A process simulation method, device, apparatus and storage medium

By intercepting the process creation function and using a thread creation function to simulate the target process and parse the executable file, the problem of poor user experience in existing technologies is solved. It achieves active process startup without adb commands and has good compatibility, reducing the difficulty of adaptation.

CN115328614BActive Publication Date: 2026-03-24DALIAN JIUZHENG TECH CO LTD
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-08-10
Publication Date
2026-03-24

AI Technical Summary

Technical Problem

Existing technologies require connecting to a computer via a data cable to install ADB tools or perform cumbersome debugging functions when modifying the number of active processes in an Android system, resulting in a poor user experience and high adaptation difficulty.

Method used

By intercepting the process creation function and replacing it with a thread creation function, the target process is simulated and memory space is allocated. The executable file is parsed and mapped to the target process, and the process's main function is called to achieve virtual process creation.

Benefits of technology

It can start more than a set number of active processes without executing adb commands, with good transparency and compatibility, reducing adaptation difficulty and cost, and improving user experience.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN115328614B_ABST
    Figure CN115328614B_ABST
Patent Text Reader

Abstract

The application discloses a process simulation method and device, equipment and storage medium, and belongs to the technical field of data computer.The method comprises the following steps: in the case that a process creation operation is identified, a process creation function is intercepted, a thread creation function is used to replace the process creation function, process creation is performed, and a virtual target process is obtained; resources of the target process are simulated, and memory space is allocated to the target process; an executable file function is intercepted, and an executable file is parsed to obtain a file parsing result; according to the file parsing result, the executable file is mapped to the target process; and a process main function in the target process is called.Through the technical scheme, more processes can be started without any operation of a user by using a thread to replace a process, user experience is improved, and the complexity of model adaptation is reduced.
Need to check novelty before this filing date? Find Prior Art

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a process simulation method, device, equipment and storage medium. BACKGROUND

[0002] The Android system limits the number of active processes, and at most a set number of active processes can be created. If the number of processes exceeds the set number, the system will eliminate them.

[0003] The current solution to this problem is to start the debugging function through wireless or wired methods in the mobile developer mode, and then connect the adb (Android DebugBridge) on the local computer or terminal (mobile phone) application (APP) to set the number of processes.

[0004] However, the current process number modification method has the following defects: 1) connecting the computer using a data cable, which requires installing adb tools on the computer and an additional computer for operation, which is not user-friendly; 2) using the debugging function method, which is common on the market, but requires high user requirements and is very cumbersome to operate, and most users may not be able to successfully set up, and individual terminals need to be adapted separately, increasing development difficulty. Therefore, it is urgent to improve. SUMMARY

[0005] The present application provides a process simulation method, device, equipment and storage medium to solve the problem of user-unfriendly experience when using a data cable or wireless debugging function to connect the process number setting.

[0006] According to an aspect of the present application, a process simulation method is provided, which comprises:

[0007] In the case of identifying the process creation operation, the process creation function is intercepted, and the thread creation function is used to replace the process creation function to create a process and obtain a virtual target process;

[0008] The resources of the target process are simulated, and the memory space of the target process is allocated;

[0009] The executable file function is intercepted, and the executable file is parsed to obtain a file parsing result;

[0010] According to the file parsing result, the executable file is mapped to the target process;

[0011] The process main function in the target process is called.

[0012] According to another aspect of the present application, there is provided a process simulation apparatus, the apparatus comprising:

[0013] a target process determination module configured to, in the case that a process creation operation is identified, intercept a process creation function and replace the process creation function with a thread creation function to create a process and obtain a virtual target process;

[0014] a memory space allocation module configured to simulate resources of the target process and allocate memory space to the target process;

[0015] a file analysis result determination module configured to intercept an executable file function and analyze an executable file to obtain a file analysis result;

[0016] a file mapping module configured to map the executable file to the target process according to the file analysis result;

[0017] a function calling module configured to call a process main function in the target process.

[0018] According to another aspect of the present application, there is provided an electronic device, the electronic device comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein

[0021] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the process simulation method according to any one of the embodiments of the present application.

[0022] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for causing a processor to perform the process simulation method according to any one of the embodiments of the present application when executed by the processor.

[0023] The technical scheme of the embodiment of the present application, by identifying the process creation operation, intercepts the process creation function, and uses the thread creation function to replace the process creation function to create a process, obtains a virtual target process, then simulates the resources of the target process, allocates memory space for the target process, further intercepts the executable file function, parses the executable file to obtain a file parsing result, maps the executable file to the target process according to the file parsing result, and finally calls the process main function in the target process. The above technical scheme replaces the process creation by creating a thread, without executing the adb related command to set the total number of processes, so that more than a set number of active processes can be started; at the same time, the technical scheme of the present application is transparent to the started processes, has good concealment and good compatibility, does not need to be individually adapted to each mobile terminal, reduces the adaptation difficulty and cost, and improves the user experience.

[0024] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained from these drawings by those skilled in the art without creative labor.

[0026] Figure 1 is a flow chart of a process simulation method according to the first embodiment of the present application;

[0027] Figure 2 is a flow chart of a process simulation method according to the second embodiment of the present application;

[0028] Figure 3 is a structural schematic diagram of a process simulation device according to the third embodiment of the present application;

[0029] Figure 4 is a structural schematic diagram of an electronic device for implementing the process simulation method of the present application. DETAILED DESCRIPTION

[0030] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work should belong to the protection scope of the present application.

[0031] It should be noted that the terms such as "target" in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0032] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of process-related data and the like in the technical solutions of the present application comply with relevant laws and regulations and do not violate public order and good customs.

[0033] Embodiment one

[0034] Figure 1 is a flowchart of a process simulation method according to the first embodiment of the present application. The present embodiment can be applied to the case of how to simulate a process. The method can be executed by a process simulation device, which can be realized in the form of hardware and / or software, and can be integrated into an electronic device carrying a process simulation function, such as an operating system in a mobile terminal (such as a mobile phone), such as an Android system. As shown in Figure 1 The process simulation method of the present embodiment can include:

[0035] S110, in the case of identifying a process creation operation, intercepting a process creation function and replacing the process creation function with a thread creation function to create a process and obtain a virtual target process.

[0036] In the present embodiment, the target process refers to a process obtained by thread simulation.

[0037] Specifically, in the case that the user state recognizes the process creation operation, the process creation function is intercepted, and the clone function is used to replace the process creation function to create a thread function to replace the process creation function to create a process.

[0038] It should be noted that the user state refers to a non-privileged execution state in the design of an operating system.

[0039] S120, the resources of the target process are simulated, and memory space is allocated for the target process.

[0040] Optionally, the resources of the target process can be simulated by creating a structure to obtain the target resources corresponding to the target process; and memory space is allocated for the target process according to the target resources.

[0041] The target resources include at least one of the following: memory start address, code segment start position, data segment start position, and memory stack interval.

[0042] Specifically, the resources of the target process can be simulated by creating a process structure to obtain the target resources corresponding to the target process, and then allocating corresponding memory space for the target process according to the target resources. It can be understood that the resources of the process itself can be described by creating a structure, so that the target process can run normally.

[0043] S130, intercepting the executable file function and parsing the executable file to obtain the file parsing result.

[0044] In this embodiment, the executable file refers to a computer file whose content can be interpreted as a program by a computer, which can be loaded into memory and executed by an operating system.

[0045] The file parsing result refers to the result obtained after parsing the executable file, which can include but is not limited to at least one of the following: original code segment and original data segment corresponding to the executable file, and space requirement value corresponding to the uninitialized data segment in the executable file. The space requirement value refers to the memory space size required by the uninitialized data segment.

[0046] Specifically, the executable file function can be intercepted in the user state, which can avoid the process space content initialization, and can also allow multiple newly started processes to run in the same process, avoiding the situation that starting a process leads to the destruction of other processes.

[0047] Further, the executable file can be parsed to obtain the file parsing result, i.e., the original code segment and the original data segment in the executable file, and the space requirement value corresponding to the uninitialized data segment in the executable file.

[0048] S140, mapping the executable file to the target process according to the file analysis result.

[0049] Specifically, the original code segment and the original data segment can be mapped into the target process, and the memory space for the uninitialized data segment is allocated in the target process according to the space requirement value. It can also be understood that the corresponding code in the executable file is read into the target process.

[0050] S150, calling the process main function in the target process.

[0051] Specifically, the process main function in the target process can be parsed, and the process main function can be called.

[0052] The technical scheme of the embodiment of the application, by identifying the process creation function in the case of creating a process, intercepting the process creation function, and using the thread creation function to replace the process creation function, creating a process, obtaining a virtual target process, then simulating the resources of the target process, allocating memory space for the target process, and then intercepting the executable file function, parsing the executable file, obtaining the file analysis result, and mapping the executable file to the target process according to the file analysis result, finally calling the process main function in the target process. The above technical scheme, by creating a thread to replace the process creation method, without executing adb related command to set the total number of processes, more than the set number of active processes can be started; at the same time, the technical scheme of the application is transparent to the started process, has good concealment and good compatibility, does not need to be adapted to each mobile terminal separately, reduces the adaptation difficulty and cost, and improves the user experience.

[0053] Embodiment two

[0054] Figure 2 is a flowchart of a process simulation method according to the second embodiment of the application. This embodiment is further optimized on the basis of the above-mentioned embodiment, and provides an optional implementation scheme. As shown in Figure 2 the process simulation method of the embodiment can include:

[0055] S210, in the case of identifying the process creation operation, intercepting the process creation function, and using the thread creation function to replace the process creation function, creating a process, and obtaining a virtual target process.

[0056] S220, simulating the resources of the target process, and allocating memory space for the target process.

[0057] S230, intercepting the executable file function, and parsing the executable file to obtain the file analysis result.

[0058] S240, mapping the executable file to the target process according to the file analysis result.

[0059] S250, analyzing the dynamic link segment of the executable file from the memory space of the target process, loading the dynamic link library relied on by the executable file according to the analysis result, and obtaining the function relied on by the executable file.

[0060] Specifically, since the executable file is mapped to the target process, the dynamic link segment of the executable file can be analyzed from the memory space of the target process to obtain the analysis result, i.e. the dynamic link library and related functions relied on by the executable file, and then the dynamic link library relied on by the executable file is loaded, the function relied on by the executable file is obtained, and the function is filled into the function table for the subsequent process main function to run normally. The function table exists in the data segment in the target process.

[0061] S260, analyzing the process main function from the memory space of the target process, and calling the process main function.

[0062] Specifically, the process main function can be analyzed from the memory space of the target process, and the process main function can be called.

[0063] The technical scheme of the embodiment of the application, by identifying the creation process operation, intercepting the process creation function, and using the thread creation function to replace the process creation function, creating a process, obtaining a virtual target process, then simulating the resources of the target process, allocating memory space for the target process, then intercepting the executable file function, analyzing the executable file to obtain the file analysis result, and mapping the executable file to the target process according to the file analysis result, and then analyzing the dynamic link segment of the executable file from the memory space of the target process, loading the dynamic link library relied on by the executable file according to the analysis result, and obtaining the function relied on by the executable file, analyzing the process main function from the memory space of the target process, and calling the process main function. The above technical scheme executes the process main function in the virtual target process created by the thread, which can actually start the process, thereby improving the user experience.

[0064] On the basis of the above embodiment, as an optional way of the application, before calling the process main function in the target process, the process initialization function address can also be analyzed from the memory space of the target process, and the initialization function can be called.

[0065] Specifically, if there is an initialization function in the executable file, the process initialization function address is analyzed from the memory space of the target process before the process main function of the target process is called, and the initialization function is called. It can be understood that various functions in the real process can be accurately simulated to ensure the normal operation of the active process.

[0066] On the basis of the above-mentioned embodiments, as an optional mode of the present application, after the memory space is allocated to the target process in the simulation of the resources of the target process, VMA data structures can be respectively allocated to the code segment and the data segment in the target process to maintain the memory space of the target process.

[0067] Specifically, after the memory space is allocated to the target process in the simulation of the resources of the target process, a vm_area_struct (VMA) data structure can be allocated to each segment, i.e., the data segment and the code segment, in the target process, the VMA structure is initialized with the address interval corresponding to the memory space in the target process just created, and a plurality of VMA structures are all linked to the process structure body to maintain the memory space of the target process.

[0068] Embodiment Three

[0069] Figure 3 is a structural schematic diagram of a process simulation device according to Embodiment Three of the present application. The present embodiment can be applied to the case of how to simulate a process. The process simulation device can be realized in the form of hardware and / or software, and can be integrated in an electronic device carrying a process simulation function, such as an operating system in a mobile terminal (such as a mobile phone), such as an Android system.

[0070] As shown in Figure 3 , the process simulation device of the present embodiment can include:

[0071] The target process determination module 310 is configured to, in the case of identifying a process creation operation, intercept a process creation function, and replace the process creation function with a thread creation function to create a process and obtain a virtual target process;

[0072] The memory space allocation module 320 is configured to simulate the resources of the target process and allocate a memory space to the target process;

[0073] The file parsing result determination module 330 is configured to intercept an executable file function and parse an executable file to obtain a file parsing result;

[0074] The file mapping module 340 is configured to map the executable file to the target process according to the file parsing result;

[0075] The function calling module 350 is configured to call a process main function in the target process.

[0076] The technical scheme of the embodiment of the application, by intercepting a process creation function in the case of recognizing a process creation operation, and replacing the process creation function with a thread creation function to create a process, obtains a virtual target process, then simulates resources of the target process, allocates memory space for the target process, further intercepts an executable file function, parses the executable file to obtain a file parsing result, maps the executable file to the target process according to the file parsing result, and finally calls a process main function in the target process. The above technical scheme replaces the process creation with the thread creation, without executing adb related commands to set the total number of processes, so that more than a set number of active processes can be started; meanwhile, the technical scheme of the application is transparent to the started processes, has good concealment and good compatibility, does not need to be separately adapted to each mobile terminal, reduces the adaptation difficulty and cost, and improves the user experience.

[0077] Optionally, the memory space allocation module 320 is specifically configured to:

[0078] The resources of the target process are simulated by creating a structure, and the target resources corresponding to the target process are obtained.

[0079] The memory space is allocated for the target process according to the target resources.

[0080] Optionally, the target resources include at least one of the following: a memory start address, a code segment start position, a data segment start position, and a memory stack interval.

[0081] Optionally, the file parsing result includes at least one of the following: an original code segment and an original data segment corresponding to the executable file, and a space requirement value corresponding to an uninitialized data segment in the executable file.

[0082] Correspondingly, the file mapping module 340 is specifically configured to:

[0083] The original code segment and the original data segment are mapped to the target process, and the memory space is allocated for the uninitialized data segment in the target process according to the space requirement value.

[0084] Optionally, the function calling module 350 is specifically configured to:

[0085] The dynamic link segment of the executable file is parsed from the memory space of the target process, the dynamic link library relied on by the executable file is loaded according to the parsing result, and the function relied on by the executable file is obtained.

[0086] The process main function is parsed from the memory space of the target process, and the process main function is called.

[0087] Optionally, the device further includes:

[0088] The initialization function calling module is configured to call the process initialization function address from the memory space of the target process before calling the process main function in the target process, and call the initialization function.

[0089] Optionally, the device further comprises:

[0090] The memory space maintaining module is configured to allocate VMA data structures to the code segment and the data segment in the target process respectively after simulating the resources of the target process and allocating the memory space for the target process, so as to maintain the memory space of the target process.

[0091] The process simulation device provided by the embodiments of the present application can execute the process simulation method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0092] Embodiment four

[0093] Figure 4 is a structural schematic diagram of an electronic device for implementing the process simulation method of the embodiments of the present application; Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices (e.g., headgear, eyewear, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0094] As shown in Figure 4 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is in communication connection with the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor, and the processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0095] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0096] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the process simulation method.

[0097] In some embodiments, the process simulation method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of the process simulation method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the process simulation method by any other appropriate means, such as by means of firmware.

[0098] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0099] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, can cause instructions defined in the flow charts and / or block diagrams to be implemented on the computer or other programmable apparatus. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a standalone software package, and partially on a remote machine or entirely on a remote machine or server.

[0100] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0101] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0102] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0103] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0104] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, and the present disclosure is not limited in this regard.

[0105] The specific embodiments described above are not intended to limit the scope of the present disclosure. Those skilled in the art will understand that various modifications, combinations, sub-combinations, and alternatives can be made to the specific embodiments without departing from the spirit and principles of the present disclosure. Any further modifications, equivalents, and / or alternatives come within the scope of the present disclosure as recited by the claims.

Claims

1. A process simulation method, characterized by, The method comprises the steps of: In the case of identifying a process creation operation, intercepting a process creation function, and replacing the process creation function with a thread creation function to create a process and obtain a virtual target process; Simulating resources of the target process, and allocating memory space for the target process, comprising: simulating resources of the target process by creating a structure to obtain target resources corresponding to the target process; and allocating memory space for the target process according to the target resources; Intercepting an executable file function, and parsing the executable file to obtain a file parsing result; wherein the file parsing result comprises at least one of the following: original code segments and original data segments corresponding to the executable file, and a space requirement value corresponding to an uninitialized data segment in the executable file; Mapping the original code segments and the original data segments into the target process, and allocating memory space for the uninitialized data segment in the target process according to the space requirement value; Calling a process main function in the target process, comprising: parsing a dynamic link segment of the executable file from the memory space of the target process, loading a dynamic link library relied on by the executable file according to the parsing result, and obtaining a function relied on by the executable file; parsing the process main function from the memory space of the target process, and calling the process main function.

2. The method of claim 1, wherein, The target resources comprise at least one of the following: a memory start address, a code segment start position, a data segment start position, and a memory stack interval.

3. The method of claim 1, wherein, Before the calling of the process main function in the target process, the method further comprises: Parsing an initialization function address of the target process from the memory space of the target process, and calling the initialization function.

4. The method of claim 1, wherein, After the simulating of the resources of the target process and the allocating of the memory space for the target process, the method further comprises: Allocating VMA data structures for the code segments and the data segments in the target process, respectively, to maintain the memory space of the target process.

5. A process simulation apparatus, characterized by comprising: The method comprises the steps of: A target process determination module is configured to, in the case of identifying a process creation operation, intercept a process creation function, and replace the process creation function with a thread creation function to create a process and obtain a virtual target process; A memory space allocation module is configured to simulate resources of the target process, and allocate memory space for the target process, comprising: simulating resources of the target process by creating a structure to obtain target resources corresponding to the target process; and allocating memory space for the target process according to the target resources; A file parsing result determination module is configured to intercept an executable file function, and parse the executable file to obtain a file parsing result; wherein the file parsing result comprises at least one of the following: original code segments and original data segments corresponding to the executable file, and a space requirement value corresponding to an uninitialized data segment in the executable file; A file mapping module is configured to map the original code segments and the original data segments into the target process, and allocate memory space for the uninitialized data segment in the target process according to the space requirement value. The function calling module is configured to call a process main function in the target process, including: resolving a dynamic link segment of an executable file from a memory space of the target process, loading a dynamic link library relied on by the executable file according to a resolution result, and obtaining a function relied on by the executable file; resolving the process main function from the memory space of the target process, and calling the process main function.

6. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected with the at least one processor in communication; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the process simulation method of any one of claims 1-4.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores computer instructions for causing the processor to implement the process simulation method of any one of claims 1-4 when executed.

Citation Information

Patent Citations

  • Method for running executable file under Android virtual machine system and storage medium

    CN111857971A

  • Code injection and code interception in an operating system with multiple subsystem environments

    US20120233612A1