Data acquisition methods, devices, equipment and storage media

Abstract

This disclosure presents a data acquisition method, apparatus, device, and storage medium. The method includes: activating a local server proxy within a preset application; acquiring a preset connection function and replacing the destination address in the function with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy; establishing a connection between the local server proxy and a real server corresponding to the target address based on connection information sent by the preset application; forwarding data between the real server and the preset application; and acquiring the data. By adopting this technical solution, the acquisition mechanism can be implemented within the application without the need for external tools. The local server proxy within the application forwards data between the application and the real server, allowing for the acquisition of more accurate and readable network data during the forwarding process, facilitating data analysis.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to data acquisition methods, apparatus, devices, and storage media. Background Technology

[0002] With the rapid development of internet technology, many applications have network connectivity. To ensure network security during application operation, it is usually necessary to acquire data packets for further analysis.

[0003] However, current data acquisition technologies for applications all rely on external tools, making it difficult to obtain data from within the application itself. As a result, the acquired data suffers from poor readability and other issues. Therefore, existing data acquisition solutions are not perfect. Summary of the Invention

[0004] This disclosure provides data acquisition methods, apparatus, storage media, and devices, which can optimize existing data acquisition schemes.

[0005] In a first aspect, embodiments of this disclosure provide a data acquisition method, including:

[0006] Start the local server agent in the default application;

[0007] When the preset application calls the preset connection function, the preset connection function is obtained, and the destination address in the preset connection function is replaced with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy. The target address is pre-written in the preset application.

[0008] The local server proxy receives connection information sent by the preset application and establishes a connection between the local server proxy and the real server corresponding to the target address based on the connection information.

[0009] The local server acts as a proxy to forward data between the real server and the preset application, and acquires data during the forwarding process.

[0010] Secondly, embodiments of this disclosure provide a data acquisition device, including:

[0011] The local server agent startup module is used to start the local server agent in a preset application.

[0012] The first connection module is used to obtain the preset connection function when the preset application calls the preset connection function, and replace the destination address in the preset connection function with the target address corresponding to the local server proxy, so as to establish a connection between the preset application and the local server proxy, wherein the target address is pre-written in the preset application;

[0013] The second connection module is used to receive connection information sent by the preset application through the local server proxy, and establish a connection between the local server proxy and the real server corresponding to the target address based on the connection information.

[0014] The data acquisition module is used to forward data between the real server and the preset application through the local server proxy, and to acquire data during the forwarding process.

[0015] Thirdly, embodiments of this disclosure provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the data acquisition method provided in embodiments of this disclosure.

[0016] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data acquisition method provided in embodiments of this disclosure.

[0017] The data acquisition scheme provided in this embodiment starts a local server proxy in a preset application. When the preset application calls a preset connection function, the local server proxy acquires the preset connection function and replaces the destination address in the preset connection function with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy. The target address is pre-programmed in the preset application. The local server proxy receives connection information sent by the preset application and establishes a connection between the local server proxy and the real server corresponding to the target address based on the connection information. The local server proxy forwards data between the real server and the preset application and acquires data during the forwarding process. By adopting the above technical solution, the acquisition mechanism can be implemented within the application without the need for external tools. The local server proxy within the application forwards data between the application and the real server, allowing for the acquisition of more accurate and readable network data during the forwarding process, facilitating data analysis. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a data acquisition method provided in an embodiment of this disclosure;

[0019] Figure 2 A flowchart illustrating another data acquisition method provided in this embodiment of the disclosure;

[0020] Figure 3 A schematic diagram illustrating the principle of a data acquisition method provided in an embodiment of this disclosure;

[0021] Figure 4 A structural block diagram of a data acquisition device provided in an embodiment of this disclosure;

[0022] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0023] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0024] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0025] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0026] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0027] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0028] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0029] In the following embodiments, each embodiment provides optional features and examples. The features described in the embodiments can be combined to form multiple optional solutions. Each numbered embodiment should not be regarded as only one technical solution.

[0030] Figure 1 This disclosure provides a flowchart illustrating a data acquisition method. This method can be applied to a preset application and can be executed by a data acquisition device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. The electronic device can be a mobile device such as a mobile phone, smartwatch, tablet computer, or personal digital assistant; it can also be other devices such as a desktop computer.

[0031] like Figure 1 As shown, the method includes:

[0032] Step 101: Start the local server agent in the default application.

[0033] For example, the default application can be any application with network access capabilities. The default application is loaded into an operating system, and the specific type of operating system is not limited. For example, it can include Unix, Linux, Apple (iOS, macOS, or OS X), and Android, etc. For ease of explanation, Android will be used as an example below.

[0034] In this embodiment of the disclosure, the local server proxy can be understood as a proxy server implemented within a preset application. During the development phase of the preset application, the relevant code for implementing the local server proxy can be pre-written, including the target address corresponding to the local server proxy. This target address may include the Internet Protocol (IP) address corresponding to the local network card of the electronic device, such as 127.0.0.1.

[0035] For example, after the default application starts, a local server proxy can be started and bound to the target address, thereby obtaining network data through the local server proxy.

[0036] Step 102: When the preset application calls the preset connection function, the preset connection function is obtained, and the destination address in the preset connection function is replaced with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy. The target address is pre-written in the preset application.

[0037] For example, applications need to use sockets to implement network capabilities. A socket is an Application Programming Interface (API) for inter-process communication in a network environment, also known as the socket interface, and is the underlying interface for network capabilities on many operating system platforms. The socket implementation includes a connect function, also known as the connect method. The connect function, as an implementation of the socket, can be used to establish a connection with the corresponding socket. When an application initiates a network request and needs to call the socket, it can call the corresponding connect function.

[0038] For example, the preset connection function can be understood as the connection function called when a preset application initiates a network request. In the preset connection function, the original request address (i.e., the destination address) is the address of the real server, which can be understood as the remote server that the preset application needs to establish a network connection with. In this embodiment of the disclosure, the preset connection function is hooked, and the destination address in it is replaced with the target address corresponding to the local server proxy, so that the preset application (which can be understood here as a network function-related module in the preset application, such as the module that initiates a network request or the module that needs to establish a network connection with the remote server) can connect to the target address, that is, establish a connection with the local server proxy, instead of directly connecting to the real server. The specific connection method can be determined according to the protocol type corresponding to the network request initiated by the preset application. The protocol type may include, for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), live streaming protocol, or file download protocol, etc.

[0039] It should be noted that, as application functionality becomes increasingly rich, the same pre-built application may initiate network requests based on different network protocols during operation, which means it may need to establish network connections with real servers based on different protocols. During the pre-built application development phase, the local server proxy can pre-integrate implementation code based on different network protocols. When it is necessary to proxy the real server to establish a connection with the pre-built application, the corresponding implementation code is used to establish a connection with the pre-built application based on the protocol type corresponding to the current network request.

[0040] Step 103: Receive connection information sent by the preset application through the local server proxy, and establish a connection between the local server proxy and the real server corresponding to the target address based on the connection information.

[0041] For example, after a pre-defined application connects to a local server proxy, it passes the connection information to the local server proxy. The specific content included in the connection information is not limited and can be determined based on the specific type of network request. For instance, if the network request is to download a file, the corresponding connection information may include the file's address on the real server, the Uniform Resource Locator (URL), the file format, and the file size, among other relevant information. The local server proxy can then initiate a corresponding network request to the real server based on the connection information, thereby establishing a network connection between the local server proxy and the real server.

[0042] Step 104: Forward data between the real server and the preset application through a local server proxy, and acquire data during the forwarding process.

[0043] For example, network data sent by the default application to the real server is sent to a local server proxy, which then forwards it to the real server. Similarly, network data returned by the real server to the default application is first returned to the local server proxy, which then forwards it to the default application. During this data forwarding process, the local server proxy can acquire data, i.e., obtain data packets. Because this acquisition is performed within the default application, the accuracy and readability of the acquired data are guaranteed.

[0044] The data acquisition method provided in this embodiment starts a local server proxy in a preset application. When the preset application calls a preset connection function, the method acquires the preset connection function and replaces the destination address in the preset connection function with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy. The target address is pre-programmed in the preset application. The local server proxy receives connection information sent by the preset application and establishes a connection between the local server proxy and the real server corresponding to the target address based on the connection information. The local server proxy forwards data between the real server and the preset application and acquires data during the forwarding process. By adopting the above technical solution, the acquisition mechanism can be implemented within the application without the need for external tools. The local server proxy within the application forwards data between the application and the real server, allowing for the acquisition of more accurate and readable network data during the forwarding process, facilitating data analysis.

[0045] In some embodiments, the local server proxy has a built-in preset digital certificate. The process of forwarding data between the real server and the preset application through the local server proxy, and acquiring data during the forwarding process, includes: performing key negotiation with the preset application based on the preset digital certificate through the local server proxy to obtain a first negotiation result; performing key negotiation with the real server based on the preset digital certificate through the local server proxy to obtain a second negotiation result; receiving first data sent by the preset application through the local server proxy, decrypting the first data according to the first negotiation result to obtain second data, encrypting the second data according to the second negotiation result to obtain third data, and sending the third data to the real server; wherein the second data is the data acquired during the forwarding process. The advantage of this setup is that by embedding a digital certificate in the local server proxy, network data decryption and encryption can be achieved, thereby facilitating the acquisition of more authentic network data that the preset application wants to send to the real server.

[0046] In related technologies, data acquisition techniques for applications all rely on external tools. For encrypted data packets, such as Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) encrypted packets, Transport Layer Security (TLS) encrypted packets, and Secure Sockets Layer (SSL) encrypted packets, external acquisition tools cannot decrypt them, making it inconvenient to parse the data and difficult to analyze the data packets.

[0047] In this embodiment, a set of digital certificates, denoted as the preset digital certificate, can be embedded in the local server proxy. This preset digital certificate, relative to the preset application, can be considered a server-side digital certificate. The local server proxy can perform key negotiation with the preset application based on the preset digital certificate. The preset digital certificate, relative to the real server, can be considered a client-side digital certificate. The local server proxy can also perform key negotiation with the real server based on the preset digital certificate. When the preset application wants to send data (here denoted as the second data) to the real server, it can encrypt the second data using an encryption method negotiated with the local server proxy (which may be included in the first negotiation result), obtaining the first data, which is then sent to the local server proxy. The local server proxy can decrypt the first data to obtain the decrypted real data, i.e., the unencrypted second data. Subsequently, the local server proxy re-encrypts the second data using the encryption method negotiated with the real server (which may be included in the second negotiation result), obtaining the third data, which is then sent to the real server, thus achieving data forwarding. It is understood that the second data is the network data that the preset application wants to send to the real server. The second data is acquired for related analysis and processing.

[0048] In some embodiments, the step of forwarding data between the real server and the preset application through the local server proxy, and acquiring data during the forwarding process, further includes: receiving fourth data sent by the real server through the local server proxy, decrypting the fourth data according to the second negotiation result to obtain fifth data, encrypting the fifth data according to the first negotiation result to obtain sixth data, and sending the sixth data to the real server; wherein, the fifth data is the data acquired during the forwarding process. The advantage of this setup is that it facilitates obtaining more authentic network data that the real server wants to send to the preset application.

[0049] In some embodiments, before detecting that the preset application calls the preset connection function, the method further includes: loading a first core library into the preset application, wherein the first core library centrally manages calls to the preset socket by injecting proxy connection functions from the first core library into a second core library, the second core library containing the preset connection function, the preset connection function being used to establish a connection with the preset socket; and injecting a custom connection function into the second core library based on a preset injection method corresponding to the proxy connection function, the custom connection function being used to replace the destination address in the preset connection function with the target address corresponding to the local server proxy. Specifically, when detecting that the preset application calls the preset connection function, acquiring the preset connection function and replacing the destination address in the preset connection function with the target address corresponding to the local server proxy includes: when detecting that the preset application calls the preset connection function through the second core library, replacing it with calling the custom connection function, thereby replacing the destination address in the preset connection function with the target address corresponding to the local server proxy. The advantage of this setup is that it eliminates the need to inject custom code into every place where a pre-defined connection function needs to be called to achieve the desired result. Instead, it utilizes a pre-defined injection method that can inject proxy connection functions into the second core library, allowing the custom connection function to function as a proxy connection function and centrally manage the calls to the pre-defined connection function. In other words, a single injection of the custom connection function can achieve the effect of injecting multiple pre-defined connection function-related code in batches, reducing the amount of code injected for obtaining connection functions and ensuring the stability and performance of the application.

[0050] For example, the core library, also known as the kernel library, can be understood as the library in the operating system that provides basic functions. The socket implementation resides in the second core library. The name of the second core library may differ across operating systems; for example, in Android, it might be the Bionic library. The first core library is different from the second. Since socket calls are frequent, for ease of management, the first core library can aggregate socket calls at the system level, proxying the actual socket implementation from the second core library to the first core library. The first core library can inject its own socket implementation (which can be called the proxy connection function) into the second core library, so that when the connection function in the second core library is executed, the proxy connection function is executed first, thus achieving centralized management of socket calls. The name of the second core library may differ across operating systems; for example, in Android, it might be the NetdClient library, and the corresponding library file might be libnetd_client.so. The application can load the first core library proactively upon startup or when a loading event of the first core library is detected. Optionally, the second core library may be loaded at the same or different times as the first core library.

[0051] For example, the preset injection method corresponding to the proxy connection function can be understood as an injection method capable of injecting the proxy connection function into the second core library. This method can be written according to actual needs, or it can reuse the injection method provided by the operating system. Optionally, the preset injection method includes a method provided by the operating system for injecting the proxy connection function in the first core library into the second core library.

[0052] For example, in Android, the default injection method includes the NetdClientInitConnect method. This method is publicly available in the Android operating system, and applications can obtain and call this method.

[0053] For example, a custom connection function can be injected into the second core library by calling a preset injection method.

[0054] In this embodiment of the disclosure, a custom connection function can be pre-written during the development phase of a preset application. The function of the custom connection function is to implement custom logic, which can be understood as the logic required to implement the hook. Specifically, it replaces the destination address in the preset connection function with the target address corresponding to the local server proxy. The custom logic can exist in the custom connection function as a parameter, also known as a custom parameter. The custom parameter can specifically be a function or related code used to implement the custom logic.

[0055] Optionally, the custom connection function is injected with preset parameters. Preset parameters can be passed when calling the preset injection method; these parameters can be understood as the object to be injected. By using the custom connection function as the injection object, that is, by passing the custom connection function into the preset injection method, the custom connection function is injected into the second core library.

[0056] For example, when a pre-defined application initiates a network request, it needs to call a pre-defined socket. This requires calling the corresponding pre-defined connection function through the second core library. Since the custom connection function has already been injected into the second core library, the original pre-defined connection function being called will not be executed directly. Instead, the custom connection function will be executed first, thereby replacing the destination address in the pre-defined connection function with the target address corresponding to the local server proxy.

[0057] In some embodiments, injecting the custom connection function into the second core library based on the preset injection method corresponding to the proxy connection function includes: using a preset dynamic library symbolic function to find the address of the preset injection method corresponding to the proxy connection function; and calling the preset injection method according to the address of the preset injection method to inject the custom connection function into the second core library. The advantage of this setup is that it allows for quick and accurate location and invocation of the address of the preset injection method provided by the operating system.

[0058] The dynamic library symbol (dlsym) function returns the address of a symbol based on the dynamic link library's operation handle and the symbol itself. It can retrieve not only function addresses but also variable addresses. Pre-defined dynamic library symbol functions can be understood as dlsym functions pre-written during the application development phase to find the addresses of pre-defined injection methods; for example, the dlsym function used to find the address of the NetdClientInitConnect method.

[0059] In some embodiments, after replacing the default connection function with a custom connection function to replace the destination address in the default connection function with the target address corresponding to the local server proxy, the method further includes: executing a system call to the default connection function. The advantage of this configuration is that it prevents the default connection function from being called again after the custom connection function has finished executing, thus avoiding a hook-based infinite loop.

[0060] For example, a system call (also known as a syscall) is a means for user space to access the kernel and is a legitimate entry point into the kernel. In the normal case of calling the preset linker function, the corresponding system call will continue to invoke the relevant functions at the system's lower layers (kernel layer) to ultimately implement the functionality of the preset linker function. In this embodiment, after calling the custom linker function to implement custom logic, the system call to the preset linker function is executed directly, instead of returning to the preset linker function, to prevent infinite loops and ensure the normal operation of the preset application.

[0061] Figure 2 This is a flowchart illustrating another data acquisition method provided in an embodiment of the present disclosure. The embodiments of the present disclosure are optimized based on the various optional solutions in the above embodiments. Figure 3 This is a schematic diagram illustrating the principle of a data acquisition method provided in an embodiment of this disclosure, which can be combined with... Figure 2 and Figure 3 The embodiments of this disclosure are understood.

[0062] Specifically, taking the Android operating system as an example, this method includes the following steps:

[0063] Step 201: After the preset application starts, the first core library is loaded in the preset application. The first core library centrally manages the calls to the preset socket by injecting the proxy connection function in the first core library into the second core library. The second core library contains the preset connection function, which is used to establish a connection with the preset socket.

[0064] For example, the NetdClient library is loaded automatically after the application starts, that is, the libnetd_client.so file is loaded.

[0065] Step 202: Use the preset dynamic library symbol function to find the address of the preset injection method corresponding to the proxy linking function.

[0066] For example, a pre-written dlsym function can be used during the application development phase to find the address of the NetdClientInitConnect method.

[0067] Step 203: Call the preset injection method according to the address of the preset injection method to inject the preset parameters into the second core library.

[0068] The custom connection function is injected with preset parameters. The custom connection function is used to replace the destination address in the preset connection function with the target address corresponding to the local server proxy.

[0069] For example, a pre-defined application can call the NetdClientInitConnect method in the NetdClient library and pass in a custom connection function to inject the custom connection function into the Bionic library.

[0070] Step 204: When a preset application calls a preset connection function through the second core library, it is replaced with a call to a custom connection function, so as to replace the destination address in the preset connection function with the target address corresponding to the local server proxy.

[0071] For example, when a pre-defined application initiates a network request, it can be detected that the pre-defined application calls a pre-defined connection function in the Bionic library. At this point, a custom connection function can be called instead to implement the logic required for hooking. For example, the destination address in the connect function can be replaced with 127.0.0.1.

[0072] Step 205: Execute the system call of the preset connection function to establish a connection between the preset application and the local server agent, and send the connection information to the local server.

[0073] Step 206: Establish a connection between the local server proxy and the real server corresponding to the target address based on the connection information through the local server proxy.

[0074] like Figure 3 As shown, in the original scheme, after the application calls the connection function, it directly establishes a network connection with the real server (as shown by the dashed arrow in the figure); while in this embodiment, by obtaining the connection function, the application first establishes a connection with the local server proxy, and then the local server proxy establishes a network connection with the real server (as shown by the solid arrow in the figure). After the connection is established, the local server proxy acts as a relay to forward data between the application and the real server and save the obtained data packets.

[0075] Step 207: Through the local server proxy, perform key negotiation with the preset application based on the preset digital certificate to obtain the first negotiation result, and perform key negotiation with the real server based on the preset digital certificate to obtain the second negotiation result.

[0076] For encrypted transmissions, the local server's built-in preset digital certificate can be used to negotiate keys with both the preset application and the real server. This facilitates subsequent data decryption and encryption, ensuring data transmission security while obtaining accurate and reliable data for later analysis and processing.

[0077] Step 208: Receive first data sent by a preset application through a local server proxy, decrypt the first data according to the first negotiation result to obtain second data, encrypt the second data according to the second negotiation result to obtain third data, and send the third data to the real server, wherein the second data is the data obtained during the forwarding process.

[0078] Step 209: Receive the fourth data sent by the real server through the local server proxy, decrypt the fourth data according to the second negotiation result to obtain the fifth data, encrypt the fifth data according to the first negotiation result to obtain the sixth data, and send the sixth data to the real server, wherein the fifth data is the data obtained during the forwarding process.

[0079] Optionally, after obtaining the second and fifth data, the second and fifth data can be analyzed according to a preset data analysis strategy, such as detecting whether there are any anomalies.

[0080] The data acquisition method provided in this embodiment involves, after the application starts, finding the address of the `NetdClientInitConnect` method in the `NetdClient` library and injecting a custom connection function for implementing destination address replacement logic into the `Bionic` library by calling the `NetdClientInitConnect` method. Subsequently, when the application initiates a network request and calls the original connection function in the `Bionic` library, the custom connection function is replaced to achieve destination address replacement and complete the connection between the application and the local server proxy. This method of acquiring the connection function involves minimal code injection, ensuring application stability and performance. Furthermore, the local server proxy has a built-in digital certificate that enables decryption and encryption of network data. This facilitates the acquisition of more accurate and reliable network data transmitted between the application and the real server within the application itself, while ensuring data transmission security, thus enabling subsequent data analysis and processing.

[0081] Figure 4 This is a structural block diagram of a data acquisition device provided in an embodiment of the present disclosure. The device can be configured in a preset application program, can be implemented by software and / or hardware, and is generally integrated into an electronic device. It can acquire data by executing a data acquisition method. Figure 4 As shown, the device includes:

[0082] Local server agent startup module 401 is used to start the local server agent in a preset application;

[0083] The first connection module 402 is used to obtain the preset connection function when the preset application calls the preset connection function, and replace the destination address in the preset connection function with the target address corresponding to the local server proxy, so as to establish a connection between the preset application and the local server proxy, wherein the target address is pre-written in the preset application;

[0084] The second connection module 403 is used to receive connection information sent by the preset application through the local server proxy, and establish a connection between the local server proxy and the real server corresponding to the target address according to the connection information.

[0085] The data acquisition module 404 is used to forward data between the real server and the preset application through the local server proxy, and to acquire data during the forwarding process.

[0086] The data acquisition device provided in this embodiment does not require external tools and can implement the acquisition mechanism within the application. It uses a local server proxy within the application to forward data between the application and the real server. During the forwarding process, more accurate and readable network data can be obtained, which is convenient for data analysis.

[0087] Optionally, the local server proxy has a built-in preset digital certificate, and the data acquisition module includes:

[0088] The first negotiation unit is used to conduct key negotiation with the preset application based on the preset digital certificate through the local server proxy, and obtain a first negotiation result;

[0089] The second negotiation unit is used to conduct key negotiation with the real server based on the preset digital certificate through the local server proxy to obtain a second negotiation result.

[0090] The first data acquisition unit is configured to receive first data sent by the preset application through the local server proxy, decrypt the first data according to the first negotiation result to obtain second data, encrypt the first data according to the second negotiation result to obtain third data, and send the third data to the real server; wherein, the second data is data acquired during the forwarding process.

[0091] Optionally, the data acquisition module further includes:

[0092] The second data acquisition unit is configured to receive the fourth data sent by the real server through the local server proxy, decrypt the fourth data according to the second negotiation result to obtain the fifth data, encrypt the fifth data according to the first negotiation result to obtain the sixth data, and send the sixth data to the real server; wherein, the fifth data is the data acquired during the forwarding process.

[0093] Optionally, the device may also include:

[0094] A loading module is used to load a first core library in a preset application before detecting that the preset application calls a preset connection function. The first core library centrally manages the calls to the preset socket by injecting the proxy connection function in the first core library into a second core library. The second core library contains the preset connection function, which is used to establish a connection with the preset socket.

[0095] The injection module is used to inject a custom connection function into the second core library based on the preset injection method corresponding to the proxy connection function;

[0096] The step of detecting when the preset application calls the preset connection function, obtaining the preset connection function, and replacing the destination address in the preset connection function with the target address corresponding to the local server proxy includes:

[0097] When the preset application is detected to call the preset connection function through the second core library, it is replaced by calling the custom connection function, so as to replace the destination address in the preset connection function with the target address corresponding to the local server proxy.

[0098] Optionally, the preset injection method includes a method provided by the operating system for injecting the proxy connection function in the first core library into the second core library.

[0099] Optionally, injecting the custom connection function into the second core library based on the preset injection method corresponding to the proxy connection function includes: using a preset dynamic library symbol function to find the address of the preset injection method corresponding to the proxy connection function; and calling the preset injection method according to the address of the preset injection method to inject the custom connection function into the second core library.

[0100] Optionally, the device further includes:

[0101] The system call execution module is used to execute the system call of the preset connection function after replacing it with the custom connection function to replace the destination address in the preset connection function with the target address corresponding to the local server proxy.

[0102] Optionally, the operating system includes the Android operating system, the first core library includes the NetdClient library, the second core library includes the Bionic library, and the preset injection method includes the NetdClientInitConnect method.

[0103] The following is for reference. Figure 5 The diagram illustrates a structural schematic of an electronic device 500 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0104] like Figure 5 As shown, the electronic device 500 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0105] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0106] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0107] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0108] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0109] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: initiate a local server agent within the preset application; upon detecting that the preset application calls a preset connection function, acquire the preset connection function and replace the destination address in the preset connection function with the target address corresponding to the local server agent to establish a connection between the preset application and the local server agent, wherein the target address is pre-written in the preset application; receive connection information sent by the preset application through the local server agent and establish a connection between the local server agent and the real server corresponding to the target address based on the connection information; and forward data between the real server and the preset application through the local server agent, acquiring data during the forwarding process.

[0110] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0112] The modules described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a module does not necessarily limit the module itself; for example, a local server agent startup module can also be described as "a module that starts a local server agent in a preset application".

[0113] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0114] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0115] According to one or more embodiments of this disclosure, a data acquisition method is provided, comprising:

[0116] Start the local server agent in the default application;

[0117] When the preset application calls the preset connection function, the preset connection function is obtained, and the destination address in the preset connection function is replaced with the target address corresponding to the local server proxy to establish a connection between the preset application and the local server proxy. The target address is pre-written in the preset application.

[0118] The local server proxy receives connection information sent by the preset application and establishes a connection between the local server proxy and the real server corresponding to the target address based on the connection information.

[0119] The local server acts as a proxy to forward data between the real server and the preset application, and acquires data during the forwarding process.

[0120] Furthermore, the local server proxy has a built-in preset digital certificate. The process of forwarding data between the real server and the preset application through the local server proxy, and acquiring data during the forwarding process, includes:

[0121] The local server proxy performs key negotiation with the preset application based on the preset digital certificate to obtain a first negotiation result.

[0122] The local server proxy performs key negotiation with the real server based on the preset digital certificate to obtain a second negotiation result;

[0123] The local server proxy receives first data sent by the preset application, decrypts the first data according to the first negotiation result to obtain second data, encrypts the first data according to the second negotiation result to obtain third data, and sends the third data to the real server; wherein, the second data is data obtained during the forwarding process.

[0124] Furthermore, the step of forwarding data between the real server and the preset application through the local server proxy, and acquiring data during the forwarding process, also includes:

[0125] The local server receives the fourth data sent by the real server through the proxy, decrypts the fourth data according to the second negotiation result to obtain the fifth data, encrypts the fifth data according to the first negotiation result to obtain the sixth data, and sends the sixth data to the real server; wherein, the fifth data is the data obtained during the forwarding process.

[0126] Furthermore, before detecting a preset application calling a preset connection function, the following is also included:

[0127] The first core library is loaded in the preset application. The first core library centrally manages the calls to the preset socket by injecting the proxy connection function in the first core library into the second core library. The second core library contains the preset connection function, which is used to establish a connection with the preset socket.

[0128] Based on the preset injection method corresponding to the proxy connection function, the custom connection function is injected into the second core library;

[0129] The step of detecting when the preset application calls the preset connection function, obtaining the preset connection function, and replacing the destination address in the preset connection function with the target address corresponding to the local server proxy includes:

[0130] When the preset application is detected to call the preset connection function through the second core library, it is replaced by calling the custom connection function, so as to replace the destination address in the preset connection function with the target address corresponding to the local server proxy.

[0131] Furthermore, the preset injection method includes a method provided by the operating system for injecting the proxy connection function in the first core library into the second core library;

[0132] The step of injecting a custom connection function into the second core library based on the preset injection method corresponding to the proxy connection function includes:

[0133] The address of the preset injection method corresponding to the proxy link function is found using a preset dynamic library symbol function;

[0134] The preset injection method is invoked according to the address of the preset injection method to inject the custom connection function into the second core library.

[0135] Furthermore, after replacing the default connection with calling the custom connection function to replace the destination address in the preset connection function with the target address corresponding to the local server proxy, the method further includes:

[0136] The system call to execute the preset connection function.

[0137] Furthermore, the operating system includes the Android operating system, the first core library includes the NetdClient library, the second core library includes the Bionic library, and the preset injection method includes the NetdClientInitConnect method.

[0138] According to one or more embodiments of this disclosure, a data acquisition apparatus is provided, comprising:

[0139] The local server agent startup module is used to start the local server agent in a preset application.

[0140] The first connection module is used to obtain the preset connection function when the preset application calls the preset connection function, and replace the destination address in the preset connection function with the target address corresponding to the local server proxy, so as to establish a connection between the preset application and the local server proxy, wherein the target address is pre-written in the preset application;

[0141] The second connection module is used to receive connection information sent by the preset application through the local server proxy, and establish a connection between the local server proxy and the real server corresponding to the target address based on the connection information.

[0142] The data acquisition module is used to forward data between the real server and the preset application through the local server proxy, and to acquire data during the forwarding process.

[0143] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0144] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0145] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A data acquisition method, characterized by, The application comprises the following steps: starting a local server agent in a preset application program; when it is detected that the preset application program calls a preset connection function, acquiring the preset connection function and replacing a destination address in the preset connection function with a target address corresponding to the local server agent to establish a connection between the preset application program and the local server agent, wherein the target address is pre-written in the preset application program; receiving connection information sent by the preset application program through the local server agent and establishing a connection between the local server agent and a real server corresponding to the target address according to the connection information; forwarding data between the real server and the preset application program through the local server agent and acquiring data in the forwarding process; wherein, before detecting that the preset application program calls the preset connection function, the following steps are further included: loading a first core library in the preset application program, wherein the first core library realizes centralized management of the call of a preset socket by injecting an agent connection function in the first core library into a second core library, the second core library containing a preset connection function, and the preset connection function being used to establish a connection with the preset socket; injecting a custom connection function into the second core library based on a preset injection method corresponding to the agent connection function; wherein, when it is detected that the preset application program calls the preset connection function, the preset connection function is acquired and the destination address in the preset connection function is replaced with the target address corresponding to the local server agent, which comprises the following steps: when it is detected that the preset application program calls the preset connection function through the second core library, the custom connection function is replaced to replace the destination address in the preset connection function with the target address corresponding to the local server agent.

2. The method of claim 1, wherein, The local server agent is built-in with a preset digital certificate, and the forwarding of data between the real server and the preset application program through the local server agent and the acquisition of data in the forwarding process comprise the following steps: performing key agreement between the preset application program and the local server agent based on the preset digital certificate through the local server agent to obtain a first negotiation result; performing key agreement between the real server and the local server agent based on the preset digital certificate through the local server agent to obtain a second negotiation result; receiving first data sent by the preset application program through the local server agent and decrypting the first data according to the first negotiation result to obtain second data, encrypting the second data according to the second negotiation result to obtain third data, and sending the third data to the real server; wherein, the second data is the data acquired in the forwarding process.

3. The method of claim 2, wherein, The forwarding of data between the real server and the preset application program through the local server agent and the acquisition of data in the forwarding process further comprise the following steps: receive fourth data sent by the real server through the local server agent, decrypt the fourth data according to the second negotiation result to obtain fifth data, encrypt the fifth data according to the first negotiation result to obtain sixth data, and send the sixth data to the real server; The fifth data is data obtained in the forwarding process.

4. The method of claim 1, wherein, The preset injection method includes a method provided by an operating system for injecting the proxy connection function into the second core library. The method comprises the following steps: The address of the preset injection method corresponding to the proxy connection function is found by using a preset dynamic library symbol function; The preset injection method is called according to the address of the preset injection method, so as to inject the custom connection function into the second core library.

5. The method of claim 1, wherein, After the destination address in the preset connection function is replaced by the target address corresponding to the local server agent to call the custom connection function, the system call of the preset connection function is executed. The operating system includes an Android operating system, the first core library includes a NetdClient library, the second core library includes a Bionic library, and the preset injection method includes a NetdClientInitConnect method.

6. The method of claim 1, wherein, The method comprises the following steps:

7. A data acquisition device, characterized by The local server agent starts a module for starting a local server agent in a preset application program; When it is detected that the preset application program calls a preset connection function, the preset connection function is obtained, and a destination address in the preset connection function is replaced by a target address corresponding to the local server agent to establish a connection between the preset application program and the local server agent, wherein the target address is pre-written in the preset application program; A second connection module is configured to receive connection information sent by the preset application program through the local server agent, and establish a connection between the local server agent and a real server corresponding to the target address according to the connection information; A data acquisition module is configured to forward data between the real server and the preset application program through the local server agent, and obtain data in the forwarding process; A loading module is configured to load a first core library in a preset application program before it is detected that the preset application program calls a preset connection function, wherein the first core library realizes centralized management of the calling of a preset socket by injecting a proxy connection function in the first core library into a second core library, the second core library includes a preset connection function, and the preset connection function is used to establish a connection with the preset socket. An injection module is configured to inject a custom connection function into the second core library based on a preset injection method corresponding to the proxy connection function. ​ The detecting the preset application program from calling the preset connection function, acquiring the preset connection function, and replacing a destination address in the preset connection function with a target address corresponding to the local server agent, comprises: detecting the preset application program from calling the preset connection function through the second core library, and replacing the preset connection function with the custom connection function to replace the destination address in the preset connection function with the target address corresponding to the local server agent.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method of any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1-6.

Images