Method, apparatus and electronic device for monitoring interface invocation

Abstract

The application provides a method, device and electronic equipment for monitoring interface calling, which can include: if an interface calling instruction is detected, obtaining interface authentication information corresponding to an interface to be called in the interface calling instruction; if a target interface calling method matching the calling type and the calling location information is found in a monitoring list, determining that the target interface calling method is suspected of violating rules; the monitoring list stores a plurality of interface calling methods suspected of violating rules and interface authentication information corresponding to each interface calling method; the plurality of interface calling methods suspected of violating rules are obtained from a library file for inter-process communication in an Android system; and the library file stores a plurality of interface calling methods provided with hooks. The method can more accurately and comprehensively monitor the calling of interfaces in inter-process communication.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a method, apparatus, and electronic device for monitoring interface calls. Background Technology

[0002] With the continuous development of technology, various applications are emerging in endless streams. During their operation, these applications may call APIs (Application Programming Interfaces). If APIs are called improperly (for example, APIs involving sensitive information, such as personal identification information, address information, account information, etc.), it may lead to information security problems (such as information leakage). Therefore, it is necessary to monitor API calls.

[0003] In related technologies, API calls can be monitored through methods such as manual analysis of static code and bytecode instrumentation, but these methods suffer from incomplete monitoring. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, and electronic device for monitoring interface calls, so as to monitor the interface call status more accurately and comprehensively in cross-process communication.

[0005] Firstly, this application provides a method for monitoring interface calls. The method includes: if an interface call instruction is detected, obtaining interface authentication information corresponding to the interface to be called in the instruction; the interface authentication information includes call type and call location information; the call type represents the type of the interface to be called; the call location information represents the position of the interface call method within a class; if a target interface call method matching both the call type and call location information is found in the monitoring list, it is determined that the target interface call method is suspected of violating regulations; the monitoring list stores multiple suspected violating interface call methods and their corresponding interface authentication information; the multiple suspected violating interface call methods are obtained from inter-process communication library files in the Android system; the library files store multiple interface call methods with hooks. This allows for relatively accurate and comprehensive monitoring of interface calls during cross-process communication.

[0006] Optionally, before determining that a target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list, the method further includes: for any suspected violating interface call method, if the interface call method is found in the library file, determining that it is an interface call method with a configurable hook; for any interface call method with a configurable hook, obtaining the interface authentication information corresponding to the interface call method during its operation; and storing the interface call method and the interface authentication information in association in the monitoring list. This ensures that the interface call method, call type, and call location information correspond to each other.

[0007] Optionally, for any interface call method with configurable hooks, obtaining the interface authentication information corresponding to the interface call method during its execution includes: obtaining the call type corresponding to the interface call method through a type acquisition function; and obtaining the call location information corresponding to the interface call method through a location acquisition function. In this implementation, the interface authentication information of the interface call method can be obtained through the type acquisition function and the location acquisition function to facilitate the establishment of a monitoring list.

[0008] Optionally, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored in the same address respectively; and the associated storage of the interface call method and interface authentication information includes: if the call type and the call location information are acquired in the same thread, and the call type and the call location information are stored in the same address, then the interface call method, call type, and call location information are associated and stored. In this way, it can be confirmed whether the call type, call location information, and interface call method correspond to each other, and if they correspond, the three are associated and stored, which improves the accuracy of the monitoring list to a certain extent.

[0009] Optionally, the call type includes the package name and AIDL file name, and the step of obtaining the interface authentication information corresponding to the interface to be called in the interface call instruction if an interface call instruction is detected includes: if an interface call instruction is detected, obtaining the package name and AIDL file name from a preset type storage location; the preset type storage location stores type information corresponding to each interface; and obtaining the call location information from a preset location information storage location; the preset location information storage location stores the location information of each interface call method in the class. In this way, accurate interface authentication information can be obtained from the preset location to facilitate the determination of whether the interface to be called is a sensitive interface.

[0010] Optionally, after determining that a target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list, the method further includes: if the target interface call method is not authorized by the user, then prohibiting the execution of the interface call instruction. This allows for timely interception of illegal instructions, improving the information security of the interface to be called.

[0011] Secondly, embodiments of this application provide an apparatus for monitoring interface calls. The apparatus includes: an acquisition module, configured to acquire interface authentication information corresponding to the interface to be called in the interface call instruction if an interface call instruction is detected; the interface authentication information includes call type and call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the position of the interface call method in the class; and a monitoring module, configured to determine that the target interface call method is suspected of violating regulations if a target interface call method matching both the call type and call location information is found in the monitoring list; the monitoring list stores multiple suspected violating interface call methods and their corresponding interface authentication information; the multiple suspected violating interface call methods are obtained from inter-process communication library files in the Android system; the library files store multiple interface call methods with hooks.

[0012] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the method provided in the first aspect above are performed.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method provided in the first aspect above.

[0014] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A flowchart illustrating a method for calling a monitoring interface, as provided in an embodiment of this application;

[0017] Figure 2 A structural block diagram of a device for calling a monitoring interface provided in an embodiment of this application;

[0018] Figure 3 This is a schematic diagram of the structure of an electronic device for executing a method of monitoring interface calls, provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] It should be noted that, where there is no conflict, the embodiments or technical features in the embodiments of this application can be combined.

[0022] In related technologies, there is a problem of incomplete monitoring of API calls. To solve this problem, this application provides a method, apparatus, and electronic device for monitoring API calls. Furthermore, by matching the relevant information of the API to be called with a monitoring list, it is determined whether the API to be called is suspected of violating regulations, thereby achieving the purpose of monitoring API calls. The monitoring list pre-stores relevant information corresponding to APIs suspected of violating regulations. In this way, it is possible to determine whether the API to be called is violating regulations relatively accurately and comprehensively through the monitoring list.

[0023] The defects in the solutions in the above-mentioned related technologies are all the result of the inventors' practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of the present invention in the following text should be considered as contributions made by the inventors to the present invention.

[0024] In some application scenarios, the methods called by the above monitoring interface can be applied to mobile terminals, such as mobile phones and tablets.

[0025] Please refer to Figure 1 The diagram illustrates a flowchart of a method for calling a monitoring interface according to an embodiment of this application. Figure 1 As shown, the method called by the monitoring interface includes the following steps 101 to 102.

[0026] Step 101: If an interface call instruction is detected, obtain the interface authentication information corresponding to the interface to be called in the interface call instruction; the interface authentication information includes call type and call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the position of the interface call method in the class;

[0027] The aforementioned interface invocation instruction, also known as the instruction to invoke an interface, may include relevant information about the interface to be invoked. This relevant information may include, for example, the address of the interface to be invoked, the request method, the type of the interface to be invoked, and / or the location of the interface to be invoked within the class.

[0028] The above call types may include, for example, types that retrieve the list of installed devices or types that retrieve the geographical location.

[0029] The aforementioned location information may include, for example, the location code and location number of the interface to be called within the class. The aforementioned class could be, for example, the `android.content.pm.IPackageManager` class (used for package installation operations) or the `android.content.IClipboard` class (used for clipboard operations). 。

[0030] In some application scenarios, if a mobile terminal detects an interface call instruction, it can obtain the call type and call location information of the interface to be called, so as to identify whether the interface to be called is suspected of violating regulations.

[0031] Step 102: If a target interface call method that matches the call type and call location information is found in the monitoring list, then the target interface call method is determined to be suspected of violating regulations. The monitoring list stores multiple suspected violating interface call methods and the corresponding interface authentication information for each interface call method. The multiple suspected violating interface call methods are obtained from the inter-process communication library file in the Android system. The library file stores multiple interface call methods with hooks set.

[0032] The aforementioned monitoring list is used to monitor whether the interfaces to be called are suspected of violating regulations. The multiple suspected violation interface call methods stored within are obtained from the inter-process communication library file in the Android system, namely libbinder.so. Therefore, the mobile terminal mentioned above is a terminal with the Android system installed.

[0033] The above-mentioned interface call methods are used to call the corresponding interfaces, which may include, for example, the following methods defined by the AIDL language (Android Interface Definition Language): android.content.pm.PackageManager.getInstalledPackages() method, android.app.ActivityManager.getRunningAppProcesses() method, and android.telephony.TelephonyManager.getDeviceId() method.

[0034] Furthermore, during inter-process communication, after obtaining the call type and call location information of the interface to be called, the mobile terminal can search the monitoring list for a target interface call method that matches both. If such a method exists, the interface to be called can be considered a sensitive interface, and the target interface call method calling this sensitive interface is suspected of violating regulations. Since the interface call methods stored in the monitoring list are all hooked (i.e., can be hooked) obtained from libbinder.so, the mobile terminal can hook the target interface call method in libbinder.so.

[0035] In related technologies, the process of calling an interface using reflection or dynamic code loading can only occur during code execution. Therefore, methods such as manually analyzing static code and bytecode instrumentation cannot monitor interface calls before code execution. 。In this context, reflection calls and dynamic code loading ultimately require calling the process methods of the other end through the lower-level libbinder.so to achieve cross-process communication. For example, the various interface call methods defined in the AIDL language all ultimately require the IBinder.transact method to achieve cross-process communication.

[0036] In this implementation, since the monitoring list stores suspected illegal interface call methods that can be hooked from libbinder.so, if a target interface call method corresponding to the interface to be called is found in the monitoring list, it can be considered that the target interface call method is suspected of being illegal. This allows for more accurate monitoring of interface calls in cross-process communication. Furthermore, because libbinder.so is a relatively low-level library file, interface call methods executed based on higher-level files (such as the aforementioned reflection call method) can be detected, thus enabling more comprehensive monitoring of interface calls.

[0037] In addition, there are solutions for dynamically monitoring API calls in related technologies. These solutions can be implemented using tools like Firda (a cross-platform hooking tool) or Xposed (an open-source framework service that runs in high-privilege mode on Android). These dynamic monitoring solutions require a pre-built detection environment to achieve their monitoring objectives. This can be achieved by pre-installing the Firda or Xposed framework, or by writing or installing corresponding plugins.

[0038] In this implementation, regardless of whether the mobile terminal has set up a detection environment or not, it can monitor the interface call status, and to a certain extent, it can be applied to more mobile terminals.

[0039] In some optional implementations, the call type includes the package name and the AIDL file name, and as described in step 101 above, if an interface call instruction is detected, the interface authentication information corresponding to the interface to be called in the interface call instruction is obtained, including:

[0040] Sub-step 1011: If an interface call instruction is detected, the package name and AIDL file name are obtained from the preset type storage location; the preset type storage location stores the type information corresponding to each interface.

[0041] The package name and AIDL file name mentioned above can be considered as the call type. For example, the call type of the android.content.IClipboard.aidl method can be: android.content.IClipboard.

[0042] The mobile terminal can pre-collect the type information corresponding to each interface, distinguish them by package name and AIDL file name, and then store them in a preset type storage location. This preset type storage location can be, for example, a folder or a data table on the mobile terminal, and is not limited here.

[0043] Sub-step 1012: Obtain the call location information from the preset location information storage location; the preset location information storage location stores the location information of each interface call method in the class.

[0044] Mobile terminals can also collect the location information of each interface call method in the class in advance and store it in a preset location information storage location. This preset location information storage location can be, for example, a folder or a data table in the mobile terminal, and there are no restrictions here.

[0045] In some application scenarios, mobile terminals can obtain call type and call location information through the Stub class, for example.

[0046] In this implementation, accurate interface authentication information can be obtained from a preset location to determine whether the interface to be called is a sensitive interface.

[0047] In some optional implementations, after determining that the target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list in step 102 above, the method further includes: if the target interface call method is not authorized by the user, then the execution of the interface call instruction is prohibited.

[0048] In some application scenarios, after determining that a target API call method is suspected of violating regulations, the mobile terminal can verify whether it has indeed violated the regulations. Specifically, the mobile terminal can verify this by checking historical information, such as whether the user authorized the use of the API call method in the previous 10 days or month. Alternatively, the mobile terminal can ask the user again whether they agree to use the target API call method to determine whether the user has authorized its use.

[0049] In these application scenarios, mobile terminals can prevent the actual transact method from being called when the target interface call method is not authorized by the user, thereby achieving the purpose of preventing the execution of interface call instructions.

[0050] In addition, if the target interface calling method has been authorized by the user in the past or is currently agreed to by the user, it can be considered that the target interface calling method is not in violation of the rules, and the interface calling instruction can be executed to call the interface to be called indicated by the instruction.

[0051] In this implementation, if it is determined that a target interface call method is suspected of violating regulations, its authenticity can be further verified to determine whether the interface to be called should be invoked. This allows for timely interception of violating instructions, improving the information security of the interface to be called.

[0052] In some optional implementations, before determining that a target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list as described in step 102 above, the method further includes the following step of establishing a monitoring list:

[0053] Step 1: For any suspected violation of the interface call method, if the interface call method is found in the library file, it is determined to be an interface call method that can be hooked.

[0054] Mobile terminals can pre-obtain API call methods suspected of being illegal. These API call methods may, for example, be pre-configured by the operator.

[0055] Then, the mobile terminal can search for each suspected violation of the API call method in libbinder.so. Specifically, the mobile terminal can search in the plt table (Procedure Link Table) in libbinder.so, or by searching through inline functions (used to define inline functions of a class).

[0056] Furthermore, if the suspected violation of the API call method is found in libbinder.so, it can be considered that the API call method can be hooked.

[0057] Step 2: For any API call method that can be configured with hooks, obtain the API authentication information corresponding to the API call method during its execution.

[0058] For API call methods that can be hooked, the API call method needs to be run in order to obtain the corresponding call type and call location information.

[0059] In some optional implementations, the step of obtaining the interface authentication information corresponding to any interface call method that can be hooked during its execution includes: obtaining the call type corresponding to the interface call method through a type acquisition function; and obtaining the call location information corresponding to the interface call method through a location acquisition function.

[0060] The functions for obtaining the above types may include, for example, the android::Parcel::writeInterfaceToken method;

[0061] The aforementioned location retrieval function may include, for example, the IPCThreadState::transact method.

[0062] In some application scenarios, for example, the following code can be used to determine whether a certain interface call method can be hooked:

[0063]

[0064]

[0065] Then, the call type corresponding to the API call method can be obtained using the following code. In this code, the call type corresponds to the token parameter.

[0066]

[0067] Then, the call location information corresponding to the method call of this interface can be obtained through the following code.

[0068] In this code, the parameter corresponding to the location information is 'code'.

[0069]

[0070]

[0071] In this implementation, the interface authentication information of the API call method can be obtained through the type acquisition function and the position acquisition function, so as to build a monitoring list.

[0072] Step 3: Associate and store the interface call method and interface authentication information in the monitoring list.

[0073] After obtaining the interface authentication information, the mobile terminal can associate and store the interface call method, call type, and call location information in the monitoring list to ensure that the three correspond to each other.

[0074] In some optional implementations, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored in the same address respectively; and the associated storage of the interface call method and interface authentication information includes: if the call type and the call location information are acquired in the same thread, and the call type and the call location information are stored in the same address, then the interface call method, call type and call location information are associated and stored.

[0075] In some application scenarios, the `android::Parcel::writeInterfaceToken` and `IPCThreadState::transact` methods mentioned above will be executed sequentially in the same thread, and after their execution, the corresponding call type and call location information will be stored at the same address. In these scenarios, for example, a `parcel` pointer can simultaneously point to the call type and call location information corresponding to the same interface call method, thereby achieving the goal of storing both at the same address.

[0076] Subsequently, after the mobile terminal obtains the call type and call location information within the same thread, it can further determine whether the two are stored at the same address to ascertain whether the call type and call location information correspond to the same interface call method. In some application scenarios, the `thread_local` function can be used to obtain the call type and call location information from the same thread, and then the `transact` method can be used to determine whether the parcel pointer corresponding to the call type is the same pointer as the parcel pointer corresponding to the call location information. If so, it can be determined that the two are stored at the same address, and thus the interface call method, call type, and call location information can be associated and stored.

[0077] In related technologies, if the Android system version changes, a certain interface call method may be inserted or removed from the same class. This will cause the call location information corresponding to the same type of interface call method to change, resulting in a mismatch between the interface call method, call type, and call location information. For example, in Android system version 2.0, the call location code for interface call method A is 36. When the Android system is upgraded to version 3.0, an interface call method B of the same type as interface call method A is added to the same class, causing the call location code for interface call method A to change from 36 to 37. Thus, this call location code no longer corresponds to interface call method A and its call type.

[0078] In this implementation, it is possible to confirm whether the call type, call location information, and interface call method correspond to each other, and when they correspond, the three are associated and stored, which improves the accuracy of the monitoring list to a certain extent.

[0079] In some application scenarios, the following code can be used to determine the correspondence between the call type, call location information, and interface call method.

[0080]

[0081]

[0082] Those skilled in the art will understand that, in the methods described in the specific embodiments, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0083] Please refer to Figure 2 The diagram illustrates a structural block diagram of a monitoring interface calling device according to an embodiment of this application. This monitoring interface calling device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 1 The method implementation is corresponding and can be executed. Figure 1 The specific functions of the device involved in the method embodiments can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0084] Optionally, the device for monitoring interface calls includes an acquisition module 201 and a monitoring module 202. The acquisition module 201 is used to acquire, if an interface call instruction is detected, the interface authentication information corresponding to the interface to be called in the interface call instruction; the interface authentication information includes call type and call location information; the call type represents the type of the interface to be called; the call location information represents the position of the interface call method in the class; the monitoring module 202 is used to determine that the target interface call method is suspected of violating regulations if a target interface call method matching both the call type and call location information is found in the monitoring list; the monitoring list stores multiple suspected violating interface call methods and their corresponding interface authentication information; the multiple suspected violating interface call methods are obtained from inter-process communication library files in the Android system; the library files store multiple interface call methods with hooks.

[0085] Optionally, the device further includes a table creation module, which is used to: before determining that a target interface call method is suspected of being in violation if a target interface call method matching the call type and call location information is found in the monitoring list, determine that any suspected violation interface call method is an interface call method that can be hooked if the interface call method is found in the library file; for any interface call method that can be hooked, obtain the interface authentication information corresponding to the interface call method during its operation; and associate and store the interface call method and the interface authentication information in the monitoring list.

[0086] Optionally, the table creation module is further configured to: for any interface call method with configurable hooks, obtain the call type corresponding to the interface call method through a type acquisition function; and obtain the call location information corresponding to the interface call method through a location acquisition function.

[0087] Optionally, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored in the same address respectively. The table building module is further used to: if the call type and the call location information are acquired in the same thread, and the call type and the call location information are stored in the same address, then the interface call method, call type and call location information are stored together.

[0088] Optionally, the call type includes the package name and the AIDL file name, and the acquisition module 201 is further configured to: if an interface call instruction is detected, obtain the package name and the AIDL file name from a preset type storage location; the preset type storage location stores type information corresponding to each interface; and obtain the call location information from a preset location information storage location; the preset location information storage location stores the location information of each interface call method in the class.

[0089] Optionally, the device further includes a verification module, which is used to: after determining that the target interface call method is suspected of violating regulations if a target interface call method that matches the call type and call location information is found in the monitoring list, and if the target interface call method has not been authorized by the user, then prohibit the execution of the interface call instruction.

[0090] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system or device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0091] Please refer to Figure 3 , Figure 3 This is a schematic diagram of an electronic device for executing a method of monitoring interface calls, provided in an embodiment of this application. The electronic device may include: at least one processor 301, such as a CPU; at least one communication interface 302; at least one memory 303; and at least one communication bus 304. The communication bus 304 is used to implement direct communication between these components. In this embodiment, the communication interface 302 is used for signaling or data communication with other node devices. The memory 303 may be a high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 303 may also be at least one storage device located remotely from the aforementioned processor. The memory 303 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 301, the electronic device can perform the aforementioned... Figure 1 The method and process are shown.

[0092] Understandable. Figure 3 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3 The components shown can be implemented using hardware, software, or a combination thereof.

[0093] This application provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it can perform actions such as... Figure 1 The method process executed by the electronic device in the illustrated method embodiment.

[0094] This application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the methods provided in the above-described method embodiments. For example, the method may include: if an interface call instruction is detected, obtaining interface authentication information corresponding to the interface to be called in the interface call instruction; the interface authentication information includes call type and call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the position of the interface call method in the class; if a target interface call method matching the call type and call location information is found in the monitoring list, it is determined that the target interface call method is suspected of violating regulations; the monitoring list stores multiple suspected violating interface call methods and the interface authentication information corresponding to each interface call method; the multiple suspected violating interface call methods are obtained from a library file for inter-process communication in the Android system; the library file stores multiple interface call methods with hooks.

[0095] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0096] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0098] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0099] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for monitoring interface calls, characterized in that, include: If an interface call command is detected, obtain the interface authentication information corresponding to the interface to be called in the interface call command; The interface authentication information includes call type and call location information; the call type represents the type of the interface to be called; the call location information represents the position of the interface call method in the class; If a target interface call method that matches the call type and call location information is found in the monitoring list, it is determined that the target interface call method is suspected of violating regulations; the monitoring list stores multiple suspected violating interface call methods and the corresponding interface authentication information for each interface call method. The multiple suspected illegal interface call methods were obtained from the inter-process communication library file in the Android system; the library file stores multiple interface call methods with hooks set. The method further includes the following steps before determining that a target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list: If any suspected violation of the API call method is found in the library file, it is determined to be an API call method that can be hooked. For any API call method with configurable hooks, obtain the API authentication information corresponding to that API call method during its execution; and The interface call method and interface authentication information are associated and stored in the monitoring list; Specifically, for any interface call method with configurable hooks, obtaining the interface authentication information corresponding to the interface call method during its execution includes: For any API call method with configurable hooks, obtain the call type corresponding to that API call method using the type acquisition function; and The location information corresponding to the call location of the interface call method is obtained through the location retrieval function; The type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored in the same address respectively. Furthermore, the associated storage of the interface call method and interface authentication information includes: If the call type and the call location information are obtained in the same thread, and the call type and the call location information are stored at the same address, then the interface call method, call type, and call location information are stored together. The call type and the call location information are determined to be stored at the same address by using the transact method to determine whether the parcel pointer corresponding to the call type is the same pointer as the parcel pointer corresponding to the call location information. If so, it is determined that the two are stored at the same address.

2. The method according to claim 1, characterized in that, The call type includes the package name and the AIDL file name, and If an interface call instruction is detected, the interface authentication information corresponding to the interface to be called in the interface call instruction is obtained, including: If an interface call instruction is detected, the package name and AIDL file name are retrieved from a preset type storage location; the preset type storage location stores type information corresponding to each interface; and The call location information is obtained from the preset location information storage location; the preset location information storage location stores the location information of each interface call method in the class.

3. The method according to claim 1, characterized in that, After determining that the target interface call method is suspected of violating regulations if a target interface call method matching the call type and call location information is found in the monitoring list, the method further includes: If the target interface call method is not authorized by the user, the execution of the interface call instruction is prohibited.

4. A device for monitoring interface calls, characterized in that, include: The acquisition module is used to acquire the interface authentication information corresponding to the interface to be called in the interface call instruction if an interface call instruction is detected. The interface authentication information includes call type and call location information; the call type represents the type of the interface to be called; the call location information represents the position of the interface call method in the class; The monitoring module is used to determine that a target interface call method is suspected of violating regulations if a target interface call method that matches the call type and call location information is found in the monitoring list. The monitoring list stores multiple suspected violating interface call methods and the corresponding interface authentication information for each interface call method. The multiple suspected illegal interface call methods were obtained from library files used for inter-process communication in the Android system; The library file stores multiple interface call methods with hooks set; The device further includes: The table creation module is used to determine if any suspected violation of the interface call method is found in the library file and is therefore a hookable interface call method; for any hookable interface call method, it retrieves the corresponding interface authentication information during its operation; and it stores the interface call method and the interface authentication information in the monitoring list. Specifically, the table creation module is used to obtain the call type corresponding to any interface call method that can be set with hooks through a type acquisition function; and to obtain the call location information corresponding to the interface call method through a location acquisition function. The type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored in the same address respectively. Furthermore, the table creation module is used to associate and store the interface call method, call type, and call location information if the call type and call location information are obtained in the same thread and are stored at the same address. The method for determining whether the call type and call location information are stored at the same address is as follows: the transact method is used to determine whether the parcel pointer corresponding to the call type is the same pointer as the parcel pointer corresponding to the call location information. If so, it is determined that the two are stored at the same address.

5. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-3.

Images