A method, device, equipment and storage medium for shelling processing

Abstract

A method, device, equipment and storage medium for shelling removal processing. The method includes: obtaining an executable file (201) to be shelled of a target application program; obtaining function identifiers of at least one extracted function in the executable file to be shelled (202); based on the function identifiers of the at least one extracted function, obtaining source functions corresponding to the at least one extracted function from a preset storage space (203); backfilling the source functions corresponding to the at least one extracted function into the executable file to be shelled to obtain a shelled-removed executable source file (204). In this way, through the function identifiers, the corresponding source functions are downloaded from the preset storage space, and the source functions are backfilled to the positions of the extracted functions in the executable file to be shelled, so as to completely restore the executable source file. When there are many extracted functions in the target application program, the Dex source file can be completely restored, and the problem that a large number of null bytecodes appear in the bytecodes of the function bodies in the shelled-removed Dex source file is solved.

Description

Technical Field

[0001] This application relates to computer technology, and in particular, to a method, device, equipment and storage medium for shelling processing. Background Art

[0002] With the gradual development of the executable file (Dex) reinforcement technology in the mobile security field, the shelling technology has also been updated. For the early reinforcement technology, a variety of shelling applications or shelling machines have emerged. Since the birth of the instruction extraction type reinforcement technology, it has been difficult to achieve full-automatic shelling.

[0003] In the prior art, the memory location of the reinforced Dex file is performed to confirm the structure of the reinforced Dex file, and all the mapped fields in the structure are cyclically traversed and loaded. Then, all the mapped fields in the structure are reorganized and repaired to obtain the shelled Dex source file.

[0004] However, the above technical solution mainly solves the problem of discontinuous loading of Dex files in memory, and does not specifically solve the problem of instruction extraction. Therefore, a large number of empty bytecodes (CodeItem) appear in the bytecode of the function body of the function in the shelled Dex source file. That is to say, a complete Dex source file cannot be obtained after the shelling operation. Summary of the Invention

[0005] To solve the above technical problems, embodiments of this application are expected to provide a method, device, equipment and storage medium for shelling processing, aiming to fully restore the source function and obtain a complete Dex source file.

[0006] In a first aspect, embodiments of this application provide a method for shelling processing, which includes:

[0007] Obtain the executable file to be shelled of the target application program;

[0008] Obtain the function identifier of at least one extracted function in the executable file to be shelled;

[0009] Based on the function identifier of the at least one extracted function, obtain the source function corresponding to the at least one extracted function from a preset storage space;

[0010] Backfill the source function corresponding to the at least one extracted function into the executable file to be shelled to obtain the shelled executable source file.

[0011] In a second aspect, embodiments of this application provide a device for shelling processing, which includes:

[0012] An obtaining part, configured to obtain the executable file to be shelled of the target application program;

[0013] The obtaining part is further configured to obtain function identifiers of at least one extracted function in the executable file to be unpacked;

[0014] The obtaining part is further configured to obtain source functions corresponding to the at least one extracted function from a preset storage space based on the function identifiers of the at least one extracted function;

[0015] The backfilling part is configured to backfill the source functions corresponding to the at least one extracted function into the executable file to be unpacked to obtain an unpacked executable source file.

[0016] In a third aspect, there is provided a de-shelling processing device, including: a processor and a memory configured to store a computer program that can run on the processor, wherein when the processor is configured to run the computer program, it executes the steps of the foregoing method.

[0017] In a fourth aspect, there is provided a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, it implements the steps of the foregoing method.

[0018] The technical solution of the embodiment of the present application downloads the source functions corresponding to the extracted functions before strengthening from a preset storage space through the function identifiers of at least one extracted function obtained, and backfills the source functions to the positions of the extracted functions in the executable file to be unpacked, so that the executable source file can be completely restored. In this way, it is possible to completely restore the Dex source file when there are many extracted functions in the target application program, and solve the problem that a large number of null bytecodes appear in the bytecodes of the function bodies in the unpacked Dex source file. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of the de-shelling process for restoring the Dex source file in the shelled Android application program;

[0020] Figure 2 The first flowchart of the de-shelling processing method in the embodiment of the present application;

[0021] Figure 3 The second flowchart of the de-shelling processing method in the embodiment of the present application;

[0022] Figure 4 Schematic diagram of the detection of the fortified executable file in the embodiment of the present application;

[0023] Figure 5 The third flowchart of the de-shelling processing method in the embodiment of the present application;

[0024] Figure 6 The fourth flowchart of the de-shelling processing method in the embodiment of the present application;

[0025] Figure 7 This is a schematic structural diagram of the components of the shelling processing device in the embodiments of the present application;

[0026] Figure 8 This is a schematic structural diagram of the components of the shelling processing equipment in the embodiments of the present application;

[0027] Figure 9 This is a schematic structural block diagram of a chip in the embodiments of the present application. Specific embodiments

[0028] In order to more comprehensively understand the features and technical content of the embodiments of the present application, the implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration purposes only and are not used to limit the embodiments of the present application.

[0029] Figure 1 This is a schematic diagram of the shelling process for restoring the Dex source file in a shelled Android application. As Figure 1 shown, specifically,

[0030] Step 101: Locate the Dex file in memory;

[0031] Locate the Dex file in memory and obtain the corresponding structure (DexFileHeader); where DexFileHeader includes: type_ids_off, type_ids_size, string_ids_off, string_ids_size, proto_ids_off, proto_ids_size, field_ids_off, field_ids_size, method_ids_off, method_ids_size, class_defs_off, class_defs_size.

[0032] Step 102: Traverse in a loop and load the left and right mapping fields;

[0033] Traverse in a loop and load all the mapped fields in the structure; that is, store the mapping table and the structure in different memory blocks respectively; where memory block 1 stores the mapping table, mainly including: strings mapping table, types mapping table, protos mapping table, methods mapping table, class defs mapping table, fields mapping table; memory block 2 stores the structure, mainly including: type_ids_off, string_ids_off, proto_ids_off, field_ids_off, method_ids_off, class_defs_off.

[0034] Step 103: Organize and repair the mappings and fields within the structure to obtain the source Dex file;

[0035] The source Dex file includes at least: a structure segment, a mapping table segment, and a data segment.

[0036] Figure 1 The technical solution shown reorganizes and restores according to the mapping information of the fields in the structure after the in-memory location of the Dex file, solving the problem of discontinuous loading of the Dex file in memory. However, since there is no targeted solution to the problem of instruction extraction, a large number of null bytecodes appear in the CodeItem of the functions in the Dex source file after shelling. Even if the extraction instructions of a small number of functions that have been executed can be restored, most function bodies are still in the extracted state, so a complete Dex source file cannot be obtained after the shelling operation.

[0037] For this reason, this application proposes a shelling processing method that can achieve the complete restoration of the Dex file. The specific implementation method is as follows:

[0038] Figure 2 This is the first process schematic diagram of the shelling processing method in the embodiments of this application. As Figure 2 shown, the shelling processing method may specifically include:

[0039] Step 201: Obtain the executable file to be shelled of the target application;

[0040] It should be noted that the executable file to be shelled is indirectly obtained based on the address of the Dex file of the target application in memory. In other words, before obtaining the executable file to be shelled, the Dex file needs to be obtained first. The Dex file here is the file after the strengthening operation. The Dex file is an executable file of the Android system and contains all the operation instructions and runtime data of the application.

[0041] In practical applications, usually first locate the address of the Dex file in memory, obtain the Dex file of the target application based on the address; then parse the structure contained in the Dex file to obtain the executable file to be shelled.

[0042] Specifically, the address of the Dex file is obtained by using dynamic debugging means, that is, setting breakpoints, for the system functions related to the structure in the Dex file after the Android application package (APK) starts running.

[0043] Step 202: Obtain the function identifier of at least one extracted function in the executable file to be shelled;

[0044] Here, the extracted function can be understood as a function whose function instructions are extracted (which can also be understood as being hidden or encrypted) during the strengthening operation; the CodeItem corresponding to the extracted function is empty bytecode. The function identifier is used to indicate the corresponding function. For example, the function identifier can be the function name.

[0045] In some embodiments, the method specifically includes: obtaining at least one function and its function identifier from the executable file to be unpacked; determining that the function that is empty among the at least one function is the at least one extracted function; and obtaining the function identifier of the at least one extracted function.

[0046] It should be noted that the executable file to be unpacked includes at least one function and function identifier; among them, the at least one function includes the function extracted during the strengthening operation and the function not extracted; each function corresponds to a function identifier.

[0047] Specifically, it is necessary to judge the CodeItem corresponding to each function among the at least one function. If the CodeItem of the current function is empty bytecode, this function is called the extracted function, and the function identifier corresponding to the extracted function is obtained. It should be noted that the extracted function presents an extracted state.

[0048] Step 203: Based on the function identifiers of the at least one extracted function, obtain the source functions corresponding to the at least one extracted function from a preset storage space;

[0049] It should be noted that the preset storage space is used to store the source functions corresponding to the function identifiers. The preset storage space can be a storage space stored locally or a storage space stored in the cloud.

[0050] In practical applications, a mapping table for storing the function identifiers and source functions is established in advance locally or in the cloud. The corresponding source functions are stored therein according to the function identifiers in sequence, which is also convenient for storing other function identifiers and source functions subsequently, as well as querying or downloading the source functions corresponding to the function identifiers.

[0051] Specifically, based on the function identifiers of the at least one extracted function obtained from the executable file to be unpacked, the corresponding source functions are downloaded from the preset storage space; when the source function corresponding to each extracted function is obtained, it is stored in a function mapping table; until all the source functions corresponding to the extracted functions are stored in this function mapping table, a complete function relationship mapping table can be obtained.

[0052] When performing the subsequent backfilling operation, the corresponding source function can be directly obtained from the above function mapping relationship table, and the source function is used to update the extracted function until the source functions corresponding to all the extracted functions are updated, and then the Dex file can be completely restored.

[0053] Step 204: Backfill the source function corresponding to the at least one extracted function into the executable file to be unpacked, and obtain the unpacked executable source file.

[0054] In practical applications, obtain the target function identifier from the function identifiers of at least one extracted function; based on the target function identifier, obtain the target source function corresponding to the target function identifier from the function mapping relationship table; backfill this target source function to the original position of the target extracted function corresponding to the target function identifier in the executable file to be unpacked. When the backfilling of the extracted functions corresponding to the function identifiers of at least one extracted function is completed, the unpacked executable source file is obtained.

[0055] Here, the execution subject of steps 201 to 204 may be the processor of the unpacking processing device.

[0056] The technical solution of the embodiment of the present application, by obtaining the function identifiers of at least one extracted function, downloads the source function corresponding to the extracted function before reinforcement from the preset storage space, and backfills the source function to the position where the extracted function is located in the executable file to be unpacked, and then the executable source file can be completely restored. In this way, when there are many extracted functions in the target application program, the Dex source file can be completely restored, and the problem that a large number of null bytecodes appear in the bytecode of the function body in the unpacked Dex source file can be solved.

[0057] To implement the method of the embodiment of the present application, based on the same inventive concept, the embodiment of the present application also provides another unpacking processing method. Figure 3 It is the second process schematic diagram of the unpacking processing method in the embodiment of the present application, as Figure 3 shown, this unpacking processing method may specifically include:

[0058] Step 301: Obtain the executable file to be unpacked of the target application program.

[0059] It should be noted that the executable file to be unpacked is indirectly obtained based on the address of the Dex file of the target application program in memory. In other words, before obtaining the executable file to be unpacked, the Dex file needs to be obtained first. The Dex file here is the file after the reinforcement operation. The Dex file is the executable file of the Android system and contains all the operation instructions and runtime data of the application program.

[0060] Step 302: Obtain the function identifiers of at least one extracted function in the executable file to be unpacked;

[0061] Here, the extracted function can be understood as a function whose function instructions are extracted (which can also be understood as hidden or encrypted) during the strengthening operation; the CodeItem corresponding to the extracted function is empty bytecode. The function identifier is used to indicate the corresponding function. For example, the function identifier can be the function name.

[0062] In some embodiments, the method specifically includes: obtaining at least one function and its function identifier from the executable file to be unpacked; determining that the functions that are empty among the at least one function are the at least one extracted function; and obtaining the function identifiers of the at least one extracted function.

[0063] It should be noted that the executable file to be unpacked includes at least one function and function identifier; among them, the at least one function includes the functions extracted during the strengthening operation and the functions that are not extracted; each function corresponds to a function identifier.

[0064] Specifically, it is necessary to judge the CodeItem corresponding to each function among the at least one function. If the CodeItem of the current function is empty bytecode, this function is called an extracted function, and the function identifier corresponding to the extracted function is obtained. It should be noted that the extracted function presents an extracted state.

[0065] Step 303: Based on the function identifiers of the at least one extracted function, run the modified system-provided call function to obtain the source functions corresponding to the at least one extracted function from a preset storage space;

[0066] In practical applications, first, initialize the function mapping relationship table, that is, the CodeItem corresponding to the extracted function corresponding to the function identifier of at least one extracted function is empty bytecode; secondly, for each function identifier corresponding to an empty extracted function obtained from the above function mapping relationship table, execute a preset call function, and then obtain the non-empty source function from the preset memory space; finally, use the obtained non-empty source function to update the empty extracted function in the function mapping relationship table.

[0067] That is to say, after obtaining the function identifiers of at least one extracted function, establish a function mapping relationship table; when obtaining the source functions corresponding to at least one extracted function, directly store the source functions in the established function mapping relationship table, that is, the mapping relationship between the function identifiers of at least one extracted function and the source functions corresponding to at least one extracted function.

[0068] In practical applications, for the extracted function whose first CodeItem obtained is empty bytecode, according to the corresponding function identifier, a preset call function is executed once. Then, when obtaining a non-empty source function from the preset memory space, a function mapping relationship table is constructed, and the function identifier and the source function are stored therein. The subsequent execution steps of the extracted function are as above and will not be described here.

[0069] That is to say, when obtaining the source functions of at least one extracted function, a function mapping relationship table is constructed.

[0070] The above-mentioned preset call function can be the modified system-built-in call function.

[0071] In some embodiments, it specifically includes: adding a backup function to the system-built-in call function to obtain a first modified call function; wherein, when the backup function runs, it is used to obtain the source functions corresponding to the at least one extracted function; and using the first modified call function as the preset call function.

[0072] It should be noted that the above steps directly modify the source code of the system-built-in call function to obtain the source functions corresponding to at least one extracted function, construct a function mapping relationship table, and store the source functions corresponding to at least one extracted function in the function mapping relationship table.

[0073] Specifically, according to the function name of the system-built-in call function, the system-built-in call function is retrieved from all system source codes; a backup function is added to the system-built-in call function, and the backup function has the functions of obtaining the source functions corresponding to at least one extracted function, constructing a function mapping relationship table, and storing the source functions corresponding to at least one extracted function in the function mapping relationship table.

[0074] The above function mapping relationship table for storing source functions lays the foundation for subsequent backfilling operations.

[0075] Step 304: Backfill the source functions corresponding to the at least one extracted function into the executable file to be unpacked to obtain an unpacked executable source file.

[0076] In practical applications, obtain a target function identifier from the function identifiers of at least one extracted function; based on the target function identifier, obtain the target source function corresponding to the target function identifier from the function mapping relationship table; and backfill this target source function to the original position of the target extracted function corresponding to the target function identifier in the executable file to be unpacked. After backfilling all the extracted functions corresponding to the function identifiers of at least one extracted function, an unpacked executable source file is obtained.

[0077] In practical applications, a shelling system is constructed according to the above shelling method; then, the shelling system is flashed into the emulator, so that the emulator with the shelling system is obtained; the shelling can be realized by running the emulator with the shelling system.

[0078] Exemplarily, by modifying the Invoke function (a system-provided call function) in the ArtMethod of the system source code, then performing a compilation operation and a flashing operation on it, finally an emulator with a shelling system is obtained. By running the emulator with the shelling system, the purpose of shelling the fortified Dex file is achieved.

[0079] Specifically, based on the emulator with the shelling system above, a fortified APK file is uploaded to it. By running the emulator with the shelling system, the corresponding source function is obtained according to the function identifier of each extracted function and stored in the function mapping relationship table; after backfilling the source function corresponding to each function identifier based on the function mapping relationship table, the shelled executable source file can be obtained.

[0080] The technical solution of the embodiment of the present application can realize the shelling of fortified applications in the OPPO application market, which is convenient for subsequent risk detection and code auditing. Figure 4 This is a schematic diagram of the detection of the fortified executable file in the embodiment of the present application. As Figure 4 shown, specifically,

[0081] Step 401: Upload a fortified APK file;

[0082] A fortified APK file is uploaded to the emulator with the shelling system.

[0083] Step 402: The shelling system of the emulator performs code restoration;

[0084] Step 403: Perform risk detection and auditing on the restored code; if the detection and auditing are passed, then step 404 is executed; if the detection and auditing are not passed, then step 405 is executed;

[0085] Step 404: Put the fortified APK on the application market;

[0086] Step 405: After fortifying the APK again, execute step 401 again.

[0087] The above execution of step 405 is because the emulator with the shelling system restores the executable file. That is to say, if the detection and auditing are not passed, it is necessary to re-perform the fortification operation on the APK, and then judge again whether it can pass the detection and auditing.

[0088] In the technical solution of the embodiment of the present application, by obtaining the function identifiers of at least one extracted function, downloading the source function corresponding to the extracted function before strengthening from the preset storage space, and backfilling the source function to the position of the extracted function in the executable file to be unpacked, the executable source file can be completely restored. In this way, when there are many extracted functions in the target application, the Dex source file can be completely restored, and the problem that a large number of empty bytecodes appear in the bytecode of the function body in the unpacked Dex source file can be solved.

[0089] To implement the method of the embodiment of the present application, based on the same inventive concept, the embodiment of the present application also provides another unpacking processing method. Figure 5 As the third process schematic diagram of the unpacking processing method in the embodiment of the present application, as Figure 5 shown, the unpacking processing method may specifically include:

[0090] Step 501: Obtain the executable file to be unpacked of the target application;

[0091] Step 502: Obtain the function identifiers of at least one extracted function in the executable file to be unpacked;

[0092] Step 503: Based on the function identifiers of the at least one extracted function, run a custom function to obtain the source function corresponding to the at least one extracted function from the preset storage space;

[0093] In practical applications, first, initialize the function mapping table, that is, the CodeItem corresponding to the extracted function corresponding to the function identifier of at least one extracted function is empty bytecode; secondly, for each function identifier corresponding to an empty extracted function obtained from the above function mapping table, execute a preset call function once, and then obtain a non-empty source function from the preset memory space; finally, use the obtained non-empty source function to update the empty extracted function in the function mapping table.

[0094] That is to say, after obtaining the function identifiers of at least one extracted function, establish a function mapping table; when obtaining the source functions corresponding to at least one extracted function, directly store the source functions in the established function mapping table above, that is, the mapping relationship between the function identifiers of at least one extracted function and the source functions corresponding to at least one extracted function.

[0095] In practical applications, based on the first extracted function whose CodeItem is empty bytecode, according to the corresponding function identifier, execute a preset call function once, and then when obtaining a non-empty source function from the preset memory space, construct a function mapping table and store the function identifier and the source function therein. The subsequent steps for the extracted functions are as above and will not be described here.

[0096] That is, when obtaining the source functions of at least one extracted function, a function mapping relationship table is constructed.

[0097] The aforementioned preset calling function can be a custom function.

[0098] In some embodiments, the method further includes: obtaining the calling functions provided by the system; adding a backup function to the calling functions provided by the system to obtain a second modified calling function; wherein, when the backup function runs, it is used to obtain the source functions corresponding to the at least one extracted function; creating a custom function by using the second modified calling function; and using the custom function as the preset calling function.

[0099] It should be noted that here, the calling of at least one extracted function is implemented through the created custom function. Based on the backup function in the custom function, the source function is obtained, and thus the purpose of unpacking is achieved.

[0100] Specifically, by executing the created custom function, the second modified calling function in the custom function is further executed. Using the backup function in the second modified calling function, the source functions corresponding to the at least one extracted function are obtained and a function mapping relationship table is constructed. Among them, the second modified calling function is obtained by copying the calling functions provided by the system and adding a backup function to the copied calling functions provided by the system.

[0101] Exemplarily, the call of functions in the Java layer in a normal system is implemented through the invoke method in the ArtMethod class. In this application, the call of at least one extracted function in the Java layer is implemented through a custom invoke function. First, a custom invoke function (custom function) is created, and the invoke function (second modified calling function) in the modified ArtMethod class is added to the custom invoke function; wherein, a dump function capable of obtaining the source functions corresponding to the at least one extracted function and constructing a function mapping relationship table is added to the invoke function in the ArtMethod class; secondly, by executing the custom invoke function, the invoke function in the modified ArtMethod class is further executed to obtain the source functions corresponding to the at least one extracted function and construct a function mapping relationship table, and the source functions corresponding to the at least one extracted function are stored in the corresponding positions in the function mapping relationship table; after obtaining the source functions of all the extracted functions, a complete function mapping relationship table is finally obtained.

[0102] In some embodiments, the execution of the preset calling function includes: executing the custom function in a hook manner.

[0103] It should be noted that hook is a technology that changes the program execution process. Here, when the system executes the built-in calling function, through the hook method, the system's built-in calling function can be directly skipped to execute the custom function.

[0104] For example, the hook method will hijack the invoke method in the system ArtMethod class. When the system calls the invoke method, the custom invoke method is executed instead of the system's own invoke method.

[0105] In actual application, the hook technology is executed under the Xposed or Frida operating framework. At this time, compared with the previous embodiment, the system function of the simulator is not changed after the simulator is run.

[0106] Step 504: Fill the source function corresponding to the at least one extracted function back into the executable file to be unpacked, to obtain an unpacked executable source file.

[0107] In practical applications, a target function identifier is obtained from a function identifier of at least one extracted function; based on the target function identifier, a target source function corresponding to the target function identifier is obtained from a function mapping relationship table; and the target source function is backfilled into the original position of the target extracted function corresponding to the target function identifier in the executable file to be unpacked. When the extracted function corresponding to the function identifier of at least one extracted function is backfilled, the unpacked executable source file is obtained.

[0108] That is to say, each extracted function is run in a hook manner until all corresponding source functions are obtained based on the function identifier of the extracted function and stored in the function mapping relationship table, and then the source function is obtained from the function mapping relationship table for backfilling to obtain a complete Dex source file.

[0109] The technical solution of the embodiment of the present application can completely restore the executable source file by obtaining the function identifier of at least one extracted function, downloading the source function corresponding to the extracted function before reinforcement from the preset storage space, and backfilling the source function to the location of the extracted function in the executable file to be unpacked. In this way, it is possible to completely restore the Dex source file when there are many extracted functions in the target application, and solve the problem of a large number of empty bytecodes in the bytecode of the function body in the Dex source file after unpacking.

[0110] Based on the above embodiments, this application specifically provides a dehulling method. Figure 6 This is a fourth flow chart of the deshelling method in the embodiment of the present application.

[0111] The extraction instruction type of reinforcement refers to protecting the function method bodies (extracted instructions) in the Dex file. Among them, the Dex file is the executable file of the Android system, containing all the operation instructions and runtime data of the application program.

[0112] This application actively calls Java layer functions. When being called, after dumping the extracted instructions, it does not execute them and directly returns, and fills the obtained extracted instructions back into the incomplete Dex file to obtain the complete Dex source file.

[0113] Specifically, Java methods are represented by ArtMethod in the ART virtual machine. After starting the virtual machine environment from zygote, it enters the Java environment through AndroidRuntime::start(), and in start(), the CallStaticVoidMethod() function is called, and further the invoke method of ArtMethod is called. The execution of Java methods is all through the invoke method. Therefore, this application dumps the extracted instructions by hooking the invoke function and executing the invoke of the extracted function.

[0114] As Figure 6 shown, it is as follows:

[0115] Step 601: Parse the Dex file in memory;

[0116] The Dex file here is the file after the reinforcement operation. The Dex file is the executable file of the Android system, containing all the operation instructions and runtime data of the application program.

[0117] In practical applications, usually first locate the address of the Dex file in memory, obtain the Dex file of the target application program based on the address; then parse the structure contained in the Dex file to obtain the executable file to be unpacked.

[0118] Specifically, to obtain the Dex file address, after the APK starts running, the system functions related to the structure in the Dex file are dynamically debugged, that is, breakpoints are set to obtain the Dex file address.

[0119] Step 602: Confirm the extracted function and create a function mapping relationship table list;

[0120] The Dex file obtained after the above steps is the executable file to be unpacked.

[0121] Here, the extracted function can be understood as a function whose function instructions are extracted (can also be understood as hidden or encrypted) when performing a hardening operation; the CodeItem corresponding to the extracted function is an empty bytecode.

[0122] The executable file to be unpacked contains at least one function and a function identifier. Therefore, the CodeItem of each function needs to be judged here, and the function with an empty CodeItem is defined as the extracted function, thereby obtaining at least one extracted function and the corresponding function identifier.

[0123] A function mapping relationship table list is created using at least one extracted function and a function identifier corresponding to the extracted function; wherein the function identifier is used to indicate the corresponding function, for example, the function identifier may be a function name.

[0124] The extracted function mentioned below is the extracted function that has not been restored, that is, it presents the extracted state.

[0125] Step 603: Create a custom invoke function, and call the invoke function in the ArtMethod class to which the dump function is added; wherein the dump function is used to download the source function corresponding to the extracted function and create a function mapping relationship table;

[0126] The source function here is the function before hardening downloaded from the preset storage space.

[0127] First, create a custom invoke function, and add the invoke function in the modified ArtMethod class to the custom invoke function; wherein, the invoke function in the ArtMethod class adds a dump function which has the function of obtaining the source function corresponding to at least one extracted function and building a function mapping relationship table; secondly, by executing the custom invoke function, and then executing the invoke function in the modified ArtMethod class, obtain the source function corresponding to at least one extracted function, and store the mapping relationship between the function identifier and the source function in the reconstructed function mapping relationship table list1, or directly use the source function to correspond to and update the extracted function, without building the function mapping relationship table again; finally, after obtaining the source functions of all extracted functions, a complete function mapping relationship table is finally obtained.

[0128] Based on the hook method under the Xposed or Frida running framework, execute the custom invoke function to implement the call of at least one extracted function of the Java layer and the dump function.

[0129] Step 604: fill the source function corresponding to the extracted function back to the location of the extracted function;

[0130] Obtain the target function identifier from the function identifiers of at least one extracted function, and then based on the reconstructed function mapping table list1 or the updated function mapping table list, obtain the source function corresponding to the target function identifier, and then backfill the source function to the location where the corresponding extracted function is located.

[0131] Step 605: Obtain the complete Dex source file.

[0132] After backfilling the source functions corresponding to all the extracted functions into the executable file, the complete Dex source file can be obtained.

[0133] This application can provide reference and assistance for Android projects, for example: assistance for analyzing competing Android reinforcement solutions; test reference for Android reinforcement solutions; risk assessment assistance for developer applications in the company's application market.

[0134] The technical solution of the embodiment of this application, by obtaining the function identifiers of at least one extracted function, downloads the source function corresponding to the extracted function before reinforcement from the preset storage space, and backfills the source function to the location where the extracted function is located in the executable file to be unpacked, the executable source file can be completely restored. In this way, it is possible to completely restore the Dex source file when there are many extracted functions in the target application program, and solve the problem that a large number of null bytecodes appear in the bytecode of the function body in the unpacked Dex source file.

[0135] To implement the method of the embodiment of this application, based on the same inventive concept, the embodiment of this application also provides a unpacking processing device, as Figure 7 shown, the device includes:

[0136] An obtaining part 701, configured to obtain the executable file to be unpacked of the target application program;

[0137] The obtaining part 701 is further configured to obtain the function identifiers of at least one extracted function in the executable file to be unpacked;

[0138] The obtaining part 701 is further configured to obtain the source functions corresponding to the at least one extracted function from the preset storage space based on the function identifiers of the at least one extracted function;

[0139] A backfilling part 702, configured to backfill the source functions corresponding to the at least one extracted function into the executable file to be unpacked to obtain the unpacked executable source file.

[0140] In some embodiments, the device includes: the obtaining part 701, which is further configured to obtain at least one function and its function identifier from the executable file to be unpacked; determine the function that is empty among the at least one function as the at least one extracted function; and obtain the function identifier of the at least one extracted function.

[0141] In some embodiments, the device includes: the obtaining part 701, which is further configured to initialize a function mapping relationship table by using the function identifiers of the at least one extracted function obtained; wherein, the function mapping relationship table includes the mapping relationship between the function identifiers of the at least one extracted function and the at least one extracted function; based on the function identifiers of at least one extracted function in the function mapping relationship table, execute a preset call function to obtain the source function corresponding to the at least one extracted function from the preset storage space; and store the source function corresponding to the at least one extracted function into the function mapping relationship table.

[0142] In some embodiments, the device includes: the obtaining part 701, which is further configured to execute a preset call function based on the function identifiers of the at least one extracted function to obtain the source function corresponding to the at least one extracted function from the preset storage space; and construct a function mapping relationship table by using the function identifiers of the at least one extracted function and their corresponding source functions.

[0143] In some embodiments, add a backup function to the system's built-in call function to obtain a first modified call function; wherein, the backup function is used to obtain the source function corresponding to the at least one extracted function when running; and use the first modified call function as the preset call function.

[0144] In some embodiments, obtain the system's built-in call function; add a backup function to the system's built-in call function to obtain a second modified call function; wherein, the backup function is used to obtain the source function corresponding to the at least one extracted function when running; create a custom function by using the second modified call function; and use the custom function as the preset call function.

[0145] In some embodiments, execute the custom function by means of hook.

[0146] The technical solution of the embodiment of the present application can download the source function corresponding to the extracted function before strengthening from the preset storage space through the function identifier of at least one extracted function obtained, and backfill the source function to the position of the extracted function in the executable file to be unpacked, so as to completely restore the executable source file. In this way, when there are many extracted functions in the target application, the Dex source file can be completely restored, and the problem that a large number of null bytecodes appear in the bytecode of the function body in the unpacked Dex source file can be solved.

[0147] The embodiment of the present application also provides another unpacking processing device, as Figure 8 shown, the device includes: a processor 801 and a memory 802 configured to store a computer program that can run on the processor;

[0148] Wherein, when the processor 801 is configured to run the computer program, it executes the method steps in the foregoing embodiment.

[0149] Of course, in actual application, as Figure 8 shown, each component in the device is coupled together through a bus system 803. It can be understood that the bus system 803 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 803 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in Figure 8 all kinds of buses are labeled as the bus system 803.

[0150] In actual application, the above-mentioned processor can be at least one of an application specific integrated circuit (ASIC), a digital signal processing device (DSPD), a programmable logic device (PLD), a field-programmable gate array (FPGA), a controller, a microcontroller, and a microprocessor. It can be understood that for different devices, the electronic devices used to implement the functions of the above-mentioned processor can also be others, and the embodiments of the present application do not make specific limitations.

[0151] The above-mentioned memory can be a volatile memory, such as a random-access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or a combination of the above types of memories, and provides instructions and data to the processor.

[0152] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions, which when executed perform the method steps of the foregoing embodiment.

[0153] If the above device in an embodiment of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in various embodiments of the present application. The foregoing storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disc, etc., which can store program codes. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0154] Figure 9 It is a schematic structural diagram of the chip in an embodiment of the present application. Figure 9 The shown chip 901 includes a processor 902, and the processor 902 can call and run a computer program from the memory 904 to implement the method in the embodiment of the present application.

[0155] Optionally, as Figure 9 shown, the chip 901 may further include a memory 904. Among them, the processor 902 can call and run a computer program from the memory 904 to implement the method in the embodiment of the present application.

[0156] Among them, the memory 904 can be an independent device from the processor 902 or integrated in the processor 902.

[0157] Optionally, the chip 901 may further include an input interface 903. Among them, the processor 902 may control the input interface 903 to communicate with other devices or chips. Specifically, it may obtain information or data sent by other devices or chips.

[0158] Optionally, the chip 901 may further include an output interface 905. Among them, the processor 902 may control the output interface 905 to communicate with other devices or chips. Specifically, it may output information or data to other devices or chips.

[0159] Optionally, the chip may be applied to the network device in the embodiment of the present application, and the chip may implement the corresponding processes implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, it will not be elaborated here.

[0160] Optionally, the chip may be applied to the terminal device in the embodiment of the present application, and the chip may implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application. For the sake of brevity, it will not be elaborated here.

[0161] It should be understood that the chip mentioned in the embodiment of the present application may also be referred to as a system-on-chip, system chip, chip system, or system-on-chip, etc.

[0162] Correspondingly, the embodiment of the present application also provides a computer storage medium, in which a computer program is stored, and the computer program is configured to execute the data scheduling method of the embodiment of the present application.

[0163] It should be noted that "first", "second", etc. are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence.

[0164] The methods disclosed in several method embodiments provided by the present application can be arbitrarily combined without conflict to obtain new method embodiments.

[0165] The features disclosed in several product embodiments provided by the present application can be arbitrarily combined without conflict to obtain new product embodiments.

[0166] The features disclosed in several method or device embodiments provided by the present application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0167] The above are only the specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0168] Industrial Applicability

[0169] In the technical solution of the embodiment of the present application, by obtaining the function identifiers of at least one extracted function, downloading the source function corresponding to the extracted function before reinforcement from a preset storage space, and backfilling the source function to the position of the extracted function in the executable file to be unpacked, the executable source file can be completely restored. In this way, when there are many extracted functions in the target application program, the Dex source file can be completely restored, and the problem that a large number of null bytecodes appear in the bytecode of the function body in the unpacked Dex source file can be solved.

Claims

1. A method for shelling treatment, wherein, Including: Obtain the executable file to be unpacked of the target application; Obtain the function identifier of at least one extracted function in the executable file to be unpacked; Based on the function identifier of the at least one extracted function, obtain the source function corresponding to the at least one extracted function from a preset storage space; Backfill the source function corresponding to the at least one extracted function into the executable file to be unpacked to obtain an unpacked executable source file; The obtaining the source function corresponding to the at least one extracted function from a preset storage space based on the function identifier of the at least one extracted function includes: Initialize a function mapping table by using the obtained function identifier of the at least one extracted function; wherein, the function mapping table includes the mapping relationship between the function identifier of the at least one extracted function and the at least one extracted function; based on the function identifier of at least one extracted function in the function mapping table, execute a preset call function to obtain the source function corresponding to the at least one extracted function from the preset storage space; store the source function corresponding to the at least one extracted function into the function mapping table; Or, based on the function identifier of the at least one extracted function, execute a preset call function to obtain the source function corresponding to the at least one extracted function from the preset storage space; construct a function mapping table by using the function identifier of the at least one extracted function and its corresponding source function.

2. The method according to claim 1, wherein, The obtaining the function identifier of at least one extracted function in the executable file to be unpacked includes: Obtain at least one function and its function identifier from the executable file to be unpacked; Determine that the function that is empty among the at least one function is the at least one extracted function; Obtain the function identifier of the at least one extracted function.

3. The method according to claim 1, wherein The method further includes: Add a backup function to the system's built-in call function to obtain a first modified call function; wherein, the backup function is used to obtain the source function corresponding to the at least one extracted function when running; Use the first modified call function as the preset call function.

4. The method according to claim 1, wherein The method further includes: Obtain the system's built-in call function; Add a backup function to the system's built-in call function to obtain a second modified call function; wherein, the backup function is used to obtain the source function corresponding to the at least one extracted function when running; Create a custom function by using the second modified call function; Use the custom function as the preset call function.

5. The method according to claim 4, wherein, The executing the preset call function includes: Execute the custom function in a hook manner.

6. A shelling treatment device, wherein, Including: An obtaining part, configured to obtain the executable file to be unpacked of the target application; The obtaining part is further configured to obtain the function identifier of at least one extracted function in the executable file to be unpacked; The obtaining part is further configured to obtain the source function corresponding to the at least one extracted function from a preset storage space based on the function identifier of the at least one extracted function; The backfilling part is configured to backfill the source functions corresponding to the at least one extracted function into the executable file to be unpacked, so as to obtain the unpacked executable source file; The obtaining part is specifically configured to initialize a function mapping relationship table by using the function identifiers of the at least one extracted function obtained; wherein, the function mapping relationship table includes the mapping relationship between the function identifiers of the at least one extracted function and the at least one extracted function; based on the function identifiers of at least one extracted function in the function mapping relationship table, execute a preset call function to obtain the source functions corresponding to the at least one extracted function from the preset storage space; store the source functions corresponding to the at least one extracted function into the function mapping relationship table; Alternatively, based on the function identifiers of the at least one extracted function, execute a preset call function to obtain the source functions corresponding to the at least one extracted function from the preset storage space; construct a function mapping relationship table by using the function identifiers of the at least one extracted function and their corresponding source functions.

7. A shelling processing device, wherein, The device includes: a processor and a memory configured to store a computer program that can run on the processor, wherein, when the processor is configured to run the computer program, it executes the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed by the processor, it realizes the steps of the method according to any one of claims 1 to 5.

Images