Method, system, electronic device and medium for controlling outbound behavior of Android programs

Abstract

The embodiment of the present invention provides a method, system, electronic device and medium for controlling the outbound behavior of an Android program, which belongs to the field of program control. The method includes: traversing the system / proc directory to identify the process ID list of the Android program; using the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET and PTRACE_PEEKDATA to track and debug each process, so as to achieve control over the behavior of the Android program in sending and receiving files. By utilizing the process tracking and debugging function of ptrace, the process of reading and sending an Android program is audited and controlled, avoiding the problem that the kernel layer hook solution has poor system compatibility and the user layer preload hook solution cannot control the Android version of the application.

Description

Technical Field

[0001] The present invention relates to the technical field of program control, and in particular to a method, system, electronic device and medium for controlling outbound behavior of an Android program. Background Art

[0002] Existing control technologies, such as kernel layer hook, are to replace the address of the kernel layer system call table by writing kernel modules, so that system function calls such as open, read, write, send and other functions point to the function implementation address written by themselves. After checking the parameters of the system call, according to business judgment, choose to call and replace the previous system call or directly return error information. The disadvantage of this solution is that it is strongly related to the system kernel version. When the system is upgraded, it needs to be re-adapted and compiled, and it can only control the underlying API of the system; another user-level preload technology uses the loading priority of the program dynamic library link to modify LD_PRELOAD or / etc / ld.so.preload to implement the API functions of the standard library libc such as open, readdir, sendmsg, etc., covering the existing C library API to achieve the purpose of control. The disadvantage of this solution is that it can only control the native software of the system. Win simulator programs and Android simulator programs have a compatibility layer, and this compatibility layer will block the preload loading of the dynamic link library, resulting in the inability of preload technology to control the simulator program. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a method, system, electronic device and medium for managing the outbound behavior of an Android program, which are used to completely or at least partially solve the technical problems existing in the above-mentioned prior art.

[0004] In order to achieve the above object, an embodiment of the present invention provides a method for controlling outbound behavior of an Android program, comprising:

[0005] Traverse the system / proc directory and identify the process ID list of Android programs;

[0006] Use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list to control the behavior of sending and receiving files in the Android program.

[0007] Optionally, traverse the system / proc directory and identify the process ID list of Android programs, including:

[0008] Traverse the system / proc directory and obtain the final pointer of the / proc / {pid} / exe symbolic link file. If it is the andorid program path, traverse the / proc / {pid} / task directory under its path and obtain the ID of its child thread, and finally get a list of process IDs.

[0009] Optionally, use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list to control the behavior of sending and receiving files by Android programs, including:

[0010] Execute the PTRACE_ATTACH instruction for each process in the process ID list for tracing debugging;

[0011] Set the tracing options to capture system calls and trace child processes, where the PTRACE_SETOPTIONS instruction is called for the process that is first added to the list;

[0012] Wait for the traced process to enter the STOP state, and determine whether it enters the STOP state due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information;

[0013] Based on the direct parameter information and pointer parameter information obtained, determine whether to allow outbound file reading. If outbound file reading is not allowed, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block outbound file reading.

[0014] Optionally, based on the direct parameter information and pointer parameter information obtained, determine whether to allow the file to be read outward. If the file is not allowed to be read outward, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block the file from being read outward, including:

[0015] If outbound file reading is not allowed, modify the offset of the file path pointer to offset it to the terminator at the end of the path, and call PTRACE_SETREGSET to make the modification effective.

[0016] Optionally, if it is not a system call, call PTRACE_CONT to continue the STOPped process.

[0017] On the other hand, the present invention also provides a management system for outbound behavior of Android programs, including:

[0018] The traversal module is used to traverse the system / proc directory and identify the process ID list of Android programs;

[0019] The control module is used to use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list, so as to control the behavior of sending and receiving files of Android programs.

[0020] Optionally, the control module is specifically used to:

[0021] Execute the PTRACE_ATTACH instruction for each process in the process ID list for tracing debugging;

[0022] Set the tracing options to capture system calls and trace child processes, where the PTRACE_SETOPTIONS instruction is called for the process that is first added to the list;

[0023] Wait for the traced process to enter the STOP state, and determine whether it enters the STOP state due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information;

[0024] Based on the direct parameter information and pointer parameter information obtained, determine whether to allow outbound file reading. If outbound file reading is not allowed, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block outbound file reading.

[0025] Optionally, the control module is specifically used to:

[0026] If outbound file reading is not allowed, modify the offset of the file path pointer to offset it to the terminator at the end of the path, and call PTRACE_SETREGSET to make the modification effective.

[0027] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for controlling the outbound behavior of Android programs described above when executing the program.

[0028] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the method for controlling the outbound behavior of an Android program described above are implemented.

[0029] Through the above technical solution, the user-level ptrace function for process tracking and debugging is utilized to audit and control the process of reading and sending Android programs, thereby realizing the function of controlling the outbound sending of Android programs and avoiding the problem that the kernel-level hook solution has poor system compatibility and the user-level preload hook solution cannot control the Android version of the application.

[0030] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0032] Figure 1 It is an implementation flow chart of a method for controlling outbound behavior of an Android program provided by an embodiment of the present invention;

[0033] Figure 2 It is a detailed implementation flow chart of a method for controlling outbound behavior of an Android program provided by an embodiment of the present invention;

[0034] Figure 3 It is a structural diagram of a system for controlling outbound behavior of an Android program provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0036] This application uses the ptrace technology under domestic Linux to "probe" the Android simulator compatibility layer under the domestic system, so as to achieve the purpose of identifying and controlling the file sending and downloading behaviors of Android simulators such as QQ and WeChat programs. Ptrace technology is a debugging process tool provided by the Linux system. It is very powerful and provides many ways to debug the process. The following is the definition of ptrace call:

[0037] long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

[0038] request: specifies the debugging instruction, such as PTRACE_ME, PTRACE_PEEKUSER, PTRACE_CONT, PTRACE_GETREGS, etc.;

[0039] pid: the process number being tracked;

[0040] addr: an address space of the process, through which the address of the process can be read and written;

[0041] data: extended content of different instructions.

[0042] See also Figure 1 As shown, it is a flowchart of an implementation method of a control method of an Android program outbound behavior provided by an embodiment of the present invention, including the following execution steps:

[0043] Step 100: Traverse the system / proc directory and identify the process ID list of the Android program.

[0044] Specifically, when executing step 100, the following steps can be specifically performed: traverse the system / proc directory to obtain the final point of the / proc / {pid} / exe symbolic link file; if it is an andorid program path, traverse the / proc / {pid} / task directory under its path to obtain the ID of its child thread, and finally obtain a list of process IDs.

[0045] Step 101: Use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list, so as to control the behavior of sending and receiving files of the Android program.

[0046] Specifically, when executing step 101, the following steps may be specifically performed:

[0047] S1010: Execute the PTRACE_ATTACH instruction for each process in the process ID list to perform tracing and debugging.

[0048] Specifically, it traverses the obtained process ID list, executes the PTRACE_ATTACH instruction of ptrace for each process, and obtains the control right when calling the system API by "tracing and debugging" the above processes.

[0049] S1011: Setting tracing options to capture system calls and trace child processes, wherein the PTRACE_SETOPTIONS instruction is called for the process that is added to the list for the first time.

[0050] Specifically, establish a process id information list, and for the process added to the list for the first time, call the ptracePTRACE_SETOPTIONS instruction: set the PTRACE_O_TRACESYSGOOD and PTRACE_O_TRACECLONE options, where PTRACE_O_TRACESYSGOOD means that when the "traced" process passes a system call signal, the signal value binary bit7 (starting from 0) is set to 1, so that we can easily determine whether the message passed by the process is the system call message we need: signal&0x80 != 0; PTRACE_O_TRACECLONE means that the traced process automatically tracks its child process when creating a new child process (using the clone system call).

[0051] S1012: Wait for the traced process to enter the STOP state, and determine whether the STOP state is entered due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information.

[0052] Specifically, if it is not a system call, PTRACE_CONT is called to allow the STOPped process to continue running.

[0053] In some implementations, the system function wait is called to wait for the process being tracked. When the process being tracked (Android compatibility layer main process) transmits a signal, it enters the STOP state and receives the STOP signal. Then, based on whether the binary bit7 of the signal value is set to 1, it is determined whether the process being tracked enters the STOP state due to a system call. If it is a system call, PTRACE_GETREGSET is called to obtain direct parameter information and PTRACE_PEEKDATA is called to obtain pointer parameter information. Otherwise, PTRACE_CONT of ptrace is called to allow the stopped process to continue running.

[0054] S1013: Based on the obtained direct parameter information and pointer parameter information, determine whether to allow the file to be read outward. If the file is not allowed to be read outward, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block the file from being read outward.

[0055] Specifically, when executing step S1013, if the file is not allowed to be read outward, the offset of the file path pointer is modified to make it offset to the terminator at the end of the path, and PTRACE_SETREGSET is called to make the modification effective.

[0056] In some implementations, the system call open and openat prototypes:

[0057] int open(const char *pathname, int flags, int mode)

[0058] int open(int dirfd, const char *pathname, int flags, int mode)

[0059] Among them, pathname is the address of the string that stores the corresponding file path address, such as " / home / zf / test.doc". The string is in C language style, so there is '\0' at the end of / home / zf / test.doc. By modifying the offset of the pathname pointer, it points to the '\0' at the end. For example, in this example, pathname needs to be offset by 17 bytes. Through this modification method, when going to 9) to execute, the open call parameters of the tracked process are modified: from the original open(" / home / zf / test.doc", flags, mode) to open("\0", flags, mode), thereby blocking the outbound reading.

[0060] In some implementations, the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA are used to "trace and debug" the Android emulator framework programs ( / usr / bin / uengine, / usr / bin / kmre, / usr / bin / Kbox, and / system / bin / sdcard) under various domestic systems (Tongxin UOS, Kylin, etc.), thereby auditing and controlling the behavior of sending and receiving files by Android emulator programs such as QQ, WeChat, and mailboxes, see Figure 2As shown, a detailed implementation flow chart of a method for controlling outbound behavior of an Android program provided by an embodiment of the present invention includes the following execution steps:

[0061] 1) Regularly traverse the system / proc directory to obtain the final point of the / proc / {pid} / exe symbolic link file. If it is the andorid simulator program path (uengine, kmre, Kbox, sdcard), traverse the / proc / {pid} / task directory under its path to obtain the id of its child thread, and finally get a list of process ids;

[0062] 2) Traverse the process ID list obtained in 1) and execute the PTRACE_ATTACH instruction of ptrace for each process. By "tracing and debugging" the above processes, obtain the control rights when calling the system API;

[0063] 3) Create a process ID information list. For the process added to the list for the first time, call the ptrace PTRACE_SETOPTIONS instruction: set the PTRACE_O_TRACESYSGOOD and PTRACE_O_TRACECLONE options. PTRACE_O_TRACESYSGOOD means that when the "traced" process passes a system call signal, the bit 7 (starting from 0) of the signal value binary is set to 1. This makes it easy to determine whether the message passed by the process is the required system call message: signal&0x80 != 0; PTRACE_O_TRACECLONE means that the traced process automatically traces its child process when creating a new child process (using the clone system call);

[0064] 4) Call the system function wait to wait for the process being tracked. When the process being tracked (main process of the Android compatibility layer) transmits a signal, it will enter the STOP state and receive the STOP signal. Then, based on whether the signal value binary bit7 is set to 1, it is determined whether the process being tracked enters the STOP state due to a system call. If it is a system call, go to 5), otherwise call PTRACE_CONT of ptrace to make the stopped process continue to run;

[0065] 5) Call PTRACE_GETREGSET of ptrace to obtain the general register corresponding to the current system call of the traced process, obtain the system call number from the general register, and filter out the system calls related to file reading and outbound transmission according to the Linux system call number definition: SYS_open and SYS_openat, and call PTRACE_PEEKDATA to obtain the pointer parameter information;

[0066] 6) According to the information of the general register, obtain the parameter information of the current open function call, so as to obtain the path and opening permission (read-only, read-write, write-only, etc.) of the open file;

[0067] 7) Package the pid, user, current time, file path, permissions and other information of the tracked process, and pass them to the product business module of the module service, waiting for the judgment and processing of the product business module to determine whether the file is allowed to be read and sent out: if allowed, go to 9), if not allowed, go to 8);

[0068] 8) Offset the file path pointer to the '\0' at the end of the path, and call PTRACE_SETREGSET to make the modification effective, in order to block the system call, thereby blocking the Android program from reading outbound calls;

[0069] 9) Call PTRACE_SYSCALL of ptrace to make the traced process continue to execute normal logic;

[0070] 10) Go to 4) and continue waiting for the next system call process of the tracked process.

[0071] This application uses the Linux user-level ptrace function to track and debug processes, and audits and controls the process of reading and sending Android version programs (such as QQ, WeChat, etc.), thereby realizing the function of controlling the outbound sending of Android version programs, and avoiding the problem that the kernel-level hook solution has poor system compatibility and the user-level preload hook solution cannot control the Android version of the application.

[0072] See also Figure 3 As shown, it is a structural diagram of a management system for outbound behavior of an Android program provided by an embodiment of the present invention, including:

[0073] The traversal module 30 is used to traverse the system / proc directory and identify the process ID list of the Android program;

[0074] The control module 31 is used to use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET and PTRACE_PEEKDATA to trace and debug each process in the process ID list, so as to control the behavior of sending and receiving files of the Android program.

[0075] In some implementations, the control module 31 is specifically used to:

[0076] Execute the PTRACE_ATTACH instruction for each process in the process ID list for tracing debugging;

[0077] Set the tracing options to capture system calls and trace child processes, where the PTRACE_SETOPTIONS instruction is called for the process that is first added to the list;

[0078] Wait for the traced process to enter the STOP state, and determine whether it enters the STOP state due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information;

[0079] Based on the direct parameter information and pointer parameter information obtained, determine whether to allow outbound file reading. If outbound file reading is not allowed, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block outbound file reading.

[0080] In some implementations, the control module 31 is specifically used for: if outbound reading of files is not allowed, modifying the offset of the file path pointer to make it offset to the terminator at the end of the path, and calling PTRACE_SETREGSET to make the modification effective.

[0081] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for controlling the outbound behavior of an Android program as described in any one of the above embodiments are implemented.

[0082] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for controlling the outbound behavior of an Android program as described in any of the above embodiments.

[0083] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0084] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0085] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0086] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0087] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0088] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0089] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0090] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0091] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for controlling outbound behavior of an Android program, characterized in that: include: Traverse the system / proc directory and identify the process ID list of Android programs; Use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list to control the behavior of sending and receiving files in Android programs. Among them, the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA are used for each process in the process ID list to track and debug, so as to control the behavior of sending and receiving files of Android programs, including: Execute the PTRACE_ATTACH instruction for each process in the process ID list for tracing debugging; Set the tracing options to capture system calls and trace child processes, where the PTRACE_SETOPTIONS instruction is called for the process that is first added to the list; Wait for the traced process to enter the STOP state, and determine whether it enters the STOP state due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information; Based on the direct parameter information and pointer parameter information obtained, determine whether to allow the file to be read outward. If the file is not allowed to be read outward, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block the file from being read outward. Based on the direct parameter information and pointer parameter information obtained, it is determined whether to allow the file to be read outward. If the file is not allowed to be read outward, the system call parameters are modified and PTRACE_SETREGSET is called to make the modification effective to block the file from being read outward, including: If outbound file reading is not allowed, modify the offset of the file path pointer to offset it to the terminator at the end of the path, and call PTRACE_SETREGSET to make the modification effective.

2. The method for controlling the outbound behavior of Android programs according to claim 1, characterized in that: Traverse the system / proc directory and identify the process ID list of Android programs, including: Traverse the system / proc directory and obtain the final pointer of the / proc / {pid} / exe symbolic link file. If it is the andorid program path, traverse the / proc / {pid} / task directory under its path and obtain the ID of its child thread, and finally get a list of process IDs.

3. The method for controlling the outbound behavior of Android programs according to claim 1, characterized in that: If it is not a system call, call PTRACE_CONT to make the STOPped process continue running.

4. A system for controlling outbound behavior of an Android program applied to the method for controlling outbound behavior of an Android program according to any one of claims 1 to 3, characterized in that: include: The traversal module is used to traverse the system / proc directory and identify the process ID list of Android programs; The control module is used to use the ptrace instruction PTRACE_ATTACH, PTRACE_GETREGSET, PTRACE_SETREGSET, and PTRACE_PEEKDATA to trace and debug each process in the process ID list, so as to control the behavior of sending and receiving files of Android programs; The control module is specifically used for: Execute the PTRACE_ATTACH instruction for each process in the process ID list for tracing debugging; Set the tracing options to capture system calls and trace child processes, where the PTRACE_SETOPTIONS instruction is called for the process that is first added to the list; Wait for the traced process to enter the STOP state, and determine whether it enters the STOP state due to a system call based on the signal value. If it is a system call, call PTRACE_GETREGSET to obtain direct parameter information and call PTRACE_PEEKDATA to obtain pointer parameter information; Based on the direct parameter information and pointer parameter information obtained, determine whether to allow outbound file reading. If outbound file reading is not allowed, modify the system call parameters and call PTRACE_SETREGSET to make the modification effective to block outbound file reading.

5. The control system for outbound Android program behavior according to claim 4, characterized in that: The control module is specifically used for: If outbound file reading is not allowed, modify the offset of the file path pointer to offset it to the terminator at the end of the path, and call PTRACE_SETREGSET to make the modification effective.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method for controlling the outbound behavior of an Android program as described in any one of claims 1-3 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the method for controlling the outbound behavior of an Android program as described in any one of claims 1 to 3 are implemented.

Images