Application processing methods, devices, terminals, and storage media

Abstract

This application provides an application processing method, apparatus, terminal, and storage medium, relating to the field of software technology. By implementing the decryption and loading of the original application in memory, the probability of application content being intercepted can be reduced, thus improving security. The application processing method includes: launching a shell application; decrypting each byte stream file of the original application in memory using the shell application based on multiple keys; obtaining the original application in memory based on each decrypted byte stream file, and replacing the shell application with the original application.

Description

Technical Field

[0001] This application relates to the field of software technology, and in particular to an application processing method, apparatus, terminal and storage medium. Background Technology

[0002] Current Android applications typically use dynamic loading technology. This involves packaging the compiled application into two parts: a loading module and a core logic module. During application startup, the loading module is launched first, releasing the core logic module from the file system and loading it using Java's dynamic loading technology. During this dynamic loading process, attackers can easily intercept the byte stream content of the core logic module by reading and writing to the file system, resulting in low security. Summary of the Invention

[0003] This application provides an application processing method, apparatus, terminal, and storage medium. By implementing the decryption and loading of the original application in memory, the probability of application content being intercepted can be reduced, thereby improving security.

[0004] In a first aspect, embodiments of this application provide an application processing method, including:

[0005] Launch shell application;

[0006] In memory, the shell application decrypts each byte stream file of the original application based on multiple keys;

[0007] The original application is obtained in memory based on each of the decrypted byte stream files, and the shell application is replaced with the original application.

[0008] In one possible implementation, during the process of decrypting each byte stream file of the original application in memory using the shell application based on multiple keys, each byte stream file is decrypted sequentially, and the decryption of each byte stream file includes:

[0009] The first key is obtained from the header of the current byte stream file;

[0010] The second key is obtained by calling a native method based on the filename of the current byte stream file.

[0011] To obtain the third key, for the first byte stream file, use empty as the third key; for other byte stream files besides the first byte stream file, use the MD5 digest of the message digest algorithm of the previous byte stream file as the third key.

[0012] The byte stream content after the header offset is obtained from the current byte stream file based on the first key, the second key, and the third key.

[0013] In one possible implementation, after the shell application is launched and before the shell application is replaced with the original application, other programs are prevented from reading the byte stream file by hooking the system read / write interface.

[0014] In one possible implementation, replacing the shell application with the original application includes:

[0015] The shell application is replaced with the original application using Java reflection.

[0016] In one possible implementation, prior to the application of the boot shell, the following is also included:

[0017] Load the application launcher;

[0018] After replacing the shell application with the original application, the method further includes:

[0019] Load other components and services besides the original application.

[0020] In one possible implementation, prior to the application of the boot shell, the following is also included:

[0021] Retrieve all byte stream files to be encrypted from the original application;

[0022] Each of the byte stream files to be encrypted is subjected to joint encryption to obtain the encrypted byte stream file;

[0023] Package the shell application's byte stream file and all encrypted byte stream files to generate the hardened application file.

[0024] Secondly, embodiments of this application provide an application processing apparatus, including:

[0025] The startup module is used to launch shell applications;

[0026] The decryption module is used to decrypt each byte stream file of the original application in memory using the shell application based on multiple keys;

[0027] A replacement module is used to obtain the original application in memory based on each of the decrypted byte stream files, and replace the shell application with the original application.

[0028] Thirdly, embodiments of this application provide an application processing apparatus, including:

[0029] A processor and a memory, wherein the memory is used to store at least one instruction, which is loaded by the processor and executed to implement the application processing method described above.

[0030] Fourthly, embodiments of this application provide a terminal, including: an application processing device as described in the second or third aspect.

[0031] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the aforementioned application processing method.

[0032] The application processing method, apparatus, terminal, and storage medium in this application embodiment, on the one hand, decrypt and load the byte stream file of the original application within memory. The entire decryption and loading process is performed in memory, rather than loading from the file system, thereby avoiding the problem of byte stream files being easily intercepted by attackers due to loading from the file system, reducing the probability of the original application content being intercepted, and thus improving security. On the other hand, by encrypting the byte stream file of the original application with multiple keys, the possibility of the original application content being cracked is reduced, further improving security. In addition, the original application is loaded in memory without needing to be released from the file system, improving the application loading speed. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating an application processing method in an embodiment of this application.

[0034] Figure 2 for Figure 1 A detailed flowchart of step 102;

[0035] Figure 3 This is a flowchart illustrating another application processing method in an embodiment of this application;

[0036] Figure 4 This is a flowchart illustrating another application processing method in the embodiments of this application;

[0037] Figure 5 This is a structural block diagram of an application processing device according to an embodiment of this application;

[0038] Figure 6 This is a structural block diagram of another application processing device in the embodiments of this application;

[0039] Figure 7 This is a structural block diagram of another application processing device in the embodiments of this application. Detailed Implementation

[0040] The terminology used in the implementation section of this application is for the purpose of explaining specific embodiments of this application only, and is not intended to limit this application.

[0041] like Figure 1 As shown, this application embodiment provides an application processing method that can be applied to terminals such as mobile phones. That is, the executing entity of this application processing method can be a terminal. It mainly involves the process of loading applications into the terminal system. This application embodiment uses an application processing method in the Android system as an example for illustration. This application processing method includes:

[0042] Step 101: Launch the shell application;

[0043] For example, for the application to be loaded, the application's file is a hardened file. The hardened file can include the shell application's byte stream file and the original application's byte stream file. The byte stream file can be a dex format file, which is a bytecode file that the Android underlying virtual machine Dalvik can parse. The shell application can be launched based on the shell application's byte stream file.

[0044] Step 102: In memory, the shell application decrypts each byte stream file of the original application based on multiple keys;

[0045] In the hardened file, the original application's byte stream file is a file encrypted with multiple keys. The original application's byte stream file contains the core logic, while the shell application is only used during the application loading process. In this step, the shell application can decrypt each byte stream file of the original application so that the core logic can be loaded based on the content of the decrypted byte stream file.

[0046] Step 103: Obtain the original application in memory based on each decrypted byte stream file, and replace the shell application with the original application.

[0047] The shell application's main function is decryption. Therefore, after decryption is complete, the shell application can be replaced with the original application obtained after decryption to load the original application.

[0048] The application processing method in this embodiment, on the one hand, decrypts and loads the byte stream file of the original application within memory. The entire decryption and loading process is performed in memory, rather than loading from the file system, thereby avoiding the problem that the byte stream file is easily intercepted by attackers due to loading from the file system, reducing the probability of the original application content being intercepted, and thus improving security. On the other hand, by encrypting the byte stream file of the original application with multiple keys, the possibility of the original application content being cracked is reduced, further improving security. In addition, the original application is loaded in memory without needing to be released from the file system, which improves the application loading speed.

[0049] In one possible implementation, such as Figure 2 As shown, in step 103 above, during the process of decrypting each byte stream file of the original application in memory using multiple keys through the shell application, each byte stream file is decrypted sequentially. The decryption of each byte stream file includes:

[0050] Step 1031: Obtain the first key based on the current byte stream file header;

[0051] Step 1032: Obtain the second key by calling a native method based on the filename of the current byte stream file;

[0052] Step 1033: Obtain the third key. For the first byte stream file, use empty as the third key. For other byte stream files besides the first byte stream file, use the MD5 digest of the message digest algorithm of the previous byte stream file as the third key.

[0053] Step 1034: Decrypt the byte stream content after obtaining the header offset of the current byte stream file based on the first key, the second key, and the third key.

[0054] Specifically, for example, in the hardened file, the original application's byte stream files sequentially include dex, dex1, dex2, ..., dexn. Each byte stream file includes header content and content after the header offset. The content after the header offset is encrypted. In step 1031, the first key P used to decrypt the content after the header offset can be obtained based on the header content of the current byte stream file. In step 1032, the second key Pdex of the file can be obtained by calling the jni function based on the filename of the current byte stream file. In step 1033, if it is determined that the current byte stream file is the first byte stream file dex of the original file, then the third key Pmd5 is set to empty. For example, for the first byte stream file dex, the corresponding joint key Pu can be obtained based on the above three keys, Pu = P + Pdex + Pmd5. The content after the header offset of dex can be decrypted based on the joint key Pu. After the first byte stream file (dex) is decrypted, the next byte stream file (dex1) is decrypted. The process of obtaining the first key P and the second key Pdex is similar. For the third key Pmd5, since the previous byte stream file was dex, the MD5 hash of the decrypted previous byte stream file (dex) is calculated and used as the third key Pmd5 for the current byte stream file (dex1). Then, the combined key obtained from the three keys is used to decrypt the current byte stream file (dex1), yielding the content after the header offset. This process is repeated for each byte stream file, following the same logic. It should be noted that this embodiment does not limit the execution order of steps 1031, 1032, and 1033. They can be executed in any order or simultaneously, as long as the three keys corresponding to the current byte stream are obtained. The decryption process in steps 1031-1033 can be executed at the JNI layer (native layer), making it more difficult to crack than lower-level decryption processes. Each byte stream file in the original application is encrypted with a different key. The different keys are distributed differently and form a chain encryption between the byte stream files, which further improves security. In addition, the decryption key is automatically generated within the program, which can increase the difficulty of decryption.

[0055] In one possible implementation, after launching the shell application in step 101 and before replacing the shell application with the original application in step 103, other programs are prevented from reading the byte stream file by hooking the system's read / write interface. During application loading, hooking relevant functions of the interface can further prevent the original application from being intercepted by other programs during loading, thereby improving security.

[0056] In one possible implementation, step 103 above, replacing the shell application with the original application, includes: replacing the shell application with the original application through Java reflection mechanism.

[0057] In one possible implementation, such as Figure 3 As shown, before step 101 and the launch shell application, the following steps are also included:

[0058] Step 100: Load the application launcher to manage the Android component lifecycle. After loading the launcher, in step 101, the system initializes the shell application within the launcher to start the shell application.

[0059] Step 103, after replacing the shell application with the original application, also includes:

[0060] Step 104: Load other components and services besides the original application.

[0061] In one possible implementation, such as Figure 4 As shown, before step 101 and launching the shell application, the following steps are also included:

[0062] Step 201: Obtain all byte stream files to be encrypted from the original application;

[0063] Step 202: Perform joint encryption on each byte stream file to be encrypted to obtain the encrypted byte stream file;

[0064] Step 203: Package the shell application's byte stream file and all encrypted byte stream files to generate the hardened application file.

[0065] Specifically, steps 201-203 are pre-executed application hardening processes. In step 201, the original Android application package (apk) file can be parsed and released, the registered original application can be found, and all byte stream files in the original apk can be obtained. Then, in step 202, for each byte stream file, the byte stream file is jointly encrypted based on the first key, the second key, and the third key. Each key is the same as in the above embodiment, that is, the first key is generated based on the file header information of each byte stream file, the second key is generated based on its file name, and the MD5 digest of each byte stream file is used as the third key for the next byte stream file. In step 203, all encrypted byte stream files are repackaged to form a new application file. The first byte stream file of the original application can be stitched with the byte stream file of the shell application, for example, it can be located before the first byte stream file of the original application. For example, the byte stream file of the shell application, the encrypted byte stream file, and the size information of the encrypted byte stream file can be added to the new application file to realize the process of generating the hardened application file. In this embodiment, the DES symmetric encryption / decryption process can be applied to make the file encryption more secure and efficient. During the application loading process, based on the hardened application file, the shell application will be launched first based on the byte stream file of the shell application, that is, steps 101 to 103 above will be executed. Throughout the process, since the actual content of the original APK is not modified, the original application is obtained after the shell application is replaced in step 103, which enhances the application's compatibility.

[0066] like Figure 5 As shown in the illustration, this application also provides an application processing apparatus, including: a startup module 1 for starting a shell application; a decryption module 2 for decrypting each byte stream file of the original application in memory using the shell application based on multiple keys; and a replacement module 3 for obtaining the original application in memory based on each decrypted byte stream file, and replacing the shell application with the original application. This application processing apparatus can apply the above-described application processing method, and its specific process and principle are the same as those in the above embodiments, and will not be repeated here.

[0067] In one possible implementation, such as Figure 6As shown, the decryption module 2 includes: a first acquisition unit 21, used to obtain a first key based on the header of the current byte stream file; a second acquisition unit 22, used to obtain a second key based on the filename of the current byte stream file through a native method call; a third acquisition unit 23, used to obtain a third key, where for the first byte stream file, an empty string is used as the third key, and for other byte stream files besides the first byte stream file, the MD5 digest of the previous byte stream file is used as the third key; and a decryption unit 24, used to decrypt the byte stream content after obtaining the header offset of the current byte stream file based on the first key, the second key, and the third key.

[0068] In one possible implementation, such as Figure 6 As shown, the application processing device also includes a Hook module 4, which is used to prevent other programs from reading byte stream files by hooking the system read / write interface after the shell application is launched and before the shell application is replaced with the original application.

[0069] In one possible implementation, such as Figure 6 As shown, replacement module 3 is specifically used to obtain the original application in memory based on each decrypted byte stream file, and replace the shell application with the original application through the Java reflection mechanism.

[0070] In one possible implementation, such as Figure 6 As shown, the application processing device also includes: a preloading module 5 for loading the application launcher; and a component loading module 6 for loading other components and services besides the original application.

[0071] In one possible implementation, such as Figure 7 As shown, the application processing device further includes: an acquisition module 01, used to acquire all the byte stream files to be encrypted in the original application; an encryption module 02, used to perform joint encryption on each byte stream file to be encrypted to obtain an encrypted byte stream file; and a packaging module 03, used to package the byte stream file of the shell application and all the encrypted byte stream files to generate a hardened application file.

[0072] It should be understood that the division of the various modules in the above application processing device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented in software via processing element calls, while others are implemented in hardware. For example, any one or more of the startup module 1, decryption module 2, and replacement module 3 can be a separate processing element, or they can be integrated into, for example, a chip. Alternatively, they can be stored as programs in memory, called and executed by a processing element. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or implemented independently. The processing element mentioned here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0073] For example, any one or more of the above modules, such as startup module 1, decryption module 2, and replacement module 3, can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital processors (DSPs), or one or more field-programmable gate arrays (FPGAs). Furthermore, when any one or more of the above modules, such as startup module 1, decryption module 2, and replacement module 3, are implemented through a processing element scheduler, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling programs. Moreover, these modules can be integrated together to implement a system-on-a-chip (SOC).

[0074] This application also provides an application processing apparatus, including a processor and a memory. The memory stores at least one instruction, which is loaded and executed by the processor to implement the application processing method in any of the above embodiments. The specific process and principle of the application processing method are the same as those in the above embodiments, and will not be repeated here.

[0075] The number of processors can be one or more, and the processors and memory can be connected via a bus or other means. Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the application processing device in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the methods in any of the above method embodiments. The memory may include a program storage area and a data storage area, wherein the program storage area may store the operating system, at least one application program required for a function, and necessary data, etc. Furthermore, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device.

[0076] This application also provides a terminal, including: the application processing device in any of the above embodiments. The terminal can be any electronic product with application processing capabilities, such as a mobile phone, television, tablet computer, navigator, or watch.

[0077] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to execute the application processing method described in any of the above embodiments.

[0078] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive).

[0079] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0080] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An application processing method, characterized in that, include: Launch shell application; In memory, the shell application decrypts each byte stream file of the original application based on multiple keys; The original application is obtained in memory based on each of the decrypted byte stream files, and the shell application is replaced with the original application. In the process of decrypting each byte stream file of the original application in memory using the shell application based on multiple keys, each byte stream file is decrypted sequentially, and the decryption of each byte stream file includes: The first key is obtained from the header of the current byte stream file; The second key is obtained by calling a native method based on the filename of the current byte stream file. To obtain the third key, for the first byte stream file, use empty as the third key; for other byte stream files besides the first byte stream file, use the MD5 digest of the message digest algorithm of the previous byte stream file as the third key. The byte stream content after the header offset is obtained from the current byte stream file based on the first key, the second key, and the third key.

2. The application processing method according to claim 1, characterized in that, After the shell application is launched and before it is replaced with the original application, other programs are prevented from reading the byte stream file by hooking the system read / write interface.

3. The application processing method according to claim 1, characterized in that, The step of replacing the shell application with the original application includes: The shell application is replaced with the original application using Java reflection.

4. The application processing method according to claim 1, characterized in that, Prior to the application of the boot shell, the following is also included: Load the application launcher; After replacing the shell application with the original application, the method further includes: Load other components and services besides the original application.

5. The application processing method according to claim 1, characterized in that, Prior to the application of the boot shell, the following is also included: Retrieve all byte stream files to be encrypted from the original application; Each of the byte stream files to be encrypted is subjected to joint encryption to obtain the encrypted byte stream file; Package the shell application's byte stream file and all encrypted byte stream files to generate the hardened application file.

6. An application processing device, characterized in that, include: The startup module is used to launch shell applications; The decryption module is used to decrypt each byte stream file of the original application in memory using the shell application based on multiple keys; A replacement module is used to obtain the original application in memory based on each of the decrypted byte stream files, and replace the shell application with the original application; In the process of decrypting each byte stream file of the original application in memory using the shell application based on multiple keys, each byte stream file is decrypted sequentially, and the decryption of each byte stream file includes: The first key is obtained from the header of the current byte stream file; The second key is obtained by calling a native method based on the filename of the current byte stream file. To obtain the third key, for the first byte stream file, use empty as the third key; for other byte stream files besides the first byte stream file, use the MD5 digest of the message digest algorithm of the previous byte stream file as the third key. The byte stream content after the header offset is obtained from the current byte stream file based on the first key, the second key, and the third key.

7. An application processing device, characterized in that, include: A processor and a memory, the memory being used to store at least one instruction, which, when loaded and executed by the processor, implements the application processing method as described in any one of claims 1 to 5.

8. A terminal, characterized in that, include: The application processing apparatus as described in claim 6 or 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the application processing method as described in any one of claims 1 to 5.

Images