacked by the packet capture application before it is encrypted, the original request message of the first HTTP message can be obtained without importing the certificate. Furthermore, the packet capture application can extract the first HTTP message for display and output based on the HTTP implementation principle in Android. On the other hand, the packet capture application will also hand over the hijacked first HTTP message to the system's HTTP module for processing, which will not cause other impacts on the processing process of the first HTTP message.

[0105] On the other hand, from Figure 6 It can be seen that after the second HTTP message sent by the system end to the client is processed by the network layer processing stack, it can be handed over to the TCP / IP processing stack for further processing, so as to parse the TCP / IP protocol header and parse the data packet. Further, the data processed by the TCP / IP processing stack can be handed over to the SSL processing stack for further processing, and the second HTTP message will also parse the SSL header in the SSL processing stack, and decrypt the second HTTP message. The decrypted second HTTP message can continue to be sent to the HTTP processing stack, which will parse the HTTP protocol header and perform unpacking processing. Afterwards, the packet capture application hijacks the second HTTP message processed by the HTTP processing stack. Since the second HTTP message has been decrypted, the packet capture application can obtain the decrypted data of the second HTTP message without importing the certificate. Further, the packet capture application can extract the second HTTP message based on the HTTP implementation principle in Android, display and output. On the other hand, the packet capture application can also hand over the hijacked decrypted second HTTP message to the target application for further processing, which will not cause other effects on the processing process of the second HTTP message.

[0106] The above content introduces a solution for capturing messages transmitted by a target application by hijacking an HTTP module. In another possible implementation, the terminal device can create a virtual network card for the system proxy service through a packet capture application to proxy all traffic of the terminal device.

[0107] From the above content, it can be seen that the current solution for capturing packets for target applications has the following problems: heavy reliance on external environment, numerous preconditions and complex operations. For example, an HTTP proxy software must be installed on a laptop, the terminal device and the laptop must be connected to a local area network, the terminal device must set the proxy server to the IP address of the laptop, and the certificate must be installed on the terminal device and the laptop for HTTPs data packets. There is also a problem with the current solution for capturing packets for target applications: the target application that has undergone certificate verification cannot capture its transmitted messages.

[0108] In the embodiment of the present application, since the packet capture of the target application can be achieved solely through the packet capture application of the terminal device, the implementation method does not rely on a laptop computer, does not rely on the type of mobile phone network, and does not require the use of proxy software. On the other hand, since the scheme provided in the embodiment of the present application can hijack the messages before encryption and the messages after decryption, it is not necessary to import certificates for the HTTPs protocol, and the HTTPs data packets can also be captured for the target application that has undergone certificate verification. It can be seen that the scheme provided in the embodiment of the present application can more conveniently capture all messages (or data packets) transmitted through the HTTP / HTTPs protocol in applications developed based on the Android system without modifying the apk package and without relying on any external conditions, so as to facilitate subsequent analysis.

[0109] Based on the same technical concept, Figure 7 The structural block diagram of a data capture device provided by an embodiment of the present application is shown as an example. Figure 7 As shown, the device 700 includes:

[0110] The processing module 701 is used to obtain a first startup entry of a target application, create a subprocess of a main process of a packet capture application, and start the target application in the subprocess of the packet capture application according to the first startup entry.

[0111] The packet capture module 702 is used to obtain the message transmitted by the target application running in the sub-process through the packet capture application.

[0112] In a possible implementation, the processing module 701 is specifically used to: hijack the local proxy interface of the system end of the target application on the client; based on the hijacked local proxy interface and the first startup entry, start the target application in the subprocess of the packet capture application.

[0113] In a possible implementation, the processing module 701 is specifically used to: obtain the second startup entry configured in the manifest file of the packet capture application; request the system end to start the second startup entry in the sub-process of the packet capture application; after verification by the system end, start the first startup entry of the target application in the sub-process of the packet capture application.

[0114] In a possible implementation, the processing module 701 is specifically used to: send a second system call request to the system end through the hijacked local proxy interface; wherein the second system call request is used to request to start a second startup entry in the packet capture application.

[0115] In one possible implementation, the processing module 701 is specifically used to: receive a second system verification pass message returned by the system end through a hijacked local proxy interface, wherein the second system verification pass message indicates that the system end allows the second startup entry to be started in the packet capture application; send a first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, wherein the first system verification pass message indicates that the system end allows the first startup entry to be started in the packet capture application.

[0116] In a possible implementation, the processing module 701 is specifically used to: send a first system call request to the local proxy interface through the client of the target application; wherein the first system call request is used to request to start a first start entry in the packet capture application.

[0117] In a possible implementation, the packet capture module 702 is specifically used to: capture a first HTTP message sent by the client of the target application to the system end at the Hypertext Transfer Protocol HTTP layer; and / or capture a second HTTP message sent by the system end of the target application to the client at the HTTP layer.

[0118] In a possible implementation, the packet capture module 702 is specifically used to: hijack the HTTP module of the system; and capture the first HTTP message and / or the second HTTP message based on the hijacked HTTP module.

[0119] In a possible implementation, the processing module 701 is specifically configured to: obtain a manifest file of a target application; and obtain a first startup entry of the target application from the manifest file of the target application.

[0120] For other relevant contents of this embodiment, please refer to the relevant description of the aforementioned embodiment, which will not be repeated here.

[0121] Based on the same technical concept, the embodiment of the present application provides a computer device, which may be a terminal or a server, such as Figure 8As shown, it includes at least one processor 801 and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0122] In an embodiment of the present application, the memory 802 stores instructions that can be executed by at least one processor 801. The at least one processor 801 can execute the steps included in the above-mentioned data capture method by executing the instructions stored in the memory 802.

[0123] Among them, the processor 801 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and perform tests by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0124] Processor 801 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0125] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0126] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned data capture method.

[0127] Based on the same inventive concept, an embodiment of the present application provides a computer program product, which includes a computer program / instructions. When the computer program / instructions are executed on a computer, the computer device executes the steps of the above-mentioned data capture method.

[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data capture method, characterized in that: include: Get the first startup entry of the target application; Create a child process of the main process of the packet capture application; Hijacking the local proxy interface of the system end of the target application on the client side; Obtaining a second startup entry configured in the manifest file of the packet capture application; Requesting the system end to start the second startup entry in the subprocess of the packet capture application; receiving a second system verification pass message returned by the system end through the hijacked local proxy interface, wherein the second system verification pass message indicates that the system end allows the second startup entry to be started in the packet capture application; sending a first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, wherein the first system verification pass message indicates that the system end allows the first startup entry to be started in the packet capture application; The message transmitted by the target application running in the sub-process is obtained through the packet capture application.

2. The method according to claim 1, characterized in that The requesting the system end to start the second startup entry in the sub-process of the packet capture application includes: Sending a second system call request to the system end through the hijacked local proxy interface; The second system call request is used to request to start a second startup entry in the packet capture application.

3. The method according to claim 1, characterized in that Before sending the first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, the method further includes: Sending a first system call request to the local proxy interface through a client of the target application; The first system call request is used to request to start the first startup entry in the packet capture application.

4. The method according to any one of claims 1 to 3, characterized in that: The acquiring, by the packet capture application, a message transmitted by the target application running in the sub-process comprises: capturing, at the Hypertext Transfer Protocol (HTTP) layer, a first HTTP message sent by the client of the target application to the system end; and / or, A second HTTP message sent by the system end of the target application to the client is captured at the HTTP layer.

5. The method according to claim 4, characterized in that The first HTTP message sent by the client of the target application to the system end is captured at the HTTP layer; And / or, capturing, at the HTTP layer, a second HTTP message sent by the system end of the target application to the client, comprising: Hijack the system's HTTP module; Based on the hijacked HTTP module, the first HTTP message and / or the second HTTP message is captured.

6. The method according to any one of claims 1 to 3, characterized in that: The obtaining of the first startup entry of the target application includes: Obtaining a manifest file of the target application; A first startup entry of the target application is obtained from the manifest file of the target application.

7. A data capture device, characterized in that: include: The processing module is used to obtain the first startup entry of the target application; create a subprocess of the main process of the packet capture application; Hijacking the local proxy interface of the system end of the target application on the client side; Obtaining a second startup entry configured in the manifest file of the packet capture application; Requesting the system end to start the second startup entry in the subprocess of the packet capture application; receiving a second system verification pass message returned by the system end through the hijacked local proxy interface, wherein the second system verification pass message indicates that the system end allows the second startup entry to be started in the packet capture application; sending a first system verification pass message to the client of the target application through the hijacked local proxy interface based on the received second system verification pass message, wherein the first system verification pass message indicates that the system end allows the first startup entry to be started in the packet capture application; The packet capture module is used to obtain the message transmitted by the target application running in the sub-process through the packet capture application.

8. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of any one of the methods described in claims 1 to 6.

9. A computer-readable storage medium, characterized in that: It stores program codes, and when the program codes are run on an electronic device, the program codes are used to enable the electronic device to execute the steps of any one of the methods described in claims 1 to 6.

10. A computer program product, comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed on a computer, the computer is enabled to implement the method according to any one of claims 1 to 6.

Images