Vulnerability detection method and device, computer device and storage medium

Abstract

The application discloses a vulnerability detection method and device, computer equipment and a storage medium. The vulnerability detection method comprises the following steps: reading detection code corresponding to a preset document vulnerability, wherein the detection code is obtained based on target code of document software, and the target code is code corresponding to a target execution process of the document software when a document file is historically opened; simulating the target execution process when the document software opens a target document through the detection code, and detecting whether the target document triggers the preset document vulnerability in the simulated target execution process to obtain a vulnerability detection result of the target document, wherein the vulnerability detection result is used to represent whether the target document triggers the document software to generate the preset document vulnerability. The method can realize accurate detection of a document vulnerability.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a vulnerability detection method, apparatus, computer device, and storage medium. Background Technology

[0002] A vulnerability is a weakness or defect in software. Attackers often exploit vulnerabilities to cause program behavior to violate certain security policies. Currently, for discovered software vulnerabilities, official developers can create and distribute patches to users to fix them. However, there are also software vulnerabilities that have not yet been discovered by official developers but have been found and exploited by hackers—these are zero-day vulnerabilities. Malicious documents are abnormal files intentionally created based on zero-day vulnerabilities in the software that loads them. These documents can be in formats such as DOC, PDF, XLS, or PPT. A document specifically crafted to exploit a zero-day vulnerability in the software that loads it can successfully execute malicious commands when opened under certain conditions. Therefore, to ensure software security, it is necessary to promptly identify malicious documents on terminal devices. Summary of the Invention

[0003] This application proposes a vulnerability detection method, apparatus, computer equipment, and storage medium that can achieve accurate detection of document vulnerabilities.

[0004] In a first aspect, embodiments of this application provide a vulnerability detection method, the method comprising: reading detection code corresponding to a preset document vulnerability, the detection code being obtained based on target code of document software, the target code being code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened a document file; simulating the target execution process when the document software opens a target document using the detection code, and detecting whether the target document triggers the preset document vulnerability during the simulated target execution process, thereby obtaining a vulnerability detection result for the target document, the vulnerability detection result being used to characterize whether the target document triggers the document software to generate the preset document vulnerability.

[0005] Secondly, embodiments of this application provide a vulnerability detection device, the device comprising: a code reading module and a vulnerability detection module, wherein the code reading module is used to read detection code corresponding to a preset document vulnerability, the detection code being obtained based on the target code of the document software, the target code being the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file; the vulnerability detection module is used to simulate the target execution process when the document software opens the target document using the detection code, and to detect whether the target document will trigger the preset document vulnerability during the simulated target execution process, thereby obtaining a vulnerability detection result for the target document, the vulnerability detection result being used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

[0006] Thirdly, embodiments of this application provide a computer device, including: one or more processors; a memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to perform the vulnerability detection method provided in the first aspect above.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium storing program code, which can be invoked by a processor to execute the vulnerability detection method provided in the first aspect above.

[0008] Fifthly, embodiments of this application provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the vulnerability detection method provided in the first aspect above.

[0009] The solution provided in this application reads the detection code corresponding to a preset document vulnerability. This detection code is derived from the target code of the document software, which is the code corresponding to the target execution process that generates the preset document vulnerability when the document software historically opens a document file. Using the detection code, the target execution process when the document software opens the target document is simulated. During the simulated target execution process, it is detected whether the target document triggers the preset document vulnerability, resulting in a vulnerability detection result for the target document. This vulnerability detection result characterizes whether the target document triggers the document software to generate the preset document vulnerability. Therefore, since the detection code is derived from the code corresponding to the target execution process that generates the preset document vulnerability in the document software, the target execution process when the document software opens the target document can be simulated using the detection code. Furthermore, by detecting whether the target document triggers the preset document vulnerability during the simulated target execution process, accurate detection of preset document vulnerabilities can be achieved during static document vulnerability detection, thus improving the detection speed. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart of a vulnerability detection method according to an embodiment of this application is shown.

[0012] Figure 2 A flowchart of a vulnerability detection method according to another embodiment of this application is shown.

[0013] Figure 3 A flowchart of a vulnerability detection method according to yet another embodiment of this application is shown.

[0014] Figure 4 A block diagram of a vulnerability detection apparatus according to an embodiment of this application is shown.

[0015] Figure 5 This is a block diagram of a computer device for performing a vulnerability detection method according to an embodiment of this application.

[0016] Figure 6 This is a storage unit in this application embodiment for storing or carrying program code that implements the vulnerability detection method according to this application embodiment. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0018] In computer security, a vulnerability is a weakness in software that attackers can exploit to cross the privilege boundaries within a computer system, enabling them to perform unauthorized operations. This threatens the confidentiality, integrity, availability, and access control of system or application data. For document-related vulnerabilities (i.e., document vulnerabilities), such as those in Office software, opening a document file that has been modified or has been given specially constructed content (i.e., a vulnerable document) will trigger a program error. In other words, opening a vulnerable document will cause the document vulnerability to be triggered, leading to a program error.

[0019] In related technologies, vulnerability document detection methods are generally divided into static detection and dynamic detection. Static detection is performed on the document before it is opened; for example, a computer device performs a static detection on a new document file after it is stored. Dynamic detection is performed when the document is opened. However, static detection is difficult to accurately locate vulnerability points and is prone to false positives or being bypassed by attackers. Although dynamic detection can locate vulnerability points more accurately, it is time-consuming and difficult to deploy on user terminals.

[0020] To address the aforementioned problems, the inventors have proposed a vulnerability detection method, apparatus, computer device, and storage medium as provided in the embodiments of this application. By utilizing detection code, the target execution process when document software opens a target document is simulated. Furthermore, by detecting whether the target document triggers a preset document vulnerability during this simulated execution process, the method enables accurate detection of preset document vulnerabilities during static vulnerability detection, thereby improving the detection speed. The specific vulnerability detection method will be described in detail in subsequent embodiments.

[0021] The vulnerability detection method provided in the embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0022] Please see Figure 1 , Figure 1 A flowchart illustrating a vulnerability detection method according to an embodiment of this application is shown. In a specific embodiment, the vulnerability detection method is applied to a computer device. The following will focus on... Figure 1 The process shown will be described in detail. The vulnerability detection method may specifically include the following steps:

[0023] Step S110: Read the detection code corresponding to the preset document vulnerability. The detection code is obtained based on the target code of the document software. The target code is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file.

[0024] In this embodiment, the computer device may pre-store detection code for preset document vulnerabilities. This detection code is used to detect whether opening any document with document software will trigger the preset document vulnerability. The document software is software used to view and edit document content. The document can be a text document, a spreadsheet document, etc., and the specific type is not limited.

[0025] In some implementations, the pre-defined document vulnerability may include at least one of the following: overflow vulnerability, privilege escalation vulnerability, arbitrary code execution vulnerability, and use of freed memory vulnerability.

[0026] Overflow vulnerabilities arise from inadequate boundary validation of received data by one or more input functions (user input parameters) in a program. For example, a buffer overflow vulnerability in a document file might involve a target image and target data indicating the image's size. If this data is altered, specifying the image size as 50 kilobytes (KB), when the actual image size is 55 KB, the document software might request a buffer based on the 50 KB size during file opening and image parsing. Since the actual image size is larger, this triggers a buffer overflow. Privilege escalation vulnerabilities refer to privilege escalation caused by kernel-level overflows, i.e., escalation from ordinary to special privileges. Arbitrary code execution vulnerabilities occur when programmers use execution functions like `eval` and `assert`, allowing users to control the execution of strings within these functions, thus creating security vulnerabilities. Misuse of freed memory vulnerabilities refer to errors occurring when freed memory is misused.

[0027] In some implementations, the computer device may store the aforementioned detection code. Optionally, the detection code may be the code corresponding to the target execution process that generates a preset document vulnerability when the document software historically opens document files (i.e., the target code), and the detection code may simulate the target execution process when the document software opens a document, and detect whether the document will trigger the preset document vulnerability during the simulated target execution process. Optionally, the aforementioned detection code may also be obtained by other devices and then sent to the computer device for storage.

[0028] Step S120: Using the detection code, simulate the target execution process when the document software opens the target document, and detect whether the target document will trigger the preset document vulnerability during the simulated target execution process, and obtain the vulnerability detection result of the target document. The vulnerability detection result is used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

[0029] In this embodiment, the target document refers to any document file that needs to be detected for document vulnerabilities. Specifically, it requires detecting whether opening the target document will trigger a pre-defined document vulnerability in the document software. After obtaining the target document, the computer device can use the detection code to detect document vulnerabilities. This involves simulating the execution process of the target document when it is opened by the document software, and detecting whether the target document triggers a pre-defined document vulnerability during the simulated execution process. The vulnerability detection result of the target document is then obtained, allowing the determination of whether the target document will trigger a pre-defined document vulnerability in the document software.

[0030] In some implementations, each time a computer device stores a new document file, such as when it receives and stores a document file sent by an external device, it can use the vulnerability detection method provided in this application to detect whether the newly stored document file will trigger the document software to generate the above-mentioned preset vulnerability, thereby avoiding security risks caused by the newly stored document file.

[0031] The vulnerability detection method provided in this application uses detection code to simulate the target execution process when a document software opens a target document. By detecting whether the target document will trigger a preset document vulnerability during the simulated target execution process, the method can accurately detect preset document vulnerabilities during static detection of document vulnerabilities and improve the detection speed of document vulnerabilities. In addition, since vulnerability detection is performed by simulating the target execution process when a document software opens a target document, accurate static detection of vulnerable documents can be achieved.

[0032] Please see Figure 2 , Figure 2 A flowchart illustrating a vulnerability detection method according to another embodiment of this application is shown. This vulnerability detection method is applied to the aforementioned computer device, and will be discussed below. Figure 2 The process shown will be described in detail. The vulnerability detection method may specifically include the following steps:

[0033] Step S210: In response to the code selection operation, select the target code from all the codes corresponding to the document software.

[0034] Regarding the detection code in the foregoing embodiments, this application also provides a method for obtaining the detection code. It is worth noting that the acquisition of the detection code can be done in advance, and the detection code can be used each time a document vulnerability is detected, without having to acquire the detection code every time a document vulnerability is detected.

[0035] In this embodiment, when obtaining the detection code, the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file can be selected from all the code corresponding to the document software, and the selected code can be used as the target code. The target execution process may include the process of reading and parsing the file when the preset document vulnerability is generated.

[0036] In some implementations, since documentation software typically does not directly provide source code to users, the computer device can obtain the machine code (i.e., binary code) generated by the documentation software during runtime and display it, allowing users to select the machine code corresponding to the target execution process from the documentation software's machine code as the target code. Machine code is the corresponding binary machine code obtained by compiling the source code. The compiled machine code can be directly executed by the Central Processing Unit (CPU), thereby improving the software's runtime speed. Source code can refer to the uncompiled code of the software, such as Java code.

[0037] In some implementations, the computer device can obtain historical vulnerability information corresponding to document vulnerabilities generated when the document software opened document files in the past; filter target vulnerability information of preset document vulnerabilities from the historical vulnerability information and display the target vulnerability information; and in response to a code selection operation input based on the displayed target vulnerability information, select target code from all the code corresponding to the document software.

[0038] Historical vulnerability information can include vulnerability information disclosed by the document software vendor. For example, if the document software is Office, the vulnerability information can be obtained from the official Office platform. Alternatively, it can be historical vulnerability information collected by a third-party platform, corresponding to document vulnerabilities that occurred when the document software was opened in the past. This historical vulnerability information can include the cause of the vulnerability and the software module where the vulnerability occurred. Based on this historical vulnerability information, vulnerability information corresponding to preset document vulnerabilities can be filtered out.

[0039] In this implementation, after filtering out historical vulnerability information corresponding to preset document vulnerabilities (as target vulnerability information), the target vulnerability information can be displayed for reverse engineering of the target vulnerability information generated by the user's document software. This allows the code corresponding to the above target execution process to be determined from all the code corresponding to the document software. Reverse engineering involves analyzing and studying a target product to deduce its processing flow, organizational structure, functional performance specifications, and other design elements, in order to create products with similar but not identical functions. When selecting the above target code, reverse engineering can be used to determine the code corresponding to the process that generated the preset document vulnerability when the document software historically opened document files.

[0040] Step S220: Add first code to the target code to obtain the detection code. The first code is used to detect whether the target document will trigger the preset document vulnerability during the execution of the target.

[0041] In this embodiment, after obtaining the target code, a first code can be added to the target code. This first code is used to detect whether the target document will trigger a preset document vulnerability during the execution of the target, thereby obtaining the detection code and storing it. It is understood that by adding the first code to the target code, the detection of preset document vulnerabilities can be achieved by locating the target execution process without simulating the entire execution process of opening the target document using document software. This enables accurate detection of document vulnerabilities and improves the detection speed of preset document vulnerabilities.

[0042] In some implementations, code editing typically involves editing assembly language code; therefore, the first code to be added may also be assembly language code. In such cases, the computer device can determine whether the target code is machine code. If the target code is machine code, it can be decompiled to obtain second code in assembly language. Then, in response to the editing operation on the second code, the first code is added at a specified location in the second code to obtain the detection code, which is then stored.

[0043] For example, regarding a buffer overflow vulnerability triggered by a document file, a document file includes a target image and target data indicating the size of the target image. If the target data is modified to indicate a target image size of 50 kilobytes (KB), while the actual target image size is 55 KB, then when the document software opens the file and reads and parses the target image, it will request a buffer size of 50 KB. Since the actual size of the target image will be larger than the requested buffer size, a buffer overflow vulnerability will be triggered. Therefore, a first piece of code can be added to the target code corresponding to the target execution process of reading and parsing the image. This first piece of code determines whether the buffer size indicated by the target data matches the actual size of the image. If they do not match, it indicates that the document will trigger a buffer overflow vulnerability during target execution.

[0044] Step S230: Read the detection code corresponding to the preset document vulnerability. The detection code is obtained based on the target code of the document software. The target code is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file.

[0045] Step S240: Using the detection code, simulate the target execution process when the document software opens the target document, and detect whether the target document will trigger the preset document vulnerability during the simulated target execution process, and obtain the vulnerability detection result of the target document. The vulnerability detection result is used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

[0046] In the embodiments of this application, steps S230 and S240 can be referred to the content of the foregoing embodiments, and will not be repeated here.

[0047] The vulnerability detection method provided in this application obtains the target code corresponding to the target execution process of a preset document vulnerability generated when the document software historically opened a document file, and adds first code to the target code to detect whether the document will trigger the preset document vulnerability during the target execution process, so as to obtain detection code. The obtained detection code can be used to simulate the target execution process when the document software opens the target document, and by detecting whether the target document will trigger the preset document vulnerability during the simulated target execution process, the method can accurately detect the preset document vulnerability when performing static detection of document vulnerabilities and improve the detection speed of document vulnerabilities.

[0048] Please see Figure 3 , Figure 3A flowchart illustrating a vulnerability detection method according to another embodiment of this application is shown. This vulnerability detection method is applied to the aforementioned computer device, and will be discussed below. Figure 3 The process shown will be described in detail. The vulnerability detection method may specifically include the following steps:

[0049] Step S310: Read the detection code corresponding to the preset document vulnerability. The detection code is obtained based on the target code of the document software. The target code is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file.

[0050] Step S320: Using the detection code, simulate the target execution process when the document software opens the target document, and detect whether the target document will trigger the preset document vulnerability during the simulated target execution process, and obtain the vulnerability detection result of the target document. The vulnerability detection result is used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

[0051] In the embodiments of this application, steps S310 and S320 can be referred to the content of the foregoing embodiments, and will not be repeated here.

[0052] Step S330: If the vulnerability detection result indicates that the target document will trigger the document software to generate the preset document vulnerability, then output the first prompt information, which is used to prompt that the target document is a vulnerable document.

[0053] In this embodiment of the application, after using detection code to detect whether the target document will trigger a preset document vulnerability and obtaining the vulnerability detection result, if the vulnerability detection result indicates that the target document will trigger the document software to generate the preset document vulnerability, then a first prompt message is specifically output to indicate that the target document is a vulnerable document.

[0054] In one possible implementation, when the computer device outputs the first prompt information mentioned above, it can output a pop-up prompt information in the display interface. For example, when the computer device is a PC, it can output a pop-up prompt information in the information prompt area in the lower right corner of the desktop. The pop-up prompt information can include content to indicate that the target document is a vulnerable document.

[0055] Optionally, the pop-up notification may also include a file control. Upon detecting a triggering action on that file control, such as a click, the file management interface of the folder containing the target document can be displayed, allowing the user to delete the target document. Therefore, if document vulnerability detection is performed every time a new document is stored on the computer, newly stored documents can be promptly deleted upon detection of vulnerabilities, effectively protecting the computer device.

[0056] Optionally, the pop-up notification may also include a delete control. If a triggering operation on this delete control is detected, the computer device can respond to the triggering operation and delete the target document. Therefore, if document vulnerability detection is performed every time a new document is stored on the computer device, a newly stored document can be promptly deleted after a vulnerable document is detected, thus effectively protecting the computer device.

[0057] Optionally, the computer device can also delete the target document while outputting the first warning message. For example, if the computer device is configured to proactively delete a vulnerable document upon detecting that a newly stored document is vulnerable, then upon determining that the vulnerability detection result indicates that the target document will trigger a preset document vulnerability in the document software, the computer device can delete the target document while outputting the first warning message, thereby providing timely protection for the computer device.

[0058] In one possible implementation, when the computer device outputs the first prompt information mentioned above, it may also output audio prompt information, such as a beeping sound or an alarm sound, and output voice content indicating that the target document is a vulnerable document.

[0059] The vulnerability detection method provided in this application simulates the target execution process when a document software opens a target document using detection code. By detecting whether the target document triggers a preset document vulnerability during the simulated target execution process, it can accurately detect preset document vulnerabilities during static document vulnerability detection and improve the detection speed. In addition, after obtaining the vulnerability detection result, it also outputs prompt information based on the vulnerability detection result so that the user knows whether the target document is a vulnerable document, thereby effectively protecting the computer device.

[0060] Please see Figure 4This document illustrates a structural block diagram of a vulnerability detection device 400 provided in an embodiment of this application. The vulnerability detection device 400 utilizes the aforementioned computer equipment and includes a code reading module 410 and a vulnerability detection module 420. The code reading module 410 reads detection code corresponding to a preset document vulnerability. This detection code is obtained based on the target code of the document software, which is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file. The vulnerability detection module 420 uses the detection code to simulate the target execution process when the document software opens the target document, and detects whether the target document triggers the preset document vulnerability during the simulated target execution process, obtaining a vulnerability detection result for the target document. This vulnerability detection result characterizes whether the target document triggers the document software to generate the preset document vulnerability.

[0061] In some implementations, the vulnerability detection device 400 may further include a code acquisition module. The code acquisition module is used to: add first code to the target code to obtain the detection code, and store the detection code. The first code is used to detect whether the target document will trigger the preset document vulnerability during the execution of the target.

[0062] In one possible implementation, the first code is assembly language type code, and the code acquisition module can be specifically used to: if the target code is machine code, then reverse compile the target code to obtain a second code of assembly language type; in response to the editing operation on the second code, add the first code at a specified position in the second code to obtain the detection code, and store the detection code.

[0063] In one possible implementation, the code acquisition module can also be used to select the target code from all the codes corresponding to the document software in response to a code selection operation, before adding the first code to the target code to obtain the detection code and storing the detection code.

[0064] Optionally, the code acquisition module can also be specifically used to: acquire historical vulnerability information corresponding to document vulnerabilities generated when the document software historically opened document files; filter target vulnerability information of the preset document vulnerabilities from the historical vulnerability information and display the target vulnerability information; and select the target code from all the codes corresponding to the document software in response to a code selection operation input based on the displayed target vulnerability information.

[0065] In some implementations, the pre-defined document vulnerability includes at least one of an overflow vulnerability, a privilege escalation vulnerability, an arbitrary code execution vulnerability, and a vulnerability that uses freed memory.

[0066] In one possible implementation, the vulnerability detection device 400 may further include an information prompting module. The information prompting module is used to output a first prompt message based on the vulnerability detection result, the first prompt message indicating that the target document is a vulnerable document.

[0067] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0068] In the several embodiments provided in this application, the coupling between modules can be electrical, mechanical, or other forms of coupling.

[0069] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0070] In summary, the solution provided in this application reads the detection code corresponding to a preset document vulnerability. This detection code is derived from the target code of the document software, which is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file. Using this detection code, the target execution process when the document software opens the target document is simulated. During the simulated target execution process, it is detected whether the target document triggers the preset document vulnerability, thus obtaining a vulnerability detection result for the target document. This vulnerability detection result characterizes whether the target document triggers the document software to generate the preset document vulnerability. Therefore, since the detection code is derived from the code corresponding to the target execution process that generated the preset document vulnerability in the document software, the target execution process when the document software opens the target document can be simulated using the detection code. Furthermore, by detecting whether the target document triggers the preset document vulnerability during the simulated target execution process, accurate detection of preset document vulnerabilities can be achieved during static document vulnerability detection, thereby improving the detection speed.

[0071] Please refer to Figure 5This diagram illustrates a structural block diagram of a computer device according to an embodiment of this application. The computer device 100 can be a PC, laptop, smartphone, tablet, e-reader, or other device capable of running applications. The computer device 100 in this application may include one or more of the following components: a processor 110, a memory 120, and one or more applications, wherein the one or more applications can be stored in the memory 120 and configured to be executed by the one or more processors 110, and the one or more applications are configured to perform the methods described in the foregoing method embodiments.

[0072] Processor 110 may include one or more processing cores. Processor 110 connects to various parts within the computer device 100 using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 120, and by calling data stored in memory 120. Optionally, processor 110 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 110 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 110 and may be implemented separately using a communication chip.

[0073] The memory 120 may include random access memory (RAM) or read-only memory (ROM). The memory 120 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 120 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described below. The data storage area may also store data created by the computer device 100 during use (such as phonebooks, audio and video data, chat log data, etc.).

[0074] Please refer to Figure 6 This diagram illustrates a structural block diagram of a computer-readable storage medium provided in an embodiment of this application. The computer-readable medium 600 stores program code that can be called by a processor to execute the methods described in the above method embodiments.

[0075] The computer-readable storage medium 600 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 600 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 600 has storage space for program code 610 that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code 610 may be compressed, for example, in a suitable form.

[0076] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the voice control method provided in the foregoing embodiments.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A vulnerability detection method, characterized in that, The method includes: In response to the code selection operation, target code is selected from all the code corresponding to the document software. The target code is the code corresponding to the target execution process that generated the preset document vulnerability when the document software historically opened the document file. Add a first code to the target code to obtain the detection code corresponding to the preset document vulnerability. The first code is used to detect whether the target document will trigger the preset document vulnerability during the target execution process of the preset document vulnerability. Read the detection code; The detection code simulates the target execution process when the document software opens the target document, and detects whether the target document will trigger the preset document vulnerability during the simulated target execution process, thereby obtaining the vulnerability detection result of the target document. The vulnerability detection result is used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

2. The method according to claim 1, characterized in that, The first code is assembly language type code. Adding the first code to the target code to obtain the detection code corresponding to the preset document vulnerability includes: If the target code is machine code, then the target code is decompiled to obtain a second code of assembly language type; In response to an editing operation on the second code, the first code is added at a specified location in the second code to obtain the detection code.

3. The method according to claim 1, characterized in that, The step of selecting the target code from all the code corresponding to the document software in response to the code selection operation includes: Obtain historical vulnerability information corresponding to document vulnerabilities generated when the document software opened document files in the past; Filter the target vulnerability information of the preset document vulnerability from the historical vulnerability information, and display the target vulnerability information; In response to a code selection operation based on the displayed target vulnerability information input, the target code is selected from all the code corresponding to the document software.

4. The method according to any one of claims 1-3, characterized in that, The preset document vulnerability includes at least one of the following: overflow vulnerability, privilege escalation vulnerability, arbitrary code execution vulnerability, and vulnerability to use freed memory.

5. The method according to any one of claims 1-3, characterized in that, After simulating the target execution process when the document software opens the target document using the detection code, and detecting whether the target document triggers the preset document vulnerability during the simulated target execution process, and obtaining the vulnerability detection result of the target document, the method further includes: If the vulnerability detection result indicates that the target document will trigger the document software to generate the preset document vulnerability, then a first prompt message is output, which is used to indicate that the target document is a vulnerable document.

6. A vulnerability detection device, characterized in that, The device includes: a code acquisition module, a code reading module, and a vulnerability detection module, wherein, The code acquisition module is used to respond to the code selection operation by selecting target code from all the codes corresponding to the document software. The target code is the code corresponding to the target execution process that generates a preset document vulnerability when the document software historically opened the document file. A first code is added to the target code to obtain the detection code corresponding to the preset document vulnerability. The first code is used to detect whether the target document will trigger the preset document vulnerability during the target execution process of the preset document vulnerability. The code reading module is used to read the detection code; The vulnerability detection module is used to simulate the target execution process when the document software opens the target document using the detection code, and to detect whether the target document will trigger the preset document vulnerability during the simulated target execution process, thereby obtaining the vulnerability detection result of the target document. The vulnerability detection result is used to characterize whether the target document will trigger the document software to generate the preset document vulnerability.

7. A computer device, characterized in that, include: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs being configured to perform the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1-5.

Images