Function calling method, apparatus, device, and storage medium

Abstract

The application discloses a function calling method and device, equipment and storage medium, belongs to hook technical field, the method includes: when detecting that the target program starts, load hook component, the target program is the program that starts the hatcher process for hatching and injects code after the operating system starts, and the hook function is executed through the hook component to call the target function. The application can avoid being detected by the program through the hook framework without characteristics, and better hook effect can be achieved.

Description

Technical Field

[0001] This invention relates to the field of hook technology, and in particular to a function call method, apparatus, device, and storage medium. Background Technology

[0002] When performing Android reverse engineering, hook frameworks such as Xposed and Frida are commonly used. However, some apps can detect these common hook frameworks, rendering them unusable and hindering the reverse engineering process. Summary of the Invention

[0003] The main objective of this invention is to provide a function call method, apparatus, device, and storage medium, which aims to solve the technical problem of how to avoid detection when hooking a program in order to achieve a better hooking effect.

[0004] To achieve the above objectives, embodiments of the present invention provide a function call method, the function call method comprising:

[0005] When the target program is detected to be starting, the hook component is loaded. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts.

[0006] The hook component executes the hook function to call the target function.

[0007] Optionally, the hook component includes: a first hook file and a second hook file;

[0008] The step of executing the hook function to call the target function through the hook component includes:

[0009] The hook function calls the target function by executing the hook function through the first hook file and the second hook file.

[0010] Optionally, the first hook file is a dex file, and the second hook file is an so file;

[0011] The step of executing the hook function to call the target function through the first hook file and the second hook file includes:

[0012] When the first hook file is executed, the second hook file is loaded;

[0013] The hook function is executed through the second hook file to call the target function.

[0014] Optionally, the step of executing the hook function to call the target function through the second hook file includes:

[0015] The second hook file redefines the functions in the classes of the target program, and then jumps to execute the hook functions in the first hook file;

[0016] The target function is called through the hook function.

[0017] Optionally, the step of executing the hook function call to the target function through the hook component includes:

[0018] When a button click command is detected, the hook component executes the hook function to call the target function.

[0019] Optionally, loading the hook component when the target program is detected to be running includes:

[0020] When the target program is detected to be starting, the file loading function is invoked;

[0021] The hook component is loaded using a preset field in the loading file.

[0022] Optionally, before loading the hook component upon detecting the target program's startup, the process further includes:

[0023] After the operating system starts, the incubator process is launched to incubate the program;

[0024] When the target program is incubated, code injection is performed on the target program.

[0025] Optionally, the step of injecting code into the target program when it is hatched includes:

[0026] When the target program is hatched, the injection program is invoked;

[0027] The injection program injects code into the target program.

[0028] Optionally, before executing the hook function call to the target function through the hook component, the method further includes:

[0029] Upon receiving a writing instruction, the hook information is determined based on the writing instruction;

[0030] The hook component is obtained based on the hook information.

[0031] Optionally, obtaining the hook component based on the hook information includes:

[0032] A first hook file is generated based on the hook information;

[0033] Configure a corresponding second hook file for the first hook file;

[0034] The hook component is obtained based on the first hook file and the second hook file.

[0035] Furthermore, to achieve the above objectives, embodiments of the present invention also propose a function call device, the function call device comprising:

[0036] The component loading module is used to load the hook component when the target program is detected to be starting. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts.

[0037] The function call module is used to execute the hook function call to the target function through the hook component.

[0038] Optionally, the hook component includes: a first hook file and a second hook file;

[0039] The function call module is also used to execute the hook function call target function through the first hook file and the second hook file.

[0040] Optionally, the first hook file is a dex file, and the second hook file is an so file;

[0041] The function call module is further configured to load the second hook file when the first hook file is executed, and to execute the hook function to call the target function through the second hook file.

[0042] Optionally, the function call module is further configured to redefine functions in classes of the target program through the second hook file, jump to execute the hook function in the first hook file, and call the target function through the hook function.

[0043] Optionally, the function call module is further configured to execute the hook function call target function through the hook component when a button click instruction is detected.

[0044] Optionally, the component loading module is further configured to call a loading file when the target program is detected to be starting; and load the hook component through a preset field in the loading file.

[0045] Optionally, the function calling device further includes:

[0046] The program incubation module is used to start the incubator process to incubate programs after the operating system starts; when a target program is incubated, code is injected into the target program.

[0047] Optionally, the program incubation module is further configured to call the injection program when the target program is incubated; and to inject code into the target program through the injection program.

[0048] Furthermore, to achieve the above objectives, this embodiment of the invention also proposes a function call device, which includes: a memory, a processor, and a function call program stored in the memory and executable on the processor. When the function call program is executed by the processor, it implements the function call method as described above.

[0049] In addition, to achieve the above objectives, this embodiment of the invention also proposes a storage medium storing a function calling program, which, when executed by a processor, implements the function calling method as described above.

[0050] In the function call method proposed in this embodiment of the invention, a hook component is loaded when the target program is detected to be starting. The target program is a program that starts an incubator process to incubate and inject code after the operating system starts. The hook component executes the hook function to call the target function. The solution of this embodiment can avoid being detected by the program through a featureless hook framework, thus achieving a better hooking effect. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of the function call device structure of the hardware operating environment involved in the embodiments of the present invention;

[0052] Figure 2 This is a flowchart illustrating the first embodiment of the function call method of the present invention;

[0053] Figure 3 This is a schematic diagram of the original function execution flow according to an embodiment of the function call method of the present invention;

[0054] Figure 4 This is a schematic diagram of the app injection process according to an embodiment of the function call method of the present invention;

[0055] Figure 5 This is a schematic diagram of the zygote injection process according to an embodiment of the function call method of the present invention;

[0056] Figure 6 This is a flowchart illustrating the second embodiment of the function call method of the present invention;

[0057] Figure 7 This is a flowchart illustrating the third embodiment of the function call method of the present invention;

[0058] Figure 8This is a schematic diagram of the functional modules of the first embodiment of the function call device of the present invention.

[0059] The realization of the objectives, functional features and advantages of the embodiments of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0060] It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of the present invention and are not intended to limit the embodiments of the present invention.

[0061] Reference Figure 1 , Figure 1 This is a schematic diagram of the function call device structure of the hardware operating environment involved in the embodiments of the present invention.

[0062] like Figure 1 As shown, the function calling device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to implement communication between these components. The user interface 1003 may include a display screen and input units such as buttons; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed random access memory (RAM) or non-volatile memory, such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0063] Those skilled in the art will understand that Figure 1 The device structure shown does not constitute a limitation on the function calling device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0064] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a function calling program.

[0065] exist Figure 1In the function call device shown, the network interface 1004 is mainly used to connect to the external network and communicate with other network devices; the user interface 1003 is mainly used to connect to the user equipment and communicate with the user equipment; the device of this embodiment calls the function call program stored in the memory 1005 through the processor 1001 and executes the function call method provided by this embodiment.

[0066] Based on the above hardware structure, an embodiment of the function call method of the present invention is proposed.

[0067] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the function call method of the present invention.

[0068] In the first embodiment, the function call method includes:

[0069] Step S10: When the target program is detected to be starting, the hook component is loaded. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts.

[0070] It should be noted that the execution subject in this embodiment can be a function call device, which can be a computer device with data processing function, or other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment, a computer device is used as an example for explanation.

[0071] In specific implementations, the computer device in this embodiment may include, but is not limited to, various types of devices such as mobile phones, tablets, and smart wearable devices. This embodiment does not impose any restrictions on this.

[0072] It should be understood that this solution can be applied to the Android system or other similar operating systems. This embodiment does not limit it. In this embodiment, the solution is applied to the Android system as an example. That is, the operating system of the computer device in this embodiment can be the Android system.

[0073] It should be noted that, as Figure 3 and Figure 4 As shown, Figure 3 This is a schematic diagram of the original function execution flow. Figure 4This is a schematic diagram of the app injection process. When performing Android reverse engineering, hook frameworks such as Xposed and Frida are commonly used. However, these common hook frameworks are detected by some apps, rendering them unusable and hindering reverse engineering. Searching for detection points individually for each app is time-consuming; for hardened apps, the difficulty is even greater. Therefore, this solution proposes a featureless hook framework to help Android reverse engineers solve some of these problems and achieve better reverse engineering results.

[0074] It should be understood that the incubator process in this embodiment may include, but is not limited to, zygote. This embodiment does not limit this. In this embodiment, zygote is used as an example for illustration.

[0075] It is understandable that... Figure 5 As shown, Figure 5 The diagram illustrates the zygote injection process. After the Android system boots, it launches processes such as init and zygote. zygote is the core process, which starts the Dalvik virtual machine and acts as an incubator process, repeatedly calling forkAndSpecialize to incubate all apps. Therefore, it's technically possible to intercept the forkAndSpecialize function of zygote. After the target app is incubated, libloaddex.so is loaded, completing the code injection for all apps.

[0076] It should be noted that in this embodiment, the incubator injection functionality can be implemented jointly by the Magisk framework, riru-core, and the riru plugin. The Magisk framework is an open-source tool that enables root privilege management and provides plugin interfaces for developers to extend their code. riru-core is essentially a Magisk plugin; it primarily provides the incubator injection interface and also has its own plugin interface for developers to write incubator injection code. The riru plugin adds the functionality to load libloaddex.so.

[0077] It should be understood that when loading the hook component, based on the characteristics of the so library, the initialization functions of the .init section and .init_array section will be called sequentially upon loading. In the .init_array section of libloaddex.so, hook.dex is loaded, and the initHook method in hook.dex is called. Because Android does not allow direct cross-process injection of dex files, libloaddex.so is introduced; this embodiment does not impose any restrictions on this.

[0078] Furthermore, it can be like Figure 5 As shown, after the operating system starts, an incubator process can be launched to incubate the program, and code injection is performed on the target program when it is incubated. Therefore, the target program can be any program that is incubated and injected with code by launching the incubator process after the operating system starts; this embodiment does not limit this.

[0079] It is understandable that, to achieve better injection results, an injection program can be invoked when the target program is hatched, and code injection can be performed on the target program through the injection program. In this embodiment, the injection program may include, but is not limited to, the inject program; this embodiment does not impose any restrictions on this.

[0080] It should be noted that the inject program in this embodiment is a tool written to inject into a single app process. The hook component consists of hook.dex and hook.so, which are at the lowest level and are used to hook Java functions.

[0081] Furthermore, to achieve better loading performance, a loading file can be invoked when the target program is detected to be starting, and the hook component can be loaded through preset fields in the loading file. In this embodiment, the loading file may include, but is not limited to, libloaddex.so, and the preset fields in the loading file may include, but are not limited to, the .init_array section in libloaddex.so. That is, the hook component can be loaded through the .init_array section in libloaddex.so; this embodiment does not impose any restrictions on this.

[0082] Step S20: The hook function is executed by calling the target function through the hook component.

[0083] It should be understood that in this embodiment, the hook function can be executed to call the target function through the first hook file and the second hook file, wherein the target function can be... Figure 5 The key functions shown are not limited in this embodiment.

[0084] It is understandable that when the first hook file is executed, the second hook file can be loaded, and then the function in the class of the target program can be redefined through the second hook file. Then, the execution of the hook function in the first hook file can be jumped to, and the target function can be called and executed through the hook function.

[0085] It should be noted that the core hook component in this embodiment consists of hook.dex and hook.so. In this embodiment, hook.dex is referred to as the first hook file, and hook.so is referred to as the second hook file. That is, the first hook file is a dex file, and the second hook file is a so file. Moreover, the terms "first" and "second" in this embodiment are only for the convenience of distinguishing different objects and do not impose any other restrictions. This embodiment does not impose any restrictions on this. In hook.dex, reverse engineers need to write code to specify the class to be hooked, the hook function, and the hook code. When the dex is executed, it will automatically load hook.so to execute the hook. hook.so is the most important part of implementing the hook. The principle is mainly based on the Android Instrumentation mechanism to redefine the functions in the classes of the target app, so that the methods that should have been executed jump to the hook methods defined in hook.dex for execution.

[0086] Furthermore, such as Figure 5 As shown, to avoid mishandling, after loading the hook component, it is also possible to monitor whether there is a user-input button click command. When a button click command is detected, the hook function is executed through the hook component to call the target function and execute the target function. This embodiment does not impose any restrictions on this.

[0087] Furthermore, to achieve better hooking results, the hook component can be set up by the reverse engineer first. For example, when setting up a hook component, the reverse engineer can input writing instructions. When the computer device receives the writing instructions, it can determine the hook information based on the instructions and then obtain the hook component based on the hook information. In this embodiment, the hook information may include, but is not limited to, the class to be hooked, the hook function, and the hook code. This embodiment does not impose any restrictions on this.

[0088] It should be understood that a first hook file can be generated based on the hook information, and a corresponding second hook file can be configured for the first hook file. Then, the hook component can be obtained based on the first hook file and the second hook file.

[0089] In a specific implementation, a hook.dex can be generated based on information such as the class to be hooked, the hook function, and the hook code. Then, a corresponding hook.so can be configured for the hook.dex, and the hook file can be obtained based on the hook.dex and hook.so. This embodiment does not impose any restrictions on this.

[0090] Understandably, the greatest value of the hook framework in this solution lies in its ability to hook the vast majority of apps. However, mainstream methods such as Xposed and Frida require significantly more time to overcome anti-debugging and anti-hook measures once detected, and may even prevent further analysis. Therefore, compared to existing technologies, the solution in this embodiment can avoid detection through a featureless hook framework, achieving better hooking results and making reverse engineering of apps more convenient.

[0091] In this embodiment, upon detecting the startup of a target program, a hook component is loaded. The target program is a program that, after the operating system starts, initiates an incubator process to incubate and inject code. The hook component executes a hook function to call the target function. This embodiment's solution, using a featureless hook framework, avoids detection by the program and achieves better hooking results.

[0092] In one embodiment, such as Figure 6 As shown, a second embodiment of the function call method of the present invention is proposed based on the first embodiment. The hook component includes: a first hook file and a second hook file.

[0093] Step S20 includes:

[0094] Step S201: Execute the hook function to call the target function through the first hook file and the second hook file.

[0095] It should be noted that in this embodiment, the first hook file can be a dex file and the second hook file can be a so file; this embodiment does not impose any restrictions on this. In a specific implementation, the first hook file can be hook.dex and the second hook file can be hook.so, with hook.dex and hook.so forming the hook component; this embodiment does not impose any restrictions on this either.

[0096] It should be understood that when the first hook file is executed, the second hook file can be loaded. Then, the second hook file can redefine functions in the target program's classes, jump to execute the hook function in the first hook file, and then call and execute the target function through the hook function. The target function can be... Figure 5The key functions shown are not limited in this embodiment.

[0097] It should be noted that the hook.dex file requires reverse engineers to write code specifying the class to be hooked, the hook function, and the hook code. When the dex is executed, it will automatically load hook.so to execute the hook. hook.so is the most important part of implementing the hook. The principle is mainly to rely on the Android Instrumentation mechanism to redefine the functions in the classes of the target app, so that the methods that should have been executed jump to the hook methods defined in hook.dex.

[0098] In specific implementations, it can be as follows: Figure 5 As shown, after incubating the process and injecting code through the incubator process, the hook component can be loaded via libloaddex.so for all launched apps. Furthermore, hook.so can be automatically loaded when hook.dex is executed, and then, through the Android Instrumentation mechanism, hook.so redefines functions in classes within the target program, adjusts the execution of hook functions in hook.dex, and then calls and executes key functions through these hook functions.

[0099] In this embodiment, the hook component includes a first hook file and a second hook file. The hook function is executed through the first hook file and the second hook file to call the target function, thereby avoiding detection and preventing the app from becoming unusable if discovered, thus improving the effectiveness of reverse engineering of the app.

[0100] In one embodiment, such as Figure 7 As shown, a third embodiment of the function call method of the present invention is proposed based on the first or second embodiment. In this embodiment, the description is based on the first embodiment. Before step S10, the method further includes:

[0101] Step S01: After the operating system starts, start the incubator process to incubate the program.

[0102] It should be noted that this embodiment utilizes the Magisk framework, riru-core, and the riru plugin to implement the incubator injection functionality. The Magisk framework is an open-source tool that enables root privilege management and provides plugin interfaces for developers to extend their code. riru-core is essentially a Magisk plugin, primarily providing the incubator injection interface, and it also has its own plugin interface for developers to write incubator injection code. The riru plugin adds the functionality to load libloaddex.so.

[0103] It should be understood that after the Android system starts, it will start processes such as init and zygote. Among them, zygote is the core process, which will start the Dalvik virtual machine. As an incubator process, it will call forkAndSpecialize multiple times to incubate all apps.

[0104] Step S02: When the target program is hatched, code injection is performed on the target program.

[0105] It should be understood that this embodiment can technically intercept the forkAndSpecialize function of zygote. After the target app is hatched, libloaddex.so is loaded, thus completing the code injection for all apps.

[0106] It is understandable that after the target program is incubated, an injection program can be called to inject code into the target program in order to achieve a better injection effect. The injection program in this embodiment may include, but is not limited to, the inject program; this embodiment does not impose any restrictions on this. Specifically, the inject program in this embodiment is a tool developed to inject code into a single app process.

[0107] In this embodiment, after the operating system starts, the incubator process is started to incubate the program. When the target program is incubated, code injection is performed on the target program, thereby achieving a better injection effect and further improving the effect of function calls and reverse analysis.

[0108] Furthermore, embodiments of the present invention also propose a storage medium storing a function calling program, which, when executed by a processor, implements the steps of the function calling method described above.

[0109] Since this storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be repeated here.

[0110] In addition, refer to Figure 8 The present invention also proposes a function call device, the function call device comprising:

[0111] The component loading module 10 is used to load the hook component when the target program is detected to be starting. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts.

[0112] In specific implementations, the computer device in this embodiment may include, but is not limited to, various types of devices such as mobile phones, tablets, and smart wearable devices. This embodiment does not impose any restrictions on this.

[0113] It should be understood that this solution can be applied to the Android system or other similar operating systems. This embodiment does not limit it. In this embodiment, the solution is applied to the Android system as an example. That is, the operating system of the computer device in this embodiment can be the Android system.

[0114] It should be noted that, as Figure 3 and Figure 4 As shown, Figure 3 This is a schematic diagram of the original function execution flow. Figure 4 This is a schematic diagram of the app injection process. When performing Android reverse engineering, hook frameworks such as Xposed and Frida are commonly used. However, these common hook frameworks are detected by some apps, rendering them unusable and hindering reverse engineering. Searching for detection points individually for each app is time-consuming; for hardened apps, the difficulty is even greater. Therefore, this solution proposes a featureless hook framework to help Android reverse engineers solve some of these problems and achieve better reverse engineering results.

[0115] It should be understood that the incubator process in this embodiment may include, but is not limited to, zygote. This embodiment does not limit this. In this embodiment, zygote is used as an example for illustration.

[0116] It is understandable that... Figure 5 As shown, Figure 5The diagram illustrates the zygote injection process. After the Android system boots, it launches processes such as init and zygote. zygote is the core process, which starts the Dalvik virtual machine and acts as an incubator process, repeatedly calling forkAndSpecialize to incubate all apps. Therefore, it's technically possible to intercept the forkAndSpecialize function of zygote. After the target app is incubated, libloaddex.so is loaded, completing the code injection for all apps.

[0117] It should be noted that in this embodiment, the incubator injection functionality can be implemented jointly by the Magisk framework, riru-core, and the riru plugin. The Magisk framework is an open-source tool that enables root privilege management and provides plugin interfaces for developers to extend their code. riru-core is essentially a Magisk plugin; it primarily provides the incubator injection interface and also has its own plugin interface for developers to write incubator injection code. The riru plugin adds the functionality to load libloaddex.so.

[0118] It should be understood that when loading the hook component, based on the characteristics of the so library, the initialization functions of the .init section and .init_array section will be called sequentially upon loading. In the .init_array section of libloaddex.so, hook.dex is loaded, and the initHook method in hook.dex is called. Because Android does not allow direct cross-process injection of dex files, libloaddex.so is introduced; this embodiment does not impose any restrictions on this.

[0119] Furthermore, it can be like Figure 5 As shown, after the operating system starts, an incubator process can be launched to incubate the program, and code injection is performed on the target program when it is incubated. Therefore, the target program can be any program that is incubated and injected with code by launching the incubator process after the operating system starts; this embodiment does not limit this.

[0120] It is understandable that, to achieve better injection results, an injection program can be invoked when the target program is hatched, and code injection can be performed on the target program through the injection program. In this embodiment, the injection program may include, but is not limited to, the inject program; this embodiment does not impose any restrictions on this.

[0121] It should be noted that the inject program in this embodiment is a tool written to inject into a single app process. The hook component consists of hook.dex and hook.so, which are at the lowest level and are used to hook Java functions.

[0122] Furthermore, to achieve better loading performance, a loading file can be invoked when the target program is detected to be starting, and the hook component can be loaded through preset fields in the loading file. In this embodiment, the loading file may include, but is not limited to, libloaddex.so, and the preset fields in the loading file may include, but are not limited to, the .init_array section in libloaddex.so. That is, the hook component can be loaded through the .init_array section in libloaddex.so; this embodiment does not impose any restrictions on this.

[0123] The function call module 20 is used to execute the hook function call target function through the hook component.

[0124] It should be understood that in this embodiment, the hook function can be executed to call the target function through the first hook file and the second hook file, wherein the target function can be... Figure 5 The key functions shown are not limited in this embodiment.

[0125] It is understandable that when the first hook file is executed, the second hook file can be loaded, and then the function in the class of the target program can be redefined through the second hook file. Then, the execution of the hook function in the first hook file can be jumped to, and the target function can be called and executed through the hook function.

[0126] It should be noted that the core hook component in this embodiment consists of hook.dex and hook.so. In this embodiment, hook.dex is referred to as the first hook file, and hook.so is referred to as the second hook file. That is, the first hook file is a dex file, and the second hook file is a so file. Moreover, the terms "first" and "second" in this embodiment are only for the convenience of distinguishing different objects and do not impose any other restrictions. This embodiment does not impose any restrictions on this. In hook.dex, reverse engineers need to write code to specify the class to be hooked, the hook function, and the hook code. When the dex is executed, it will automatically load hook.so to execute the hook. hook.so is the most important part of implementing the hook. The principle is mainly based on the Android Instrumentation mechanism to redefine the functions in the classes of the target app, so that the methods that should have been executed jump to the hook methods defined in hook.dex for execution.

[0127] Furthermore, such as Figure 5 As shown, to avoid mishandling, after loading the hook component, it is also possible to monitor whether there is a user-input button click command. When a button click command is detected, the hook function is executed through the hook component to call the target function and execute the target function. This embodiment does not impose any restrictions on this.

[0128] Furthermore, to achieve better hooking results, the hook component can be set up by the reverse engineer first. For example, when setting up a hook component, the reverse engineer can input writing instructions. When the computer device receives the writing instructions, it can determine the hook information based on the instructions and then obtain the hook component based on the hook information. In this embodiment, the hook information may include, but is not limited to, the class to be hooked, the hook function, and the hook code. This embodiment does not impose any restrictions on this.

[0129] It should be understood that a first hook file can be generated based on the hook information, and a corresponding second hook file can be configured for the first hook file. Then, the hook component can be obtained based on the first hook file and the second hook file.

[0130] In a specific implementation, a hook.dex can be generated based on information such as the class to be hooked, the hook function, and the hook code. Then, a corresponding hook.so can be configured for the hook.dex, and the hook file can be obtained based on the hook.dex and hook.so. This embodiment does not impose any restrictions on this.

[0131] Understandably, the greatest value of the hook framework in this solution lies in its ability to hook the vast majority of apps. However, mainstream methods such as Xposed and Frida require significantly more time to overcome anti-debugging and anti-hook measures once detected, and may even prevent further analysis. Therefore, compared to existing technologies, the solution in this embodiment can avoid detection through a featureless hook framework, achieving better hooking results and making reverse engineering of apps more convenient.

[0132] In this embodiment, upon detecting the startup of a target program, a hook component is loaded. The target program is a program that, after the operating system starts, initiates an incubator process to incubate and inject code. The hook component executes a hook function to call the target function. This embodiment's solution, using a featureless hook framework, avoids detection by the program and achieves better hooking results.

[0133] In one embodiment, the hook component includes: a first hook file and a second hook file; the function call module is further configured to execute a hook function call to a target function through the first hook file and the second hook file.

[0134] In one embodiment, the first hook file is a dex file and the second hook file is a so file; the function call module is further configured to load the second hook file when the first hook file is executed; and execute the hook function to call the target function through the second hook file.

[0135] In one embodiment, the function call module is further configured to redefine functions in classes of the target program through the second hook file, jump to execute the hook function in the first hook file, and call the target function through the hook function.

[0136] In one embodiment, the function call module is further configured to execute a hook function call to a target function through the hook component when a button click instruction is detected.

[0137] In one embodiment, the component loading module is further configured to call a loading file when the target program is detected to be starting; and load the hook component through a preset field in the loading file.

[0138] In one embodiment, the function call device further includes a program incubation module, which is used to start an incubator process to incubate the program after the operating system starts; and to inject code into the target program when the target program is incubated.

[0139] In one embodiment, the program incubation module is further configured to call an injection program when the target program is incubated; and to inject code into the target program through the injection program.

[0140] In one embodiment, the function calling device further includes a configuration module, configured to determine hook information based on the writing instruction when a writing instruction is received, and to obtain a hook component based on the hook information.

[0141] In one embodiment, the configuration module is further configured to generate a first hook file based on the hook information; configure a corresponding second hook file for the first hook file; and obtain a hook component based on the first hook file and the second hook file.

[0142] Other embodiments or specific implementation methods of the function call device described in the embodiments of the present invention can refer to the above-described method embodiments, and will not be repeated here.

[0143] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0144] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the embodiments of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The estimation machine software product is stored in an estimation machine readable storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a smart device (which may be a mobile phone, estimation machine, function call device, or network function call device, etc.) to execute the methods described in the various embodiments of the present invention.

[0146] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A function call method, characterized in that, The function call methods include: When the target program is detected to be starting, the hook component is loaded. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts. The hook component executes the hook function to call the target function; Specifically, when loading the hook component, different initialization functions are called sequentially based on the characteristics of the so library to load the hook component. The hook component includes: a first hook file and a second hook file. The step of executing the hook function to call the target function through the hook component includes: The hook function calls the target function by executing the hook function through the first hook file and the second hook file. The first hook file is a dex file and the second hook file is a so file. The step of executing the hook function to call the target function through the first hook file and the second hook file includes: When the first hook file is executed, the second hook file is loaded; The hook function is executed through the second hook file to call the target function.

2. The function call method as described in claim 1, characterized in that, The step of executing the hook function to call the target function through the second hook file includes: The second hook file redefines the functions in the classes of the target program, and then jumps to execute the hook functions in the first hook file; The target function is called through the hook function.

3. The function call method as described in claim 1, characterized in that, The step of executing the hook function to call the target function through the hook component includes: When a button click command is detected, the hook component executes the hook function to call the target function.

4. The function call method as described in any one of claims 1 to 3, characterized in that, The step of loading the hook component when the target program is detected to be starting includes: When the target program is detected to be starting, the file loading function is invoked; The hook component is loaded using a preset field in the loading file.

5. The function call method as described in any one of claims 1 to 3, characterized in that, Before loading the hook component upon detecting the target program's startup, the process also includes: After the operating system starts, the incubator process is launched to incubate the program; When the target program is incubated, code injection is performed on the target program.

6. The function call method as described in claim 5, characterized in that, The step of injecting code into the target program when it is incubated includes: When the target program is hatched, the injection program is invoked; The injection program injects code into the target program.

7. The function call method as described in any one of claims 1 to 3, characterized in that, Before the hook function is executed to call the target function through the hook component, the following is also included: Upon receiving a writing instruction, the hook information is determined based on the writing instruction; The hook component is obtained based on the hook information.

8. The function call method as described in claim 7, characterized in that, The step of obtaining the hook component based on the hook information includes: A first hook file is generated based on the hook information; Configure a corresponding second hook file for the first hook file; The hook component is obtained based on the first hook file and the second hook file.

9. A function call device, characterized in that, The function calling device includes: The component loading module is used to load the hook component when the target program is detected to be starting. The target program is a program that starts the incubator process to incubate and inject code after the operating system starts. The function call module is used to execute the hook function call to the target function through the hook component; Specifically, when loading the hook component, different initialization functions are called sequentially based on the characteristics of the so library to load the hook component. The hook component includes: a first hook file and a second hook file. The function call module is further configured to execute a hook function call to a target function through the first hook file and the second hook file; the first hook file is a dex file and the second hook file is a so file; The function call module is further configured to load the second hook file when the first hook file is executed, and to execute the hook function to call the target function through the second hook file.

10. The function call apparatus as described in claim 9, characterized in that, The function call module is further configured to redefine functions in classes of the target program through the second hook file, jump to execute the hook function in the first hook file, and call the target function through the hook function.

11. The function call apparatus as described in claim 9, characterized in that, The function call module is also used to execute the hook function to call the target function through the hook component when a button click instruction is detected.

12. The function call apparatus as described in any one of claims 9 to 11, characterized in that, The component loading module is also used to call a loading file when the target program is detected to be starting; and to load the hook component through a preset field in the loading file.

13. The function call apparatus as described in any one of claims 9 to 11, characterized in that, The function calling device further includes: The program incubation module is used to start the incubator process to incubate programs after the operating system starts; when a target program is incubated, code is injected into the target program.

14. The function call apparatus as described in claim 13, characterized in that, The program incubation module is also used to call the injection program when the target program is incubated; and to inject code into the target program through the injection program.

15. A function call device, characterized in that, The function calling device includes: a memory, a processor, and a function calling program stored in the memory and executable on the processor, wherein the function calling program, when executed by the processor, implements the function calling method as described in any one of claims 1 to 8.

16. A storage medium, characterized in that, The storage medium stores a function calling program, which, when executed by a processor, implements the function calling method as described in any one of claims 1 to 8.

Images