Application starting method and device, equipment and storage medium

Abstract

The application provides an application starting method and device, equipment and storage medium. The method comprises the following steps: before creating a process in an application, writing a custom calling path of a custom loader into an environment variable of the process, and intercepting an original dynamic library loader by closing a preset loading switch; the custom loader is a self-implemented library file loader; in the process of starting the application by creating the process, reading the custom calling path and a preset custom loading strategy from the environment variable; calling the custom loader through the custom calling path, shielding or loading a to-be-loaded dynamic library corresponding to the process according to the preset custom loading strategy, and completing the starting of the application. Through the application, the security of the application can be improved.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to an application startup method, apparatus, device, and storage medium. Background Technology

[0002] Currently, for user devices with advanced privileges (such as root privileges), third-party malware can be injected into the device's operating system in the form of dynamic libraries, posing security risks to various applications such as communication, login, and mobile payment, causing unpredictable financial losses or privacy leaks to users, thereby reducing the security of application use. Summary of the Invention

[0003] This application provides an application startup method, apparatus, device, and storage medium that can improve the security of application use.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides an application launch method, including:

[0006] Before creating a process in the application, a custom call path for a custom loader is written into the environment variables of the process, and the original dynamic library loader is intercepted by turning off the preset loading switch.

[0007] During the process of launching the application by creating a process, the custom call path and the preset custom loading strategy are read from the environment variables;

[0008] The custom loader is invoked through the custom call path, and the dynamic library to be loaded corresponding to the process is blocked or loaded according to the preset custom loading strategy, thereby completing the startup of the application.

[0009] This application provides an application launching device, including:

[0010] The interception module is used to write the custom call path of the custom loader into the environment variables of the process before the process is created in the application, and to intercept the original dynamic library loader by turning off the preset loading switch.

[0011] The reading module is used to read the custom call path and the preset custom loading strategy from the environment variables during the process of starting the application by creating a process;

[0012] The startup module is used to call the custom loader through the custom call path, and according to the preset custom loading strategy, to block or load the dynamic library to be loaded corresponding to the process, thereby completing the startup of the application.

[0013] In the above device, the preset custom loading strategy includes: a strategy type corresponding to each process in at least one process, and a preset loading rule corresponding to each strategy type; the strategy type corresponding to each process belongs to at least one preset strategy type; the startup module is further configured to read the target strategy type corresponding to the process from the preset custom loading strategy through the custom loading program; and to block or load the dynamic library to be loaded corresponding to the process according to the target loading rule corresponding to the target strategy type.

[0014] In the above-described device, the preset loading rule includes: a protection type and a dynamic library candidate list. The startup module is further configured to: block the dynamic library to be loaded corresponding to the process when the protection type in the target loading rule is a preset first type; load the dynamic library to be loaded included in the dynamic library candidate list when the protection type in the target loading rule is a preset second type; and block the dynamic library to be loaded included in the dynamic library candidate list when the protection type in the target loading rule is a preset third type.

[0015] In the above-described device, the startup module is further configured to load the dynamic libraries to be loaded from the dynamic library candidate list by means of custom loading logic in the custom loader; the custom loading logic is obtained by copying the functions in the original library file loader.

[0016] In the above-mentioned device, the preset loading rule further includes: interface configuration rule, and the application launch device further includes: display module; the display module is used to display a preset anti-hook protection animation on the preset application interface when the interface configuration rule indicates that the animation effect is to be displayed, during the loading or blocking of the dynamic library to be loaded; and not to provide interface prompts when the interface configuration rule indicates that the animation effect is not to be displayed.

[0017] In the above device, the preset grid of the preset loading rule includes at least one field connected by a preset connection character, the at least one field including: a field representing the protection type and a field representing the dynamic library candidate list; or, a field representing the protection type, a field representing the dynamic library candidate list, and a field representing the interface configuration rule.

[0018] In the above-described device, the application launch device further includes an update module, which is used to update the preset loading rule by updating any field among the at least one field.

[0019] In the above device, the preset custom loading strategy is stored in a preset configuration file. The startup module is also used to read the file path of the preset configuration file from the environment variables; and obtain the preset custom loading strategy from the preset configuration file through the file path.

[0020] In the above-described device, the update module is further configured to update the preset custom loading strategy by updating the correspondence between the update process and the strategy type in the preset configuration file.

[0021] In the aforementioned device, the application startup device further includes: a setting module, which is used to set the state of the preset protection switch by receiving a switch operation for the preset protection switch in the preset interface of the application; the startup module is also used to determine whether the preset protection switch corresponding to the application is in an on state when a startup instruction for the application is received, before writing the custom call path of the custom loader into the environment variables of the process; and when the preset protection switch is in a off state, to call the original library file loader to load the dynamic library to be loaded corresponding to the process in the application, thereby completing the startup of the application.

[0022] In the above-mentioned device, the application launch device further includes a recording module, which is used to record the blocked dynamic library information and send it to the backend server so that the backend server can collect information and perform data analysis based on the blocked dynamic library information.

[0023] In the above-described device, the startup module is further configured to, after calling the custom loader through the custom call path, read at least one dynamic library file that the process depends on from the process's program header information through the custom loader, as the dynamic library to be loaded.

[0024] This application provides an electronic device, including:

[0025] Memory, used to store executable instructions;

[0026] The processor, when executing executable instructions stored in the memory, implements the application startup method provided in the embodiments of this application.

[0027] This application provides a computer-readable storage medium storing executable instructions for inducing a processor to execute and implement the application startup method provided in this application.

[0028] This application provides a computer program product, including a computer program or instructions, characterized in that, when the computer program or instructions are executed by a processor, they implement the application startup method provided in this application.

[0029] The embodiments of this application have the following beneficial effects:

[0030] Before creating processes within the application, by writing a custom call path to the environment variables and disabling the preset loading switch, the original dynamic library loader is intercepted, blocking the intrusion path of malicious programs injecting into the application through the original dynamic library loader. Furthermore, during process creation, the dynamic libraries to be loaded for each process can be blocked or loaded according to the preset custom loading strategy. This allows for flexible customization of the preset loading strategy, extending the security mechanism of the loader, thereby improving the security of dynamic library loading, effectively blocking the intrusion of malicious dynamic libraries, and thus improving the security of application use. Attached Figure Description

[0031] Figure 1 This is an optional process diagram illustrating the dynamic library loading process of the related technologies provided in this application embodiment;

[0032] Figure 2 This is an optional structural diagram of the application launching device provided in the embodiments of this application;

[0033] Figure 3 This is an optional flowchart illustrating the application startup method provided in this application embodiment;

[0034] Figure 4 This is an optional flowchart illustrating the application startup method provided in this application embodiment;

[0035] Figure 5 This is a schematic diagram illustrating the relationship between the policy types corresponding to each process provided in the embodiments of this application;

[0036] Figure 6 This is an optional flowchart illustrating the application startup method provided in this application embodiment;

[0037] Figure 7 This is a schematic diagram illustrating the effect of opening a preset protection switch according to an embodiment of this application;

[0038] Figure 8 This is an optional flowchart illustrating the application startup method provided in this application embodiment;

[0039] Figure 9 This is an optional flowchart illustrating the MobileSubstrate loading process provided in an embodiment of this application;

[0040] Figure 10 This is an optional schematic diagram of the directory structure of the dynamic library to be loaded provided in an embodiment of this application;

[0041] Figure 11 This is an optional schematic diagram of the dynamic library file directory structure provided in the embodiments of this application;

[0042] Figure 12 This is an optional flowchart illustrating the application startup method provided in this application embodiment;

[0043] Figure 13 This is an optional schematic diagram of the masked dynamic library information provided in an embodiment of this application;

[0044] Figure 14 This is an optional flowchart illustrating the application launch method provided in this application embodiment applied to a real-world scenario. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0047] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0048] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0050] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0051] 1) Dynamic Library: Also known as a dynamic link library, it is a set of source code modules. Each module contains some functions that can be called by applications or other dynamic link libraries. When an application calls a function in a dynamic link library, the operating system maps the file image of the dynamic link library into the address space of the process, that is, loads the dynamic library so that all threads in the process can call the functions in the dynamic link library.

[0052] 2) Mobile Substrate: Also known as Cydia Substrate, it is a framework developed by Saurik. Third-party developers can call its API to patch the iOS system and change the behavior of the system or applications.

[0053] 3) SubstrateLoader.dylib: Part of MobileSubstrate, mainly responsible for loading the corresponding dynamic libraries under the / MobileSubstrate / directory.

[0054] 4) SpringBoard: This is the basic program in iOS responsible for managing the home screen, starting the WindowServer, launching applications, and configuring the device when the device starts.

[0055] 5) Launchd: As the first user-space process launched by the iOS system kernel, Launchd is responsible for launching other daemons and agents in the system. Launchd can be used to create every application process in the iOS system.

[0056] 6) Anti-hook: refers to preventing the injection of malicious third-party programs (dynamic libraries).

[0057] Currently, application launches are typically achieved by running processes within the application, and the execution of these processes depends on loading functions or methods from dynamic libraries. Taking iOS operating systems with advanced root privileges as an example, this is usually done using tools like MobileSubstrate, through methods such as... Figure 1The loading process shown intercepts the application startup process of the operating system and replaces it with the dynamic library loading method in MobileSubstrate to load the dynamic libraries that the application depends on, as follows:

[0058] After the operating system boots up, the MSHOOKProcess(pid,library) method is injected into the Launchd configuration file / etc / launchd.conf using the Cynject injection tool. Here, pid is set to the PID of the Launchd application creation process, and library is the calling path of the SubstrateLauncher.dylib dynamic library launcher in MobileSubstrate: bsexec.. / usr / bin / cynject1 / Library / Frameworks / .. / SubstrateLauncher.dylib. This injects the dynamic library launcher into the Launchd configuration file.

[0059] Then, the operating system starts the application creation process Launchd. Launchd begins the application process creation process from the parent process (pid=1). During its execution, Launchd calls the injected dynamic library launcher SubstrateLauncher.dylib based on its configuration file. The process creation function posix_spawn in SubstrateLauncher.dylib is intercepted using an MSHOOK method. Specifically, the environment variable DYLD INSERTLIBRARIES of the current process is modified to the path of the dynamic library loader in MobileSubstrate: / Library / MobileSubstrate / SubstrateLoader.dylib. Thus, when the process creation function posix_spawn creates processes within the application, it can call methods in the dynamic library loader SubstrateLoader.dylib to load the corresponding dynamic libraries for each process.

[0060] based on Figure 1 As can be seen, malicious programs can be carried out in the form of dynamic libraries and exploit... Figure 1 The loading process of MobileSubstrate's dynamic libraries is injected into the application's startup process, thereby reducing the security of application use.

[0061] This application provides an application launch method, apparatus, device, and storage medium, which can improve the security of application use. The following describes exemplary applications of the electronic devices provided in this application. These electronic devices can be implemented as smartphones, smartwatches, laptops, tablets, desktop computers, set-top boxes, mobile devices (e.g., mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), smart voice interaction devices, smart home appliances, and in-vehicle terminals, and can also be implemented as servers.

[0062] In some embodiments, the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, smart voice interaction device, smart home appliance, or in-vehicle terminal, but is not limited to these.

[0063] The following will describe an exemplary application of an electronic device as a terminal.

[0064] See Figure 2 , Figure 2 This is a schematic diagram of the structure of the terminal 400 provided in the embodiment of this application. Figure 2 The terminal 400 shown includes at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in the terminal 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to implement communication between these components. In addition to a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 440.

[0065] The processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0066] User interface 430 includes one or more output devices 431 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0067] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices physically located away from the processor 410.

[0068] The memory 450 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 450 described in this application embodiment is intended to include any suitable type of memory.

[0069] In some embodiments, memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0070] Operating system 451 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0071] The network communication module 452 is used to reach other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 including: Bluetooth, Wi-Fi, and Universal Serial Bus (USB), etc.

[0072] Presentation module 453 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 431 (e.g., a display screen, a speaker, etc.) associated with user interface 430;

[0073] The input processing module 454 is used to detect and translate one or more user inputs or interactions from one or more input devices 432.

[0074] In some embodiments, the apparatus provided in this application can be implemented in software. Figure 2 An application launch device 455 stored in memory 450 is shown. It can be software in the form of programs and plug-ins, including the following software modules: intercept module 4551, reading module 4552 and launch module 4553. These modules are logical and can therefore be arbitrarily combined or further split according to the functions they implement.

[0075] The functions of each module will be explained below.

[0076] In other embodiments, the apparatus provided in this application can be implemented in hardware. For example, the apparatus provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the application startup method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0077] In some embodiments, the terminal or server can implement the application launch method provided in this application embodiment by running a computer program. For example, the computer program can be a native program or software module in the operating system; it can be a native application (APP), that is, a program that needs to be installed in the operating system to run, such as a social application APP or a shopping APP; it can also be a mini-program, that is, a program that only needs to be downloaded into the browser environment to run; or it can be a mini-program or web client program that can be embedded in any APP. In short, the above-mentioned computer program can be any form of application, module or plugin.

[0078] The application launch method provided in this application embodiment will be described in conjunction with exemplary applications and implementations of the electronic device provided in the embodiments of this application.

[0079] See Figure 3 , Figure 3 This is an optional flowchart illustrating the application launch method provided in this application embodiment, which will be combined with... Figure 3 The steps shown are explained.

[0080] S101. Before creating a process in the application, write the custom call path of the custom loader into the process's environment variables, and intercept the original dynamic library loader by turning off the preset loading switch.

[0081] The application launch method provided in this application embodiment can be applied to scenarios of launching and running applications or services on electronic devices. For example, it can be applied to application launch scenarios on iOS systems that have obtained the highest level of permissions. The specific method can be selected according to the actual situation, and this application embodiment does not limit it.

[0082] In this embodiment, the electronic device can initiate an application launch process based on an application launch command. For example, upon receiving a launch operation for an application entry on the system desktop, such as clicking a desktop application icon, the electronic device determines that it has received an application launch command and begins to execute the launch process of the application specified by the application launch command.

[0083] In some embodiments, electronic devices can utilize the SpringBoard method in the iOS system to deliver UI events occurring in the operating interface to the application. In this way, when a UI event indicates the launch of the application, the operating system can be driven to respond to the application launch event and execute the relevant methods for launching the application.

[0084] In this embodiment, the electronic device can launch an application by creating a process. At least one process within the application supports its normal operation and performs its corresponding functions. Therefore, the application can be launched by creating and launching at least one process within it.

[0085] In this embodiment, process creation relies on methods and parameters set in environment variables. Before creating a process within an application, the electronic device can write a custom call path for the custom loader into the process's environment variables. This allows the custom loader to run by calling methods in the environment variables during process creation. Here, the custom loader differs from the original dynamic library loader; it can be a self-implemented dynamic library loader, i.e., a program that uses its own methods to load dynamic libraries. In some embodiments, the custom loader can be a self-implemented program that extends or modifies the original dynamic library loader using its own methods to implement custom dynamic library loading functionality, or it can be a program entirely based on its own methods. The choice depends on the specific circumstances, and this embodiment does not impose any limitations.

[0086] For example, the original dynamic library loader can be the dynamic library loader SubstrateLoader.dylib in MobileSubstrate mentioned above.

[0087] In some embodiments, the custom loader can be a dynamic library file, i.e., a custom dynamic library loader; the environment variable can be the DYLD INSERT LIBRARIES environment variable that exists when the process starts in the iOS system. By writing the full path of the dynamic library into DYLD INSERT LIBRARIES, the corresponding dynamic library can be inserted when the process is created. Figure 1 Electronic devices can write a custom call path for loading dynamic libraries into the environment variable DYLD INSERT LIBRARIES before Launchd creates the process.

[0088] In some embodiments, taking iOS 6 and above as an example, for applications launched from the system desktop, environment variables can be modified by hooking the Springboard method SBApplication:launchSettings in the code implementation. For other types of operating systems, the appropriate method can be used to write the environment variables according to the operating system's own setting and calling methods. The specific method is selected according to the actual situation, and this application embodiment does not limit it.

[0089] In this embodiment, the electronic device can intercept the original dynamic library loader by setting a secure loading mode, thereby preventing the call path of the original dynamic library loader from being written into the environment variables.

[0090] In some embodiments, the original dynamic library loader is provided with a preset loading switch. The preset loading switch is used to add a call to the original dynamic library loader to the environment variable when the original dynamic library loader is enabled, thereby executing the method in the original dynamic library loader to load the dynamic library; and to prevent the call path of the original dynamic library loader from being written to the environment variable when the original dynamic library loader is disabled.

[0091] For example, the default loading switch could be the MobileSubstrate safety mode switch _MSSafe Mode. When _MSSafeMode is 0, normal mode is enabled (on). In normal mode, the dynamic library launcher SubstrateLauncher.dylib in MobileSubstrate adds the call path of the original dynamic library loader to the environment variable DYLD INSERT LIBRARIES, such as the call path of SubstrateLoader.dylib: / Library / MobileSubstrate / SubstrateLoader.dylib. When _MSSafeMode is 1, safety mode is enabled (off), and the call path of the original dynamic library loader is not added to the environment variable. For the MobileSubstrate loading process, this is equivalent to not loading the dynamic library.

[0092] It is understandable that, based on the function of the aforementioned preset loading switch, when the preset loading switch is in the off state and the call path of the dynamic library loader is not written in the environment variables, the electronic device will not load the dynamic library; however, as in the embodiment of this application, when the preset loading switch is in the off state and the custom call path of the custom loader is written in the environment variables, the original dynamic library loader can be replaced with the custom loader, and the custom loader can be called through the environment variables.

[0093] For example, when the default loading switch is the _MSSafeMode switch, the code implementation for controlling whether to enter the MobileSubstrate loading process via the _MSSafeMode switch can be as follows:

[0094]

[0095] Based on the code example above, the code implementation for S101 can be as follows:

[0096] NSMutableDictionary*newDict=[NSMutableDictionary dictionarywithDictionary:dict];

[0097] [newDict setObject:@"1"forKey:SafeMode_]; / / Set SafeMode_ to 1, which disables the preset loading switch.

[0098] [newDict setObject:ProtectLibrary_forKey:DYLDVariable_]; / / Set the custom call path ProtectLibrary_ to the environment variable DYLDVariable_.

[0099] S102. During the process of starting the application by creating a process, read the custom call path and the preset custom loading strategy from the environment variables.

[0100] In this embodiment, the electronic device also maintains a preset custom loading strategy in its environment variables. Thus, during the process of launching an application by creating a process, the electronic device can use the process's environment variables to pass parameters, read the preset custom loading strategy from the environment variables, and access the aforementioned custom call path.

[0101] Here, the preset custom loading strategy includes: the dynamic library loading strategy corresponding to at least one process in at least one application on the current device. The preset custom loading strategy is used to configure the loading rules for dynamic libraries. In other words, the electronic device can uniformly maintain the loading rules for dynamic libraries configured for various installed applications within the preset custom loading strategy. In some embodiments, the preset custom loading strategy can be stored in a preset configuration file. The electronic device can pre-write the file path of the preset configuration file into the environment variables by distributing the preset configuration file. Thus, during the process of starting an application by creating a process, the electronic device can read the file path of the preset configuration file from the environment variables and obtain the preset custom loading strategy from the preset configuration file through the file path.

[0102] For example, the preset custom loading strategy may include a dynamic library candidate list (for example, a blacklist or whitelist), protection type (used to configure the operation method for dynamic libraries in the dynamic library candidate list), interface configuration information (such as an anti-hook protection animation that can be displayed on the UI interface of the electronic device), etc. The specific selection is made according to the actual situation, and this application embodiment does not limit it.

[0103] In some embodiments, taking the iOS system as an example, the generation and maintenance of a preset custom loading strategy can be implemented in the Springboard code, and when Launchd creates a process, the preset custom loading strategy can be used as a parameter to execute the custom loader, and the parameter can be passed through environment variables, as follows:

[0104]

[0105]

[0106] S103. Call the custom loader through the custom call path, and according to the preset custom loading strategy, block or load the dynamic library to be loaded for the process to complete the startup of the application.

[0107] In this embodiment of the application, when an electronic device creates each process in an application, it can call a custom loader through a custom call path. The custom loader obtains the dynamic library to be loaded for each process and, according to a preset custom loading strategy, masks or loads at least one dynamic library file in the dynamic library to be loaded for each process, thereby realizing the creation and startup of the process in the application and thus completing the startup of the application.

[0108] In some embodiments, a custom loader can read at least one dynamic library file that the process depends on for running from the program header information of each process, and use it as the dynamic library to be loaded for that process.

[0109] In some embodiments, for each dynamic library file among at least one dynamic library file, the electronic device uses a custom loader to match loading rules for each dynamic library file within a preset custom loading strategy. If the matching result indicates that loading is prohibited, the electronic device blocks the dynamic library file and does not load it into the process. If the matching result indicates that loading is permitted, the electronic device loads the dynamic library file into the process and performs rule matching, loading, or blocking on the next dynamic library file until at least one dynamic library file has been traversed, completing the library file loading for a process. The electronic device loads library files in the same way when creating each process, thereby completing the application startup.

[0110] Understandably, by writing a custom call path to the environment variables and disabling the preset loading switch before creating processes in the application, the call path of the original dynamic library loader is prevented from being written to the environment variables. This intercepts the original dynamic library loader, blocking malicious programs from injecting into the application through it. Furthermore, during process creation, the dynamic libraries to be loaded for each process can be blocked or loaded according to the preset custom loading strategy. This allows for flexible expansion of the loader's security mechanism through customization of the preset loading strategy, thereby improving the security of dynamic library loading, effectively blocking the intrusion of malicious dynamic libraries, and ultimately enhancing the security of application use.

[0111] In some embodiments, the preset custom loading strategy includes: a strategy type corresponding to each process in at least one process, and preset loading rules corresponding to each strategy type; the strategy type corresponding to each process belongs to at least one preset strategy type; based on Figure 3 ,like Figure 4As shown, S103 can be implemented through S1031-S1032, which will be explained in conjunction with each step.

[0112] S1031. Read the target policy type corresponding to each process from the preset custom loading policy through a custom loader.

[0113] In this embodiment of the application, for at least one application on an electronic device, the preset custom loading strategy may include the dynamic library loading strategy type corresponding to each process in each application. When creating each process in the application, the electronic device can call a custom loader through a custom call path, and through the custom loader, read the target strategy type corresponding to the current process from the preset custom loading strategy based on the process identifier of the current process.

[0114] In some embodiments, the process identifier can be either the process PID or the process name, depending on the actual situation. This application does not limit the choice.

[0115] For example, the policy type corresponding to each process in the preset custom loading strategy can be as follows: Figure 5 As shown, each process in each application on an electronic device can be associated with a policy type pre-configured for that process by its process name. Figure 5 The text shows two preset strategy types, 0 and 1. The preset loading rules for each strategy type will be explained below.

[0116] S1032. According to the target loading rules corresponding to the target strategy type, the dynamic library to be loaded for each process is either blocked or loaded.

[0117] In this embodiment, the electronic device uses the preset loading rule corresponding to the target policy type as the target loading rule, and blocks or loads the dynamic library to be loaded for each process according to the dynamic library loading permission information contained in the target loading rule.

[0118] In some embodiments, the target loading rule may include a dynamic library blacklist and a dynamic library whitelist. For example, the dynamic library blacklist may contain known malicious programs, and the dynamic library whitelist may contain non-third-party dynamic libraries, etc. The electronic device can use the target loading rule to filter the dynamic libraries to be loaded for each process and determine whether to load or block them.

[0119] In some embodiments, the preset loading rules include: protection type and a list of candidate dynamic libraries. Figure 4 ,like Figure 6 As shown, S1032 can be implemented by any one of S201-S203, as follows:

[0120] S201. When the protection type is the preset first type, the dynamic library to be loaded corresponding to the process is blocked.

[0121] In this embodiment, when the protection type in the target loading rule is a preset first type, the electronic device blocks all dynamic libraries to be loaded corresponding to the process and does not load the hook. In some embodiments, the preset first type can be represented by 0 or other values, depending on the actual situation, and this embodiment does not limit the choice.

[0122] S202. When the protection type is the preset second type, load the dynamic libraries to be loaded that are included in the dynamic library candidate list.

[0123] In this embodiment, when the protection type in the target loading rule is a preset second type, the electronic device traverses the dynamic libraries to be loaded corresponding to the current process and loads only the dynamic libraries included in the dynamic library candidate list. In some embodiments, the preset second type can be represented by 1, or other values, depending on the actual situation, and this embodiment does not limit the specific choice.

[0124] In some embodiments, multiple processes within at least one process may correspond to the same policy type, such as... Figure 5 As shown, multiple processes are configured with strategies using two preset strategy types, 0 and 1. Therefore, for the preset loading rule corresponding to a strategy type, the dynamic library names included in its dynamic library candidate list can be pre-configured based on the dynamic libraries that multiple processes may correspond to, meaning it may include dynamic library names corresponding to processes other than the current process. In S202, the electronic device iterates through the dynamic libraries to be loaded corresponding to the current process. For each dynamic library file in the list, it determines whether it is included in the dynamic library candidate list based on the file's name. If included, the dynamic library file is loaded.

[0125] In some embodiments, the preset loading rule can be implemented in a preset format, wherein the preset format may include at least one field connected by preset characters. For example, the at least one field may include a field representing the protection type and a field representing a list of dynamic library candidates, as shown below:

[0126] protectType&dylibs(dylib1;dylib2;…dylibN)

[0127] Here, dylibs(dylib11; dylib2; ... dylibN) corresponds to the field representing the dynamic library candidate list, (dylib11; dylib2; ... dylibN) is a dynamic library candidate list containing N dynamic library names, where N is a positive integer greater than or equal to 1; protectType corresponds to the field representing the protection type, including: the first default type, which represents blocking all hooks (i.e., dynamic libraries), the second default type, which represents loading only the hooks in the dynamic library candidate list dylibs set, and the third default type, which represents blocking only the hooks in the dynamic library candidate list dylibs set.

[0128] In some embodiments, when the protection type is a preset second type, the electronic device can load the dynamic libraries to be loaded from the dynamic library candidate list through custom loading logic in the custom loader; the custom loading logic is obtained by copying the functions in the original library file loader.

[0129] In this embodiment of the application, when the protection type is the preset second type, the electronic device will use the dynamic libraries to be loaded included in the dynamic library candidate list as legal dynamic libraries that can be allowed, and use the same loading logic as the original library file loader to load the legal dynamic libraries in order to maintain the consistency of the system process.

[0130] For example, the original library file loader can be the SubstrateLoader.dylib loading module in MobileSubstrate. By copying the CoreFoundation library in SubstrateLoader.dylib, a custom loading logic can be obtained, which can make the custom loading logic lightweight, improve its loading speed, and avoid affecting the process startup speed.

[0131] S203. When the protection type is the preset third type, the dynamic libraries to be loaded included in the dynamic library candidate list are blocked.

[0132] In this embodiment, when the protection type in the target loading rule is a preset third type, the electronic device traverses the dynamic libraries to be loaded corresponding to the current process, blocks the dynamic libraries to be loaded that are included in the dynamic library candidate list, and loads the dynamic libraries not included in the dynamic library candidate list. In some embodiments, the preset third type can be represented by 2, or it can be other values, and the specific selection depends on the actual situation. This embodiment does not limit the choice.

[0133] In S203, the electronic device traverses the dynamic libraries to be loaded corresponding to the current process. For each dynamic library file in the dynamic library to be loaded, it determines whether it is included in the dynamic library candidate list based on the name of the dynamic library file. If it is included, the dynamic library file is masked.

[0134] In some embodiments, the preset loading rules may further include at least one of process business type and interface configuration rules. The process business type can be used to characterize the type of business that the process needs to handle, and the interface configuration rules can be used to characterize whether to display the anti-hook protection animation on the UI interface. When the interface configuration rules characterize displaying the animation effect, the electronic device can display the preset anti-hook protection animation on the preset application interface corresponding to the process during the loading or blocking of the dynamic library to be loaded. When the interface configuration rules characterize not displaying the animation effect, the electronic device will not provide any interface prompts during the loading or blocking of the dynamic library to be loaded. Thus, by expanding the content of the loading rules, the loading rules can be configured from different dimensions, making the security protection of the library file loading process more flexible and comprehensive, and also improving the richness of the interface display.

[0135] In some embodiments, the preset format of the preset loading rule may further include at least one field connected by preset characters, which may also include: a field representing the protection type, a field representing the dynamic library candidate list, and a field representing the interface configuration rule. For example, the preset format may also be as follows:

[0136] softType&showAnimate&protectType&dylibs(dylib;dylib;dylib)

[0137] Wherein, `softType` represents the process business type, which may include: login class (which can be represented as 0) and payment class (which can be represented as 1), etc.; `showAnimate` corresponds to the field representing the interface configuration rule, which may include: not displaying the anti-hook protection animation (which can be represented as 0), and displaying the anti-hook protection animation (which can be represented as 1). Based on the above preset format, the target loading rule can be exemplarily shown in Table 1, as follows:

[0138] 0 0&1&1&dylib1;dylib4;dylib6;dylib7 1 1&1&1&dylib1;dylib5;

[0139] Table 1

[0140] Combined with Table 1 Figure 5 ,by Figure 5Taking the process cn.xxx.yyy.zzz as an example, the target policy type corresponding to this process is 0, which corresponds to the target loading rule 0&1&1&dylib1;dylib4;dylib6;dylib7 in Table 1. Based on this target loading rule, it can be known that the business type of this process is login type (softType=0). When the electronic device loads the dynamic library to be loaded corresponding to the process cn.xxx.yyy.zzz, it needs to display the anti-hook protection animation (showAnimate=1) and load any one or more dynamic libraries contained in dylib1;dylib4;dylib6;dylib7 of the dynamic library to be loaded corresponding to cn.xxx.yyy.zzz (protectType=1).

[0141] In some embodiments, based on Figure 5 The preset custom loading strategy in the shown preset configuration file can be updated by updating the mapping between processes and strategy types in the preset configuration file. For example, the electronic device can add a new mapping between processes and strategy types, or modify an existing mapping between processes and strategy types, to update the preset custom loading strategy.

[0142] In some embodiments, based on preset loading rules in a preset format as shown in Table 1, the electronic device can update the preset loading rules by updating any field in at least one of the fields. For example, the electronic device can update the preset loading rules by receiving updated fields from external input, such as an updated dynamic library candidate list input by a user, and updating the corresponding fields in at least one of the fields according to the updated fields.

[0143] Understandably, by maintaining a unified policy type for each process through preset custom loading strategies, and then mapping the policy type to preset loading rules, the configuration of processes and dynamic library loading rules can be decoupled. This achieves unified maintenance of policy information for multiple processes, facilitating subsequent updates and modifications. Furthermore, it allows for individual modification of the preset loading rules corresponding to policy types, making the new loading rules effective for processes configured with the corresponding policy type. This eliminates the need to configure policy information for each process, improving the efficiency and maintainability of policy configuration. Moreover, by extending the loading rules, configuration can be performed from different dimensions, making security protection during library file loading more flexible and comprehensive, and also enhancing the richness of the interface display.

[0144] In some embodiments, the electronic device can control whether to execute the application launch method provided in this application via an interface switch, as shown in S001-S002, as follows:

[0145] S001. In the application's preset interface, by receiving the switching operation for the preset protection switch, the state of the preset protection switch is set.

[0146] In this embodiment, for each application installed on the electronic device, a preset protection switch can be displayed on the application's preset interface. It should be noted that the content displayed on the preset interface, the control display format of the preset protection switch, and the entry settings can be the same or different for different applications. The specific selection depends on the actual situation, and this embodiment does not impose any limitations.

[0147] For example, such as Figure 7 As shown, the preset protection switch can be displayed in the application's settings interface. Users can access the settings interface, click on the preset protection switch, and initiate a switching operation on the preset protection switch. Upon receiving the switching operation on the preset protection switch, the electronic device will adjust the state of the preset protection switch accordingly.

[0148] In this embodiment, when the preset protection switch is turned on, the application launch method described in the above embodiment is implemented for the application when it is launched. In some embodiments, when the preset protection switch is turned on, the electronic device can display corresponding protection prompts on the application interface to remind the user of the application's security status. For example, as shown... Figure 7 As shown, when the user has already enabled the preset protection switch corresponding to application A, the user can click the application A icon on the desktop of the electronic device to launch application A through the application launch method in this embodiment of the application. The dynamic library to be loaded corresponding to the process in application A is loaded securely, malicious or redundant hooks are blocked, and a protection prompt is displayed on the main interface of application A, such as the system status position at the top of the main interface.

[0149] based on Figure 3 With S001, such as Figure 8 As shown, before S101, the following can also be executed:

[0150] S002. Upon receiving a startup command for an application, determine whether the preset protection switch corresponding to the application is in the on state.

[0151] In this embodiment of the application, when the electronic device receives a startup command for an application, it first determines whether the preset protection switch corresponding to the application is in the on state.

[0152] When the preset protection switch is in the on state, the application startup method of this application embodiment is executed, such as the method in S101-S103.

[0153] S003. When the preset protection switch is in the off state, the original library file loader is called to load the dynamic library to be loaded corresponding to the process in the application, and the application is started.

[0154] In this embodiment, when the preset protection switch is in the off state, the electronic device loads the dynamic library through the original library file loading program to start the application.

[0155] In some embodiments, the original library file loader can be the SubstrateLoader.dylib loading module in MobileSubstrate, and its loading process is as follows: Figure 9 As shown below:

[0156] The electronic device iterates through each dynamic library file in the dynamic libraries to be loaded corresponding to the current process. For each dynamic library file, it checks whether a corresponding property list file (plist) exists. For example, the corresponding property list file can be a property list file with the same name as the dynamic library file, such as... Figure 10 As shown. Figure 10 This shows the dynamic library file (.dylib) and the attribute list file (.plist) with the same name stored in the directory of the dynamic library to be loaded for each process.

[0157] based on Figure 9 and Figure 10 For each dynamic library file in the list of dynamic libraries to be loaded, if there is no corresponding attribute list file for that dynamic library file, the electronic device can directly load the library file. If there is a corresponding attribute list file for that dynamic library file, the electronic device will load it according to preset filtering rules (such as...). Figure 8 The plist filtering logic shown in the image is used to determine whether to load a .dylib file with the same name as the .plist file.

[0158] In some embodiments, the preset filtering rules may include at least one filtering mode and at least one filtering condition. In some embodiments, the at least one filtering condition may include at least one of: executable file filtering conditions, bundle filtering conditions, and class filtering conditions.

[0159] The executable file filtering condition is used to determine whether the name of the executable file in the Executables directory of the dynamic library file is the same as the name of the current process. If they are the same, the executable file filtering condition is determined to be a match; otherwise, it is determined not to match.

[0160] The package filtering criteria are used to determine whether the value of the package binding identifier (BundlesId) in the Bundles directory of the dynamic library file is the same as the package binding identifier of the current process. If they are the same, the package filtering criteria are determined to match; otherwise, the package filtering criteria are determined not to match.

[0161] The class filter condition is used to determine whether the value of the class name in the Classes directory of the dynamic library file is the same as the class name of the current process. If they are the same, the class filter condition is determined to be a match; otherwise, the class filter condition is determined to be a mismatch.

[0162] For example, the Executables directory and Bundles directory in a dynamic library file can be as follows: Figure 11 As shown.

[0163] In some embodiments, at least one filtering mode may include: a first filtering mode (Any=false), which indicates that the dynamic library file will not be loaded if any of the at least one filtering conditions are not matched; and a second filtering mode (Any=true), which indicates that the dynamic library file will be loaded if any of the at least one filtering conditions are matched. The second filtering mode may be configured with a matching priority, such as setting the matching priority from high to low as: executable file filtering condition, package filtering condition, and class filtering condition.

[0164] It should be noted that, under the condition of matching package filtering conditions, electronic devices can load dynamic library files by binding to the package binding identifier (Bundles Id) that exists in the current process, thereby loading global hooks.

[0165] It is understood that the embodiments of this application use application-level switch control to accurately locate the anti-hook (prevent malicious injection) range, without affecting the startup process of non-protected apps that have not activated the preset protection switch, thus improving the accuracy of security protection.

[0166] In some embodiments, based on Figure 3 ,like Figure 12 As shown, the application launch method provided in this application embodiment may further include S104, as follows:

[0167] S104. Record the information of the blocked dynamic libraries and send it to the backend server so that the backend server can collect information and perform data analysis based on the information of the blocked dynamic libraries.

[0168] In this embodiment, the electronic device can record the dynamic library information that is blocked during the execution of S103 and send it to the backend server. In this way, the backend server can perform information collection and data analysis based on the received blocked dynamic library information.

[0169] In some embodiments, the backend server can perform big data analysis on the received blocked dynamic library information, thereby gaining timely insight into the distribution of third-party hooks on key apps (such as WeChat, Taobao, etc.) and generating real-time dynamic trends of third-party hooks on key apps, and promptly verifying malicious hook attacks on key apps.

[0170] For example, such as Figure 13 As shown, electronic devices can record and statistically analyze information such as the hook name, loading type, loading characteristics, whether it targets a preset key APP, and the number of times it has been blocked, thereby generating report data and feeding it back to the backend server. Alternatively, it can save the data locally for further analysis.

[0171] Understandably, by reporting the data of the blocked dynamic libraries to the backend server, the backend server can analyze the dynamic changes of third-party hooks and issue security alerts, thereby further improving the security of application use.

[0172] Below, we will combine Figure 14 Taking the launch of an application on an iOS system (which already has the highest system privileges) as an example, this application illustrates an exemplary application in a real-world application scenario.

[0173] S301, Receive application startup command.

[0174] In S301, the electronic device receives the application startup command in the Springboard and starts the corresponding application.

[0175] S302. Determine whether the preset protection switch is turned on. If it is turned on, execute S303; otherwise, execute S304-2.

[0176] S303, Modify environment variables and set security mode to intercept MobileSubstrate.

[0177] In S303, when the preset protection switch is enabled, the electronic device adds the call path of the custom loader to the Springboard process startup environment variable DYLD INSERT LIBRARIES and sets _MSSafeMode to 1 to disable the preset loading switch, thereby intercepting the MobileSubstrate process on the iOS system. The process is consistent with that described in S101 and will not be repeated here.

[0178] S304-1, Do not inject SubstrateLoader.dylib.

[0179] In S304-1, since the interception of the original dynamic library loader MobileSubstrate has already been implemented in S303-1, the loading module SubstrateLoader.dylib in MobileSubstrate will not be injected into launchd.

[0180] S305, Application Startup.

[0181] S306-1. Run the anti-hook loading logic of the custom loader to perform hook loading.

[0182] The process in S306-1 is consistent with that described in S103, and will not be repeated here.

[0183] S307, Startup complete.

[0184] S304-2. When the preset protection switch is off, the electronic device adds the call path of SubstrateLoader.dylib to the environment variable DYLD INS ERTLIBRARIES to inject the SubstrateLoader.dylib loading module into launchd.

[0185] S306-2, Run the loading logic of SubstrateLoader.dylib to perform hook loading.

[0186] In S306-2, the electronic device performs a hook by running the loading logic of SubstrateLoader.dylib in MobileSubstrate, i.e., loading the dynamic library. The process of S306-2 is consistent with that described in S003, and will not be repeated here.

[0187] based on Figure 14 The application startup process is shown. The applicant conducted a comparative test on the application startup speed under two conditions: the preset protection switch is on and off. The test data is as follows:

[0188] The startup data is as follows when the default protection switch is on (without blocking any hooks):

[0189] application didFinishlaunchingWithOptions endtime=2014:06:16:15:20:42:2750SBApplication:launchSettingsbegintime=2014:06:16:15:20:39:7800alltime=2.495s

[0190] The startup data is as follows when the preset protection switch is on (normal shielding hook):

[0191] application:didFinishlaunchingWithOptions endtime=2014:06:16:15:01:58:3280SBApplication:launchSettings begintime=2014:06:16:15:01:56:2640alltime=2.064s

[0192] The startup data under the preset protection switch off (no anti-hook protection) condition is as follows:

[0193] application didFinishlaunchingWithOptions endtime=2014:06:16:15:05:55:1560SBApplication:launchSettings begintime=2014:06:16:15:05:52:6880alltime=2.468s

[0194] As can be seen, since the custom loading logic in this embodiment of the application hijacks MobileSubstrate and copies its core module SubstrateLoader.dylib for dynamic library loading, the startup speed with the preset protection switch enabled is almost identical to that with it disabled. In particular, for apps with the preset protection switch enabled, the startup speed can be further improved by blocking malicious or unnecessary hooks using the method in this embodiment of the application. As shown in the test data above:

[0195] The startup speed is 2.468s without anti-hook protection; 2.495s with anti-hook protection activated but without any hooks blocked; and 2.064s with anti-hook protection activated and malicious or redundant hooks blocked, which is the optimal state.

[0196] Furthermore, the applicant has compiled statistics on the anti-hook success rate of the embodiments of this application, wherein the anti-hook success rate = number of successful anti-hook attempts / number of anti-hook activations. The statistical data shows that the anti-hook success rate of the embodiments of this application can be as high as 99.78%, indicating that the application activation method of the embodiments of this application has strong stability and has not been compromised by large-scale malicious attacks from third parties.

[0197] It is understood that the application startup method provided in this application embodiment can effectively block the injection of malicious programs, improve the security of application use, and improve the application startup speed while blocking malicious programs, thereby improving user experience and user acceptance.

[0198] The following description continues to illustrate the exemplary structure of the application launch device 455 provided in the embodiments of this application as a software module. In some embodiments, such as... Figure 2 As shown, the software module stored in the application startup device 455 of the memory 450 may include:

[0199] The interception module 4551 is used to write the custom call path of the custom loader into the environment variables of the process before the process in the application is created, and to intercept the original dynamic library loader by turning off the preset loading switch.

[0200] The reading module 4552 is used to read the custom call path and the preset custom loading strategy from the environment variables during the process of starting the application by creating a process;

[0201] The startup module 4553 is used to call the custom loader through the custom call path, and according to the preset custom loading strategy, to block or load the dynamic library to be loaded corresponding to the process, thereby completing the startup of the application.

[0202] In some embodiments, the preset custom loading strategy includes: a strategy type corresponding to each process in at least one process, and a preset loading rule corresponding to each strategy type; the strategy type corresponding to each process belongs to at least one preset strategy type; the startup module 4553 is further configured to read the target strategy type corresponding to the process from the preset custom loading strategy through the custom loading program; and to block or load the dynamic library to be loaded corresponding to the process according to the target loading rule corresponding to the target strategy type.

[0203] In some embodiments, the preset loading rule includes: a protection type and a dynamic library candidate list. The startup module 4553 is further configured to: block the dynamic library to be loaded corresponding to the process when the protection type in the target loading rule is a preset first type; load the dynamic library to be loaded included in the dynamic library candidate list when the protection type in the target loading rule is a preset second type; and block the dynamic library to be loaded included in the dynamic library candidate list when the protection type in the target loading rule is a preset third type.

[0204] In some embodiments, the startup module 4553 is further configured to load the dynamic libraries to be loaded included in the dynamic library candidate list through custom loading logic in the custom loader; the custom loading logic is obtained by copying the functions in the original library file loader.

[0205] In some embodiments, the preset loading rule further includes: interface configuration rule, and the application launch device further includes: a display module; the display module is used to display a preset anti-hook protection animation on the preset application interface when the interface configuration rule indicates that an animation effect is to be displayed, during the loading or blocking of the dynamic library to be loaded; and not to provide interface prompts when the interface configuration rule indicates that no animation effect is to be displayed.

[0206] In some embodiments, the preset grid of the preset loading rule includes at least one field connected by a preset connection character, the at least one field including: a field representing the protection type and a field representing the dynamic library candidate list; or, a field representing the protection type, a field representing the dynamic library candidate list, and a field representing the interface configuration rule.

[0207] In some embodiments, the application launch device further includes an update module, which is used to update the preset loading rule by updating any field among the at least one field.

[0208] In some embodiments, a preset custom loading strategy is stored in a preset configuration file. The startup module 4553 is further configured to read the file path of the preset configuration file from the environment variables; and obtain the preset custom loading strategy from the preset configuration file through the file path.

[0209] In some embodiments, the update module is further configured to update the preset custom loading strategy by updating the correspondence between the update process and the strategy type in the preset configuration file.

[0210] In some embodiments, the application launch device 455 further includes a setting module, which is used to set the state of the preset protection switch by receiving a switch operation for the preset protection switch in the preset interface of the application; the launch module 4553 is further used to determine whether the preset protection switch corresponding to the application is in an on state before writing the custom call path of the custom loader into the environment variables of the process, upon receiving a launch instruction for the application; if the preset protection switch is in a off state, the original library file loader is called to load the dynamic library to be loaded corresponding to the process in the application, thereby completing the launch of the application.

[0211] In some embodiments, the application launch device 455 further includes a recording module for recording the blocked dynamic library information and sending it to a backend server so that the backend server can collect information and perform data analysis based on the blocked dynamic library information.

[0212] In the above-described device, the startup module 4553 is further configured to, after calling the custom loader through the custom call path, read at least one dynamic library file that the process depends on from the program header information of the process through the custom loader, as the dynamic library to be loaded.

[0213] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0214] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to perform the method provided in this application, for example... Figure 3 , Figure 4 , Figure 6 , Figure 8 , Figure 12 or Figure 14 The method shown in the figure.

[0215] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EP ROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0216] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0217] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0218] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0219] In summary, by writing a custom call path into the environment variables and disabling the preset loading switch before creating processes in the application, the call path of the original dynamic library loader is prevented from being written into the environment variables, thus intercepting the original dynamic library loader and blocking malicious programs from injecting into the application through it. Furthermore, during process creation, the corresponding dynamic libraries to be loaded for each process can be blocked or loaded according to a preset custom loading strategy. This allows for flexible expansion of the loader's security mechanism through customization of the preset loading strategy, thereby improving the security of dynamic library loading, effectively blocking malicious dynamic library intrusion, and ultimately enhancing the security of application use. Moreover, this embodiment uses application-level switch control to precisely locate the anti-hook (preventing malicious injection) range without affecting the startup process of non-protected apps with the preset protection switch disabled, improving the precision of security protection. Furthermore, by feeding back the data of blocked dynamic libraries to the backend server, the backend server can analyze the dynamic changes of third-party hooks and provide security warnings, further improving the security of application use. In addition to blocking malicious programs, the application startup speed is also improved, thereby enhancing user experience and user acceptance.

[0220] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. An application launch method, characterized in that, include: Before creating a process in the application, a custom call path for a custom loader is written into the environment variables of the process, and the original dynamic library loader is intercepted by turning off the preset loading switch. During the process of launching the application by creating a process, the custom call path and the preset custom loading strategy are read from the environment variables; The preset custom loading strategy includes: at least one strategy type corresponding to each process in the process, and a preset loading rule corresponding to each strategy type; the strategy type corresponding to each process belongs to at least one preset strategy type; The custom loader is invoked through the custom call path, and the target policy type corresponding to the process is read from the preset custom loading policy through the custom loader. According to the target loading rules corresponding to the target strategy type, the dynamic libraries to be loaded for the process are either blocked or loaded to complete the startup of the application. The target loading rule is the preset loading rule corresponding to the target strategy type.

2. The method according to claim 1, characterized in that, The preset loading rules include: protection type and dynamic library candidate list. The step of blocking or loading the dynamic library to be loaded corresponding to the process according to the target loading rule corresponding to the target policy type includes: When the protection type in the target loading rule is the preset first type, the dynamic library to be loaded corresponding to the process is blocked. If the protection type in the target loading rule is the preset second type, the dynamic libraries to be loaded included in the dynamic library candidate list are loaded. When the protection type in the target loading rule is the preset third type, the dynamic libraries to be loaded included in the dynamic library candidate list are blocked.

3. The method according to claim 2, characterized in that, The loading of the dynamic libraries to be loaded from the candidate list of dynamic libraries includes: The custom loading logic in the custom loader loads the dynamic libraries to be loaded from the dynamic library candidate list; the custom loading logic is obtained by copying the functions in the original dynamic library loader.

4. The method according to claim 2, characterized in that, The preset loading rules also include: interface configuration rules, and the method further includes: When the interface configuration rules characterize the display animation effect, a preset anti-hook protection animation is displayed on the preset application interface during the loading or blocking of the dynamic library to be loaded. If the interface configuration rule indicates that no animation effects should be displayed, no interface prompts will be provided.

5. The method according to claim 4, characterized in that, The preset format of the preset loading rule includes: at least one field connected by a preset connection character, wherein the at least one field includes: Fields characterizing the protection type and fields characterizing the candidate list of dynamic libraries; or, The fields that characterize the protection type, the fields that characterize the dynamic library candidate list, and the fields that characterize the interface configuration rules.

6. The method according to claim 5, characterized in that, The method further includes: The preset loading rule is updated by updating any field in at least one of the fields.

7. The method according to claim 1, characterized in that, The preset custom loading strategy is stored in a preset configuration file, and the method further includes: Read the file path of the preset configuration file from the environment variables; and obtain the preset custom loading strategy from the preset configuration file through the file path.

8. The method according to claim 7, characterized in that, The method further includes: The preset custom loading strategy is updated by updating the correspondence between the process and the strategy type in the preset configuration file.

9. The method according to claim 1, characterized in that, The method further includes: In the application's preset interface, the state of the preset protection switch is set by receiving a switch operation for the preset protection switch; Before writing the custom call path of the custom loader into the environment variables of the process, the method further includes: Upon receiving a launch command for the application, determine whether the preset protection switch corresponding to the application is in the on state; When the preset protection switch is in the off state, the original dynamic library loader is invoked to load the dynamic library to be loaded corresponding to the process in the application, thereby completing the startup of the application.

10. The method according to any one of claims 1-6, characterized in that, The method further includes: The information of the blocked dynamic libraries is recorded and sent to the backend server, so that the backend server can collect information and perform data analysis based on the information of the blocked dynamic libraries.

11. The method according to any one of claims 1-6, characterized in that, After invoking the custom loader through the custom invocation path, the method further includes: The custom loader reads at least one dynamic library file that the process depends on from the process's program header information, and uses it as the dynamic library to be loaded.

12. An application activation device, characterized in that, include: The interception module is used to write the custom call path of the custom loader into the environment variables of the process before the process is created in the application, and to intercept the original dynamic library loader by turning off the preset loading switch. The reading module is used to read the custom call path and the preset custom loading strategy from the environment variables during the process of starting the application by creating a process; wherein the preset custom loading strategy includes: at least one strategy type corresponding to each process in the process, and a preset loading rule corresponding to each strategy type; the strategy type corresponding to each process belongs to at least one preset strategy type; The startup module is used to call the custom loader through the custom call path, and through the custom loader, read the target policy type corresponding to the process from the preset custom loading strategy; according to the target loading rule corresponding to the target policy type, it blocks or loads the dynamic library to be loaded corresponding to the process to complete the startup of the application; wherein, the target loading rule is the preset loading rule corresponding to the target policy type.

13. The apparatus according to claim 12, characterized in that, The preset loading rules include: protection type and dynamic library candidate list; the startup module is also used for: When the protection type in the target loading rule is the preset first type, the dynamic library to be loaded corresponding to the process is blocked. If the protection type in the target loading rule is the preset second type, the dynamic libraries to be loaded included in the dynamic library candidate list are loaded. When the protection type in the target loading rule is the preset third type, the dynamic libraries to be loaded included in the dynamic library candidate list are blocked.

14. The apparatus according to claim 13, characterized in that, The startup module is also used for: The custom loading logic in the custom loader loads the dynamic libraries to be loaded from the dynamic library candidate list; the custom loading logic is obtained by copying the functions in the original dynamic library loader.

15. The apparatus according to claim 13, characterized in that, The preset loading rules also include: interface configuration rules, and the device further includes a display module for: When the interface configuration rules characterize the display animation effect, a preset anti-hook protection animation is displayed on the preset application interface during the loading or blocking of the dynamic library to be loaded. If the interface configuration rule indicates that no animation effects should be displayed, no interface prompts will be provided.

16. The apparatus according to claim 15, characterized in that, The preset format of the preset loading rule includes: at least one field connected by a preset connection character, wherein the at least one field includes: Fields characterizing the protection type and fields characterizing the candidate list of dynamic libraries; or, The fields that characterize the protection type, the fields that characterize the dynamic library candidate list, and the fields that characterize the interface configuration rules.

17. The apparatus according to claim 16, characterized in that, The device further includes an update module for: The preset loading rule is updated by updating any field in at least one of the fields.

18. The apparatus according to claim 12, characterized in that, The preset custom loading strategy is stored in a preset configuration file. The startup module is also used for: Read the file path of the preset configuration file from the environment variables; and obtain the preset custom loading strategy from the preset configuration file through the file path.

19. The apparatus according to claim 18, characterized in that, The device further includes an update module, which is further configured to: The preset custom loading strategy is updated by updating the correspondence between the process and the strategy type in the preset configuration file.

20. The apparatus according to claim 12, characterized in that, The device further includes a setting module for: In the application's preset interface, the state of the preset protection switch is set by receiving a switch operation for the preset protection switch; Before writing the custom call path of the custom loader into the environment variables of the process, the startup module is further configured to: Upon receiving a launch command for the application, determine whether the preset protection switch corresponding to the application is in the on state; When the preset protection switch is in the off state, the original dynamic library loader is invoked to load the dynamic library to be loaded corresponding to the process in the application, thereby completing the startup of the application.

21. The apparatus according to any one of claims 12-17, characterized in that, The device further includes a recording module for: The information of the blocked dynamic libraries is recorded and sent to the backend server, so that the backend server can collect information and perform data analysis based on the information of the blocked dynamic libraries.

22. The apparatus according to any one of claims 12-17, characterized in that, After the custom loader is invoked via the custom invocation path, the startup module is further configured to: The custom loader reads at least one dynamic library file that the process depends on from the process's program header information, and uses it as the dynamic library to be loaded.

23. An electronic device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the method according to any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that, It stores executable instructions for implementing the method of any one of claims 1 to 11 when executed by a processor.

25. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the method described in any one of claims 1 to 11.

Images