Function processing method, device, electronic device, storage medium and program product

Abstract

The present disclosure relates to a function processing method, device, electronic device, storage medium, and program product, which can analyze closed-source native code or add call logic through inline hooking. The method includes: inserting a first stub function before an original function called by a target function of an application, and inserting a second stub function after the original function to generate a hooked function; when the target function calls the hooked function, executing the hooked function to analyze the execution time or call logic of the original function based on the execution results of the first stub function and the second stub function, or to add call logic when the target function calls the original function through at least one of the first stub function and the second stub function.

Description

Technical Field

[0001] The present disclosure relates to the field of software development technology, and in particular to a function processing method, device, electronic device, storage medium, and program product. Background Art

[0002] During software development, it's sometimes necessary to analyze the execution flow of closed-source native code or add call logic to it. Because native code isn't open source, adding logging, tracing, or registering callbacks isn't possible by modifying or compiling the code. Inlinehook technology is a hook that can analyze closed-source native code. Inlinehook involves modifying the code to add a jump instruction, redirecting the execution flow to the hooked logic.

[0003] Currently, the industry uses Inlinehook mainly to define a custom function with the same parameters as the hooked function (that is, a custom function with the same parameters as the hooked function but different functions). When the hooked function is called, the custom function is called instead.

[0004] However, before modifying the code, using Inlinehook requires knowing the parameter definitions of the hooked function in advance. For functions in third-party libraries, mastering their parameter definitions is very time-consuming. Therefore, the existing inlinehook technology is inefficient in hooking non-open source native code. Summary of the Invention

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a function processing method, device, electronic device, storage medium and program product.

[0006] A first aspect of an embodiment of the present disclosure provides a function processing method, the method comprising: inserting a first stub function before an original function called by a target function of an application, and inserting a second stub function after the original function to generate a hooked function; when the target function calls the hooked function, executing the hooked function so as to analyze the execution time or calling logic of the original function based on the execution results of the first stub function and the second stub function, or so as to increase the calling logic when the target function calls the original function through at least one of the first stub function and the second stub function.

[0007] Optionally, the first pile function includes a user-defined first function, and the second pile function includes a user-defined second function; when the target function calls the hooked function, the hooked function is executed, including: when the target function calls the hooked function, according to the jump code in the hooked function, jumping to the initial parameter register corresponding to the original function, the jump code is obtained by modifying the first code in the original function; saving the target jump address, the target jump address is used to jump back to the target function; calling and executing the first function; updating the current parameter register to the initial parameter register saved before; calling and executing the repaired original function; saving the result parameter register after executing the repaired original function; calling and executing the second function; obtaining the target jump address saved before; updating the current parameter register to the result parameter register saved before; jumping back to the target function according to the target jump address.

[0008] Optionally, saving the target jump address includes: saving the target jump address through a first assembly code; or saving the target jump address by calling a user-defined third function.

[0009] Optionally, obtaining the previously saved target jump address includes: obtaining the previously saved target jump address through the second assembly code; or obtaining the previously saved target jump address by calling a fourth function.

[0010] Optionally, the first function is an empty function, or the second function is an empty function.

[0011] Optionally, the first pile function is inserted before the original function called by the target function of the application, and the second pile function is inserted after the original function to generate the hooked function, including: when the application loads a dynamic library, the first pile function is inserted before the original function, and the second pile function is inserted after the original function to generate the hooked function.

[0012] Optionally, the first pile function is inserted before the original function called by the target function of the application, and the second pile function is inserted after the original function to generate a hooked function. The method also includes: during the running process of the application, the first pile function is inserted before the original function, and the second pile function is inserted after the original function to generate the hooked function; after jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function, the method also includes: stopping the execution of all threads in the application; before calling and executing the repaired original function, the method also includes: resuming the execution of all threads in the application.

[0013] Optionally, executing the repaired original function includes: executing the repaired first code; returning to the original function and executing all codes after the jump code in the original function according to the target address, and the target address is used to indicate the second code after the jump code in the target function.

[0014] Optionally, the first code is an address-related code, and the repaired first code is obtained by repairing the first code according to the address offset.

[0015] A second aspect of the embodiments of the present disclosure provides a function processing device, which includes: a generation module and an execution module; the generation module is used to insert a first stub function before the original function called by the target function of the application, and insert a second stub function after the original function to generate a hooked function; the execution module is used to execute the hooked function generated by the generation module when the target function calls the hooked function, so as to analyze the execution time or calling logic of the original function according to the execution results of the first stub function and the second stub function, or to increase the calling logic when the target function calls the original function through at least one of the first stub function and the second stub function.

[0016] Optionally, the first pile function comprises the self-defined first function, and the second pile function comprises the self-defined second function; This device comprises: jump module, preservation module, calls and execution module, update module and acquisition module; Jump module is used for when this target function calls quilt hook function, according to this quilt jump code in the hook function, jumps to the initial parameter register that preserves the primitive function correspondence, and this jump code is obtained by revising the first code in this primitive function; Preservation module is used to preserve target jump address, and this target jump address is used to jump back to this target function; Call and execution module is used to call and execute the first function; Update module is used for the initial parameter register that is preserved before the current parameter register is updated; Call and execution module is also used to call and execute this primitive function after repairing; Preservation module is also used to preserve the result parameter register after the primitive function that is performed after repairing; Call and execution module is also used to call and execute the second function; Acquisition module is used to obtain this target jump address that was preserved before; Update module is also used for the result parameter register that is preserved before the current parameter register is updated; Jump module is also used to jump back to this target function according to this target jump address.

[0017] Optionally, the saving module is specifically configured to save the target jump address through the first assembly code; or save the target jump address by calling a user-defined third function.

[0018] Optionally, the acquisition module is specifically configured to acquire the previously saved target jump address through the second assembly code; or acquire the previously saved target jump address by calling a fourth function.

[0019] Optionally, the first function is an empty function, or the second function is an empty function.

[0020] Optionally, the generation module is specifically configured to insert a first stub function before the original function and a second stub function after the original function when the application loads a dynamic library, so as to generate the hooked function.

[0021] Optionally, the generation module is specifically used to insert a first pile function before the original function and a second pile function after the original function during the running process of the application to generate the hooked function; the device also includes: a stop module and a recovery module; the stop module is used to stop executing all threads in the application after jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function; the recovery module is used to resume executing all threads in the application before calling and executing the original function.

[0022] Optionally, the calling and executing module is specifically used to execute the repaired first code; according to the target address, return to the original function and execute all the codes after the jump code in the original function, and the target address is used to indicate the second code after the jump code in the target function.

[0023] Optionally, the first code is an address-related code, and the repaired first code is obtained by repairing the first code according to the address offset.

[0024] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, which includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the function processing method described in the first aspect.

[0025] According to a fourth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the function processing method described in the first aspect is implemented.

[0026] A fifth aspect of an embodiment of the present disclosure provides a computer program product, wherein the computer program product includes a computer program. When the computer program product runs on a processor, the processor executes the computer program to implement the function processing method described in the first aspect.

[0027] In a sixth aspect of an embodiment of the present disclosure, a chip is provided, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run program instructions to implement the function processing method described in the first aspect.

[0028] The technical scheme that the disclosed embodiment provides has the following advantages compared with prior art: in the disclosed embodiment, before the primitive function that the target function of application program calls, insert the first pile function, and insert the second pile function after this primitive function, generate quilt hook function; When this target function calls this quilt hook function, execution should be hooked function, so that according to the execution result of the first pile function and the second pile function, analyze the execution time or the calling logic of this primitive function, or so that by at least one in the first pile function and the second pile function, increase the calling logic when this target function calls this primitive function. In this scheme, can be realized under the situation of not obtaining the parameter definition of primitive function in advance, by inserting pile function respectively before and after primitive function, generate quilt hook function, then after execution quilt hook function, according to the execution result of the first pile function and the second pile function, analyze the execution time or the calling logic of this primitive function, thereby can realize the analysis of the primitive function that is not open source; Or by at least one in the first pile function and the second pile function, increase the calling logic when this target function calls this primitive function, thereby realize adding calling logic before or after the primitive function that is not open source. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0030] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0031] Figure 1A A flowchart of a function processing method provided in an embodiment of the present disclosure;

[0032] Figure 1B A flowchart of another function processing method provided in an embodiment of the present disclosure;

[0033] Figure 2 A schematic diagram of an existing function call provided in an embodiment of the present disclosure;

[0034] Figure 3 A function call diagram of a function processing method provided in an embodiment of the present disclosure;

[0035] Figure 4 A structural block diagram of a function processing device provided in an embodiment of the present disclosure;

[0036] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0038] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0039] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present disclosure can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects related to each other are in an "or" relationship.

[0040] During software development, it's sometimes necessary to analyze the execution flow of closed-source native code. For example, certain closed-source 3D engines are widely used in games. When running at a 90 FPS, they often experience excessive CPU consumption, but the cause remains unidentified. Therefore, it's necessary to track the execution flow of the 3D engine's code, including the start and end times of function execution, during game execution to analyze the cause and identify a solution.

[0041] The electronic devices in the embodiments of the present disclosure may be mobile electronic devices or non-mobile electronic devices. Mobile electronic devices may be mobile phones, tablet computers, laptop computers, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs); non-mobile electronic devices may be personal computers (PCs), televisions (TVs), ATMs, or self-service kiosks, etc.; the embodiments of the present disclosure do not specifically limit these.

[0042] The execution subject of the function processing method provided in the embodiment of the present disclosure can be the above-mentioned electronic device (including mobile electronic devices and non-mobile electronic devices), or it can be a functional module and / or functional entity in the electronic device that can implement the function processing method. The specific one can be determined according to actual usage requirements and is not limited by the embodiment of the present disclosure.

[0043] The function processing method provided by the embodiment of the present disclosure is described in detail below through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0044] like Figure 1A As shown, an embodiment of the present disclosure provides a function processing method, which may include the following steps 101 to 102.

[0045] 101. Insert a first stub function before the original function called by the target function of the application, and insert a second stub function after the original function to generate a hooked function.

[0046] Among them, the original function can be any function called by the target function, the target function can be any function in the application, and the original function can also be a function preliminarily determined by simpleperf (a local performance analysis tool on the Android platform) and / or hook. The specific function can be determined according to actual conditions and is not limited here.

[0047] 102, when this target function calls this quilt hook function, execute this quilt hook function, so that according to the execution result of the first pile function and the second pile function, analyze the execution time or the calling logic of this primitive function, or so that by at least one in the first pile function and the second pile function, increase the calling logic when this target function calls this primitive function.

[0048] The first function can be customized according to actual needs, and the second function can be customized according to actual needs, and there is no limitation here.

[0049] Among them, the first pile function and the second pile function can be customized functions that track and analyze the original function. In this case, when the target function calls the hooked function, the hooked function can be executed to track the original function. Then, the execution time or calling logic of the original function is analyzed according to the execution results of the first pile function and the second pile function, and then the code is improved accordingly according to the analysis to improve the frame rate of the application and the fluency of the application.

[0050] Among them, the first pile function or the second pile function can also be a customized calling logic function that needs to be added when the original function is called. By adding calling logic before or after the original function, the performance of the application when executing the function of the original function can be improved, or the performance of the application when executing the function after the original function can be improved.

[0051] In the disclosed embodiment, before the primitive function that the target function of application program calls, insert the first pile function, and after this primitive function, insert the second pile function, generate quilt hook function; When this target function calls this quilt hook function, execution should be hooked function, so that according to the execution result of the first pile function and the second pile function, analyze the execution time or the calling logic of this primitive function, or so that by at least one in the first pile function and the second pile function, increase the calling logic when this target function calls this primitive function. In this scheme, can be realized under the situation of the parameter definition that does not obtain primitive function in advance, by inserting pile function respectively before and after the primitive function, generate quilt hook function, then after execution quilt hook function, according to the execution result of the first pile function and the second pile function, analyze the execution time or the calling logic of this primitive function, thereby can realize the analysis of the primitive function that is not open source; Or by at least one in the first pile function and the second pile function, increase the calling logic when this target function calls this primitive function, thereby realize adding calling logic before or after the primitive function that is not open source.

[0052] like Figure 1B As shown, an embodiment of the present disclosure provides a function processing method, which may include the following steps 200 to 210.

[0053] 200. Insert a first stub function before the original function called by the target function of the application, and insert a second stub function after the original function to generate a hooked function.

[0054] 201. When the target function calls the hooked function, jump to the initial parameter register corresponding to the original function according to the jump code in the hooked function.

[0055] The jump code is obtained by modifying the first code in the original function.

[0056] Optionally, the jump code can be at least one of the internal springboard code b (assembly language jump instruction, the jump distance is shorter) and the internal springboard code br (branch, assembly language jump instruction, unconditional jump to all address ranges supported by the chip, the jump distance can be longer). The jump code can also be other jump codes, which can be determined according to actual conditions and are not limited here.

[0057] Optionally, the jump code jumps to the initial parameter register corresponding to the original function, including jumping from the jump code (b internal springboard code) in the hooked function to an intermediate position, and then jumping from the jump code (br internal springboard code) at the intermediate position to the initial parameter register.

[0058] It can be understood that when a larger unused space area is included near the hooked function, the jump to the saved initial parameter register can be directly performed according to the jump code in the hooked function; when a smaller unused space area is included near the hooked function, the jump code in the hooked function can be jumped to an intermediate position, and then the jump code in the intermediate position can be jumped to the saved initial parameter register, that is, the jump to the saved initial parameter register is based on multiple jump codes. The specific method can be determined according to actual conditions and is not limited here.

[0059] It is understood that saving the initial parameter registers corresponding to the original function may specifically be saving the initial parameter registers to a stack, for example, by using a push instruction to save the initial parameter registers to the stack. The initial parameter registers may also be saved by other means, which are not limited here.

[0060] 202. Save the target jump address.

[0061] The target jump address is used to jump back to the target function.

[0062] It can be understood that the target jump address is the address corresponding to the instruction after the instruction that calls the original function in the target function, and can also be understood as the return address (location return, LR) after the target function is executed.

[0063] Optionally, the target jump address can be saved in the secure transport layer protocol (TLS) memory space of the current thread (thread), or the target jump address can be saved in a custom memory space. The specific method can be determined according to actual conditions and is not limited here.

[0064] Optionally, the above step 202 can be specifically implemented through the following step 202a or step 202b.

[0065] 202a. Save the target jump address through the first assembly code.

[0066] 202b. Save the target jump address by calling a user-defined third function.

[0067] In the embodiments of the present disclosure, a variety of methods for storing the target jump address are provided, which can be determined according to actual conditions and are not limited here.

[0068] The target jump address is saved by calling a user-defined third function, thereby improving operation efficiency.

[0069] 203. Call and execute the first function.

[0070] The parameter definition of the first function may be the same as or different from the parameter definition of the original function, and may be determined based on actual conditions, which is not limited here.

[0071] Optionally, the first function can be a logging function, a trace function, a registration callback function, a cache clearing function, a function for detecting all read and write files of the program, a keyboard input detection function, a network traffic detection function or an empty function, etc. The specific function can be determined according to actual conditions and is not limited here.

[0072] Optionally, when the above-mentioned step 202 is specifically the above-mentioned step 202b, the above-mentioned first function and third function can be two separately set functions, or can be set in one function, which includes both the code for saving the target jump address and the code of the customized first function. The specific function can be determined according to actual conditions and is not limited here.

[0073] Among them, the first function can be understood as the first pile function or a part of the first pile function inserted before the hooked original function (the first pile function can also include the third function, and can also include other functions, which are not limited here).

[0074] 204. Update the current parameter register to the previously saved initial parameter register.

[0075] It can be understood that restoring the previously saved initial parameter registers may specifically be restoring all registers from the stack, for example, restoring the initial parameter registers from the stack through a pop instruction.

[0076] 205. Call and execute the repaired original function.

[0077] Optionally, in addition to the above functions, the first function may also include a function for obtaining the first address of the repaired original function, and then the repaired original function may be called and executed according to the first address. The specific address can be determined based on actual conditions and is not limited here.

[0078] Optionally, a function for obtaining the first address of the repaired original function can be implemented in assembly language, and then the repaired original function can be called and executed according to the first address. The specific address can be determined based on actual conditions and is not limited here.

[0079] The repaired original function can be a function obtained by repairing all the codes of the original function, or a function composed of the repaired first code and all the codes after the jump code in the original function. The specific function can be determined according to the actual situation and is not limited here.

[0080] Optionally, the above step 205 can be specifically implemented through the following steps 205a to 205b.

[0081] 205a. Execute the repaired first code.

[0082] 205b. Return to the original function according to the target address and execute all codes after the jump code in the original function.

[0083] The target address is used to indicate the second code after the jump code in the original function. The second code is the code after the first code in the original function.

[0084] In an embodiment of the present application, only the first code can be repaired to obtain the repaired first code, and then the original function can be reused and all the code after the jump code in the original function (that is, all the code after the first code in the original function) can be executed. In this way, the previous code is reused, not only less code needs to be repaired, but also memory space can be saved, thereby improving the efficiency of repairing the original function.

[0085] Optionally, the first code is an address-related code, and the repaired first code is obtained by repairing the first code according to the address offset.

[0086] Exemplarily, the above step 205a can be implemented specifically through the following steps 205a1 to 205a2.

[0087] 205a1. When the first code is an address-related code, repair the saved first code according to the address offset to obtain the repaired first code, and execute the repaired first code.

[0088] 205a2. When the first code is not an address-related code, determine the saved first code as the repaired first code, and execute the repaired first code.

[0089] It can be understood that when the first code is an address-related code, the result of executing the first code will be related to the address, because the address of the original first code is modified to a jump code. Therefore, if the address of the previously saved first code is not corrected, the result obtained by directly executing the saved first code will have an address offset from the result of the original first code before execution. Therefore, the saved first code can be repaired according to the address offset to obtain the repaired first code, and then executed. The result obtained is the same as the result of the original first code before execution. In this way, it can be ensured that there will be no problems when calling and executing the hooked function, and it can be guaranteed that it can be executed smoothly, thereby ensuring the stability of the application operation.

[0090] 206. Save the result parameter register after executing the repaired original function.

[0091] It is understood that saving the result parameter register may specifically be saving the result parameter register to a stack, for example, by using a push instruction to save the result parameter register to the stack. The result parameter register may also be saved in other ways, which are not limited here.

[0092] 207. Call and execute the second function.

[0093] The parameter definition of the second function may be the same as or different from the parameter definition of the original function, and may be determined based on actual conditions, which is not limited here.

[0094] Optionally, the second function can be a logging function, a trace function, a registration callback function, a cache clearing function, a function for detecting all read and write files of the program, a keyboard input detection function, a network traffic detection function or an empty function, etc. The specific function can be determined according to actual conditions and is not limited here.

[0095] 208. Get the previously saved target jump address.

[0096] It can be understood that the previously saved target jump address is obtained from the memory space (the TLS of the thread or the custom memory space) where the target jump address is saved in step 202 .

[0097] Optionally, the above step 208 can be specifically implemented through the following step 208a or step 208b.

[0098] 208a. Obtain the previously saved target jump address through the second assembly code.

[0099] 208b. Acquire the previously saved target jump address by calling the fourth function.

[0100] Optionally, when the above-mentioned step 208 is specifically the above-mentioned step 208b, the above-mentioned second function and fourth number can be two separately set functions, or can be set in one function, which includes both the code of the customized first function and the code for obtaining the target jump address. The specific function can be determined according to actual conditions and is not limited here.

[0101] Wherein, the second function can be understood as the second pile function or a part of the second pile function (this second pile function can also include the following 4th function, can also include other functions, are not limited here) that is inserted after the original function that is hooked.

[0102] 209. Update the current parameter register to the previously saved result parameter register.

[0103] It can be understood that the previously saved result parameter registers are restored, and specifically all registers can be restored from the stack, for example, the result parameter registers are restored from the stack through a pop instruction.

[0104] 210. Jump back to the target function according to the target jump address.

[0105] It can be understood that in the embodiment of the present disclosure, by saving the initial parameter register and restoring the initial parameter register, the customized first function can be called and executed before executing the original function; by saving the result parameter register and restoring the result parameter register, the customized second function can be called and executed after executing the original function. By saving the target jump address before calling and executing the customized first function, and obtaining the previously saved target jump address after calling and executing the customized second function, the target function can be returned after calling and executing the customized second function. In this way, it is possible to insert a customized function (stub function) before and after the original function without obtaining the parameter definition of the original function in advance, thereby enabling the analysis of the original function that is not open source to be performed based on the customized function.

[0106] Optionally, the first function is an empty function, or the second function is an empty function.

[0107] In the embodiment of the present disclosure, when there is no need to execute any behavior through the first function, the first function can be set to an empty function, and when there is no need to execute any behavior through the second function, the second function can be set to an empty function. Therefore, although the custom function is inserted before and after the original function, it can be determined whether to execute a certain behavior through the first function or the second function according to actual usage requirements. In this way, in the hook method provided in the embodiment of the present disclosure, the first function and the second function can be set flexibly and conveniently as needed, which can improve the performance of the hook.

[0108] For example, the target jump address is the jump address (LR) of instruction 2, the target function is function 0, the original function is function 1 (original func), the first function is the jump address of instruction 2 saved in function 2 (func1), the third function is the custom behavior 1 in function 2, the second function is the custom behavior 2 in function 3 (func2), and the fourth function is the jump address of instruction 2 saved in function 3, as shown in FIG. Figure 2 As shown in the figure above, the original calling method is that function 0 calls function 1, and after executing code 1 to code n of function 1, it returns to function 0. Figure 3As shown, the modified calling steps are as follows: (1) to (11). Sequence number (1) indicates that function 0 calls the hooked function (the function obtained by inserting stub functions before and after function 1), sequence number (2) indicates jumping from the b internal springboard of the hooked function to the br internal springboard, sequence number (3) indicates jumping from the br internal springboard to the trampoline code segment, and then executing the trampoline code segment, wherein executing the trampoline code segment includes: saving the initial parameter register, sequence number (4) indicates calling function 2 (call func1) (execution of function 2 includes: saving the jump address of instruction 2, executing custom behavior 1, and returning the address of the repaired code 1 (return original func addr), sequence number (5) indicates that after executing function 2, it returns to the trampoline code segment to continue execution, restores the initial parameter register, and calls the repaired function 1 (call originalfunc) (execution of the repaired function 1 includes: calling and executing the repaired code 1 as indicated by sequence number (6), obtaining the address of code 2 in the original function 1, returning to code 2 in the original function 1 as indicated by sequence number (7) to continue executing code 2 to code n, returning to the trampoline code segment after executing the repaired function 1 as indicated by sequence number (8) to continue execution), saving the result parameter register, calling function 3 (call func2) as indicated by sequence number (9) (execution of function 3 includes: executing custom behavior 2, obtaining the saved jump address of instruction 2, returning to the trampoline code segment after executing function 3 as indicated by mark (10) to continue execution), restoring the saved result parameter register, and jumping back to instruction 2 of function 0 to continue execution according to the jump address of instruction 2 returned by function 3 as indicated by mark (11).

[0109] Combine Figure 3 As shown, the trampoline code segment implements the following: The purpose of first saving and restoring the initial parameter registers is to ensure that the parameter registers are consistent with those when calling the repaired function 1 from function 0. Function 2 is used as a public stub function before calling the repaired function 1, and its behavior can be customized, such as logging, tracing, and registering callbacks. Function 2 receives the jump address of instruction 2 as a parameter and records the jump address of instruction 2 in the TLS of the current thread. The purpose of saving and restoring the result parameter registers after calling the repaired function 1 is to return the correct return value to function 0. This ensures that calling function 3 does not affect the return value of function 1. Function 3 returns the jump address of instruction 2 recorded by function 2, which is used to return to function 0. Function 3 is used as a public stub function after calling the repaired function 1, and its behavior can be customized. The customized behavior in function 3 is similar to that in function 2, such as logging, tracing, and registering callbacks.

[0110] In the disclosed embodiment, the typical inlinehook is improved. Without knowing the parameters of the original function being hooked, a stub function can be inserted before and after the original function being hooked by means of inlinehook. Custom functions can be implemented in the stub function, such as adding logs, tracing, registering callbacks, etc., thereby achieving the purpose of tracking the call of the original function being hooked.

[0111] For inlinehook, the existing code is modified to a jump instruction so that it can jump to the logic of the hook function. If the code is modified while the application is running, it may be modified when the central processing unit (CPU) is halfway through execution, causing the application to crash. Therefore, there are two ways to solve the above problem and ensure the security of the application. One way is to modify the code when the application loads the dynamic library to avoid the situation where the instruction is modified halfway through execution; the other way is to suspend all threads in the process before hooking, and then execute inlinehook. After executing the hook, all threads are resumed to ensure that other threads are suspended when inlinehook is executed, and the situation where the instruction is modified halfway through execution will not occur.

[0112] Optionally, before the above step 200, it can be specifically implemented through the following step 200a.

[0113] 200a. When the application loads the dynamic library, a first stub function is inserted before the original function, and a second stub function is inserted after the original function to generate the hooked function.

[0114] Illustratively, the above step 200a in the function processing method provided in the embodiment of the present application may specifically include: when the application loads the dynamic library, modifying the first code in the original function to the jump code; and loading the target code.

[0115] Among them, the target code includes code for saving the initial parameter register, code for saving the target jump address, code for calling the first function, code for the first function, code for updating the current parameter register to the initial parameter register, code for calling the repaired original function, code for repairing the corresponding code of the original function, code for saving the result parameter register, code for calling the second function, code for the second function, code for obtaining the target jump address, code for updating the current parameter register to the result parameter register, and code for jumping back to the target function according to the target jump address.

[0116] In the disclosed embodiment, by modifying the first code in the original function to the jump code and loading the target code when the application loads the dynamic library, the situation where the instruction is modified halfway through execution can be avoided, thereby ensuring the security of the application.

[0117] Optionally, the above-mentioned step 200 can be specifically implemented through the following step 200b, and after the above-mentioned step 201 (the latter in step 206), the function processing method provided in the embodiment of the present application may also include the following step 211, and before the above-mentioned step 205 (or after step 210), the function processing method provided in the embodiment of the present application may also include the following step 212.

[0118] 200b. During the running of the application program, a first stub function is inserted before the original function, and a second stub function is inserted after the original function to generate the hooked function.

[0119] The above step 200b in the function processing method provided in the embodiment of the present application may specifically include: during the running of the application, modifying the first code in the original function to the jump code; and loading the target code.

[0120] Among them, the target code includes code for saving the initial parameter register, code for saving the target jump address, code for calling the first function, code for the first function, code for updating the current parameter register to the initial parameter register, code for calling the repaired original function, code for repairing the corresponding code of the original function, code for saving the result parameter register, code for calling the second function, code for the second function, code for obtaining the target jump address, code for updating the current parameter register to the result parameter register, and code for jumping back to the target function according to the target jump address.

[0121] 211. Stop executing all threads in this application.

[0122] 212. Resume execution of all threads in the application.

[0123] The specific methods of stopping the execution of all threads in the application and resuming the execution of all threads in the application can refer to existing related technologies and are not limited here.

[0124] In the disclosed embodiment, before hook (execution of the first pile function or the second pile function), all threads in the process are first suspended, and then inlinehook (the first pile function or the second pile function) is executed. After the hook is executed, all threads are resumed, thereby ensuring that other threads are suspended during inlinehook, and the situation where the instruction is modified halfway through execution will not occur, thereby ensuring the security of the application.

[0125] Figure 4 This is a structural block diagram of a function processing device shown in an embodiment of the present disclosure. Figure 4 As shown, it comprises: a generation module 401 and an execution module 402; This generation module 401 is used for inserting the first pile function before the primitive function that the target function of application program calls, and inserting the second pile function after this primitive function, generating a hooked function; This execution module 402 is used for when this target function calls this hooked function, executes this hooked function that this generation module 401 generates, so that according to the execution result of the first pile function and the second pile function, analyzes the execution time or the calling logic of this primitive function, or so that by at least one in the first pile function and the second pile function, increases the calling logic when this target function calls this primitive function.

[0126] Optionally, the first pile function comprises the self-defined first function, and the second pile function comprises the self-defined second function; This device comprises: jump module, preservation module, calls and execution module, update module and acquisition module; Jump module is used for when this target function calls quilt hook function, according to this quilt jump code in the hook function, jumps to the initial parameter register that preserves the primitive function correspondence, and this jump code is obtained by revising the first code in this primitive function; Preservation module is used to preserve target jump address, and this target jump address is used to jump back to this target function; Call and execution module is used to call and execute the first function; Update module is used for the initial parameter register that is preserved before the current parameter register is updated; Call and execution module is also used to call and execute this primitive function after repairing; Preservation module is also used to preserve the result parameter register after the primitive function that is performed after repairing; Call and execution module is also used to call and execute the second function; Acquisition module is used to obtain this target jump address that was preserved before; Update module is also used for the result parameter register that is preserved before the current parameter register is updated; Jump module is also used to jump back to this target function according to this target jump address.

[0127] Optionally, the saving module is specifically configured to save the target jump address through the first assembly code; or save the target jump address by calling a user-defined third function.

[0128] Optionally, the acquisition module is specifically configured to acquire the previously saved target jump address through the second assembly code; or acquire the previously saved target jump address by calling a fourth function.

[0129] Optionally, the first function is an empty function, or the second function is an empty function.

[0130] Optionally, the generating module 401 is specifically configured to insert a first stub function before the original function and a second stub function after the original function when the application loads a dynamic library, so as to generate the hooked function.

[0131] Optionally, the generation module 401 is specifically used to insert a first pile function before the original function and a second pile function after the original function during the running process of the application to generate the hooked function; the device also includes: a stop module and a recovery module; the stop module is used to stop executing all threads in the application after jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function; the recovery module is used to resume executing all threads in the application before calling and executing the original function.

[0132] Optionally, the calling and executing module is specifically used to execute the repaired first code; according to the target address, return to the original function and execute all the codes after the jump code in the original function, and the target address is used to indicate the second code after the jump code in the target function.

[0133] Optionally, the first code is an address-related code, and the repaired first code is obtained by repairing the first code according to the address offset.

[0134] In the embodiments of the present disclosure, each module can implement the function processing method provided in the above method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0135] Figure 5 A structural diagram of an electronic device provided in an embodiment of the present disclosure is used to exemplify an electronic device that implements an arbitrary function processing method in an embodiment of the present disclosure, and should not be understood as a specific limitation on the embodiment of the present disclosure.

[0136] like Figure 5 As shown, the electronic device 500 may include a processor (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. Various programs and data required for the operation of the electronic device 500 are also stored in the RAM 503. The processor 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0137] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 500 is shown as having various devices, it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0138] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processor 501, the functions defined in any function processing method provided in the embodiment of the present disclosure can be executed.

[0139] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. Computer-readable storage media may be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0140] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0141] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0142] The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the electronic device, the electronic device is caused to: insert a first pile function before the original function called by the target function of the application program, and insert a second pile function after the original function to generate a hooked function; when the target function calls the hooked function, execute the hooked function to analyze the execution time or the calling logic of the original function according to the execution result of the first pile function and the second pile function, or to increase the calling logic when the target function calls the original function through at least one of the first pile function and the second pile function.

[0143] In embodiments of the present disclosure, computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the computer, partially on the computer, as a separate software package, partially on the computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0145] The units involved in the embodiments described in this disclosure may be implemented in software or hardware, wherein the name of a unit does not necessarily limit the unit itself.

[0146] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0147] In the context of the present disclosure, a computer-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0149] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0150] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A function processing method, characterized in that: The method comprises: Inserting a first stub function before an original function called by a target function of an application program, and inserting a second stub function after the original function to generate a hooked function; When described target function calls the described quilt hook function, carry out the described quilt hook function, so that according to the execution result of described first pile function and described second pile function, analyze the execution time or the calling logic of described primitive function, perhaps so that by at least one in described first pile function and described second pile function, increase the calling logic when described target function calls the described primitive function; Wherein, the first pile function comprises a self-defined first function, and the second pile function comprises a self-defined second function; When the target function calls the hooked function, executing the hooked function includes: When the target function calls the hooked function, jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function, wherein the jump code is obtained by modifying the first code in the original function; Saving a target jump address, where the target jump address is used to jump back to the target function; Calling and executing the first function; Updating the current parameter register to the previously saved initial parameter register; Calling and executing the repaired original function; Save the result parameter register after executing the repaired original function; Calling and executing the second function; Obtain the previously saved target jump address; Update the current parameter register to the previously saved result parameter register; Jump back to the target function according to the target jump address.

2. The method according to claim 1, characterized in that The storing target jump address includes: Save the target jump address through the first assembly code; or, The target jump address is saved by calling a user-defined third function.

3. The method according to claim 1, characterized in that The obtaining of the previously saved target jump address includes: Obtain the previously saved target jump address through the second assembly code; or, The target jump address saved previously is obtained by calling the fourth function.

4. The method according to claim 1, wherein The first function is an empty function, or the second function is an empty function.

5. The method according to claim 1, wherein The method comprises inserting a first pile function before the original function called by the target function of the application program, and inserting a second pile function after the original function to generate a hooked function, comprising: When the application loads the dynamic library, the first stub function is inserted before the original function, and the second stub function is inserted after the original function to generate the hooked function.

6. The method according to claim 1, characterized in that The method further comprises inserting a first pile function before the original function called by the target function of the application program, and inserting a second pile function after the original function to generate a hooked function. The method further comprises: During the application program running process, inserting the first stub function before the original function and inserting the second stub function after the original function to generate the hooked function; After jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function, the method further includes: Stopping execution of all threads in the application; Before calling and executing the repaired original function, the method further includes: Resume execution of all threads in the application.

7. The method according to any one of claims 1 to 6, characterized in that The original function after executing the repair comprises: executing the repaired first code; According to the target address, return to the original function and execute all codes after the jump code in the original function, wherein the target address is used to indicate the second code after the jump code in the original function.

8. The method according to claim 7, characterized in that The first code is an address-related code, and the repaired first code is obtained by repairing the first code according to the address offset.

9. A function processing device, characterized in that: include: Generate modules and execute modules; Described generation module, is used for inserting the first pile function before the original function called by the target function of application program, and inserting the second pile function after described original function, and generates hooked function; Described execution module, be used for when described target function calls the described quilt hook function, carry out the described quilt hook function that described generation module generates, so that according to the execution result analysis of described primitive function of described first pile function and described second pile function, perhaps so that by at least one in described first pile function and described second pile function, increase the calling logic when described target function calls described primitive function; Wherein, the first pile function comprises a self-defined first function, and the second pile function comprises a self-defined second function; The execution module is specifically used for: When the target function calls the hooked function, jumping to the initial parameter register corresponding to the original function according to the jump code in the hooked function, wherein the jump code is obtained by modifying the first code in the original function; Saving a target jump address, where the target jump address is used to jump back to the target function; Calling and executing the first function; Updating the current parameter register to the previously saved initial parameter register; Calling and executing the repaired original function; Save the result parameter register after executing the repaired original function; Calling and executing the second function; Obtain the previously saved target jump address; Update the current parameter register to the previously saved result parameter register; Jump back to the target function according to the target jump address.

10. An electronic device, characterized in that: include: A memory and a processor, the memory is used to store a computer program; the processor is used to execute the function processing method according to any one of claims 1 to 8 when calling the computer program.

11. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the function processing method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The computer program product stores a computer program, and when the computer program is executed by a processor, the function processing method according to any one of claims 1 to 8 is implemented.

Images