Static injection method and storage medium

Abstract

The embodiment of the invention relates to the technical field of MacOS injection, and discloses a static injection method and a storage medium. The method comprises the following steps: inserting a blank character in a loading command area of an executable file, and writing a first target loading command at the position of the blank character; a second target loading command in the loading command area is processed, so that a non-first loading command in the loading command area is shortened by a target length, position information, corresponding to the loading command, of the loading command area is adjusted according to processing of a second target recorded command, and the position information comprises the size of a virtual memory, the address of the virtual memory and a file deviation value; the executable file keeps normal operation after being processed by the second target loading command, and the target length is not smaller than the length of the blank character. The problem that the reserved space is not enough to insert the loading command of the injection library is solved, the static injection process can be simplified, the implementation difficulty of the static injection is reduced, and successful implementation of the static injection is guaranteed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of MacOS injection technology, and in particular to a static injection method and storage medium. Background Art

[0002] In order to better meet user needs using the MacOS system, it is sometimes necessary to modify or extend the existing program behavior. Static injection is a typical implementation method that can be used to modify or extend the existing program behavior, and it has been widely used. Among them, static injection is usually implemented by modifying the executable file (Mach-o file) corresponding to the target application process. Specifically, a load command (LC) entry of type LC_LOAD_DYLIB for loading the injection library is added to the load command area in the executable file.

[0003] However, static injection is not always successful in practice, and errors often occur during the loading and running of executable files. Summary of the invention

[0004] The embodiments of the present application provide a static injection method and storage medium, which at least help to reduce or avoid errors in the loading and running process of executable files and improve the success rate of static injection.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a static injection method, comprising: reducing the space occupied by a first target load command in a load command area of ​​an executable file by a target length, wherein the reduction of the space occupied by the first target load command does not affect the normal loading of the executable file; inserting blank characters in the load command area, wherein the target length is equal to the length of the blank characters; writing a second target load command in the blank characters, wherein the second target load command is used to load an injection library; and adjusting the location information of the corresponding load command according to the reduction of the space occupied by the first target load command, wherein the location information includes the virtual memory size, the virtual memory address, and the file offset value.

[0006] In some embodiments, after adjusting the location information of the corresponding load command according to the reduction of the space occupied by the first target load command, the method further includes: in the data area of ​​the executable file, moving the data section pointed to by the load command with a type value of 0x33 from the current file location to another file location and modifying the load command with a type value of 0x33 to point to the other file location after the move.

[0007] In some embodiments, the another file position is located after the positions of all other data sections in the data area.

[0008] In some embodiments, the first target load command comprises a load command with a type value of 0x19 and a name of __PAGEZERO.

[0009] In some embodiments, inserting a blank character into a load command area of ​​an executable file comprises: inserting the blank character after all load commands in the load command area.

[0010] In some embodiments, reducing the space occupied by the first target load command in the load command area of ​​the executable file by a target length includes: shortening the target length of the load command whose type value is 0x19 and whose name is __PAGEZERO; adjusting the position information of the corresponding load command according to the reduction of the space occupied by the first target load command includes: subtracting the target length from the virtual memory size of the load command whose type value is 0x19 and whose name is __PAGEZERO; subtracting the target length and the file offset value from the virtual memory address of the load command whose type value is 0x19 and whose name is not __PAGEZERO, and increasing the target length; and increasing the file offset value of the load command whose type value is not 0x19 by the target length.

[0011] In some embodiments, writing the second target load command in the blank character includes: writing the second target load command in the blank character and the reserved space of the load command area when the blank character and the reserved space are continuously distributed.

[0012] In some embodiments, reducing the space occupied by the first target load commands in the load command area of ​​the executable file by the target length includes: shortening at least one of the first target load commands, and / or deleting at least one of the first target load commands to reduce the space occupied by all the first target load commands by the target length.

[0013] According to some embodiments of the present application, a second aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the static injection method as described in any one of the first aspects is implemented.

[0014] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, wherein the computer program is an executable file obtained after static injection, wherein the executable file before static injection and the executable file after static injection have a loading command area with the same virtual memory size.

[0015] In some embodiments, in the executable file before static injection and the executable file after static injection, the file location pointed to by the data section pointed to by the load command with a type value of 0x33 is different.

[0016] In some embodiments, in the executable file after static injection, the data section pointed to by the load command with a type value of 0x33 is located after the positions of all other data sections in the data area of ​​the executable file.

[0017] In some embodiments, in the executable file before static injection and the executable file after static injection, the virtual memory size of the load command with a type value of 0x19 and a name of __PAGEZERO is different.

[0018] In some embodiments, relative to the executable file before static injection, in the executable file after static injection, the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO reduces the target length, the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO reduces the target length, the file offset value increases the target length, and the file offset value of the load command with a type value other than 0x19 increases the target length; wherein, the target length is not less than the length of the load command of the newly added injection library during the static injection process, and the target length is N*4K, where N is a positive integer.

[0019] In some embodiments, in the executable file after static injection, the tail of the load command area is a blank character.

[0020] The technical solution provided in the embodiments of the present application has at least the following advantages:

[0021] Since the space occupied by the first target load command in the load command area is reduced by the target length without affecting the normal loading of the executable file, and the target length is equal to the length of the blank character to be inserted in the load command area, it is realized that the space for inserting enough blank characters is provided by shortening the target length without affecting the normal loading of the executable file, so as to write the second target load command for loading the injection library. At the same time, the shortened length of the first target load command is equal to the length of the newly inserted blank character, so the space occupied by the load command area as a whole remains unchanged before and after the injection, and the file position of the data area does not need to change, and there is no need to modify the reference address information in the data area to adapt to the file position change of the data area. It is only necessary to adjust the position information including the virtual memory size, virtual memory address, and file offset value of the corresponding load command in the load command area, so that the normal loading and running of the executable file can be guaranteed, and the information required to be adjusted during static injection is reduced, which is conducive to reducing or avoiding errors in the loading and running process of the executable file, simplifying the processing of static injection, reducing the difficulty of implementing static injection, and improving the success rate of static injection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0023] Figure 1 It is a schematic diagram of the structure of an existing executable file;

[0024] Figure 2 This is a schematic diagram of the structure of the __TEXT segment of an existing executable file;

[0025] Figure 3 This is the process of the static injection method provided in the embodiment of the present application Figure 1 ;

[0026] Figure 4 This is the process of the static injection method provided in the embodiment of the present application Figure 2 ;

[0027] Figure 5 This is the process of the static injection method provided in the embodiment of the present application Figure 3 ;

[0028] Figure 6 This is the process of the static injection method provided in the embodiment of the present application Figure 4 ;

[0029] Figure 7 This is the process of the static injection method provided in the embodiment of the present application Figure 5 ;

[0030] Figure 8 This application Figure 7 A structural comparison diagram of the data area of ​​an executable file before and after the static injection method provided in the illustrated embodiment is implemented;

[0031] Fig. 9 This is a structural comparison diagram of the executable file before and after the implementation of the existing static injection solution;

[0032] Fig.10 It is a structural comparison diagram of the executable file before and after the static injection method provided in the embodiment of the present application is implemented;

[0033] Fig.11 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] As known from the background technology, static injection is not always successfully implemented when applied, and errors often occur during the loading and running of executable files.

[0035] After analysis, at least one aspect of the above problem is caused by: when static injection is performed, the reserved space in the load command area (generally blank padding generated for alignment during compilation) may not be enough to insert the load command for loading the injection library. At this time, either a dynamic injection solution is considered, or the data area is moved backward to leave enough space in front of the data area for the load command for static injection. Among them, in the second method, since the data area is moved backward, the position of each data segment in the data area will change. In order to adapt to this change, a large number of modifications need to be made to the executable file. The content that needs to be modified is numerous, and the injection process is cumbersome to implement. Once the modification is not thorough or the modification is wrong, it will cause errors in the loading and running of the executable file. The specific analysis is as follows:

[0036] The structure of an executable file (Mach-O file) is usually as follows Figure 1As shown, it includes three parts: Header, Load commands area and Data area. Among them, the header mainly describes: the architecture of the current executable file, whether it is a Fat binary file, the type of central processing unit (CPU), etc. The load command area mainly describes: 1. How the space in the executable file is allocated in the virtual memory, from which memory address to which memory address; 2. The location and size distribution of different segments (Segment) in the executable file; 3. Each load command has its type value and name. Some types of load commands may contain multiple sub-segments, such as: load commands with a type value of 0x19, etc. The data area mainly describes: how the memory is allocated, such as the __TEXT segment, __DATA segment, etc. Among them, take the __TEXT segment as an example: the __TEXT segment contains the actual code and read-only data of the executable program, and its interior will be roughly as follows Figure 2 As shown, it includes multiple sections, such as the __text section: stores the actual machine code of the program, which is the main part of the executable code; the __cstring section: stores constant strings in the program, such as string constants in the C language; the __const subsection: stores read-only data, such as const variables in the C language; the __unwind_info section: stores information used for exception handling (such as C++ exceptions) and program call stack expansion; the __stubs section: stores stub code for external function calls; the __stub_helper section: stores auxiliary information for external function calls.

[0037] Based on the above structure, the loading process of the executable file is roughly as follows:

[0038] 1. Parsing the executable file header: First, the loader reads the executable file header and parses the load command information contained therein, including key information such as virtual memory address (VM Address), file offset value (file offset) and virtual memory size (file size). This information describes the virtual memory address, file offset and size of each segment in the file, which will affect the layout and location of the program in memory.

[0039] 2. Memory allocation: Based on the virtual memory address and size information in the load command, the loader allocates virtual memory space for each segment of the executable file. This includes the code segment, data segment, stack, etc. At the same time, the loader also allocates space in memory for these segments to store the data read from the file.

[0040] File mapping: The loader maps the data of each segment described in the executable file from the disk to the corresponding location in the memory according to the file offset value and virtual memory size information in the load command. This process may involve virtual memory paging and file mapping operations.

[0041] 3. Relocation: Once the various segments of the program are mapped to the specified virtual memory addresses, the loader will perform the necessary relocation operations to ensure that the pointers and jump targets in the program correctly point to the corresponding memory locations.

[0042] 4. Permission setting: Based on the information in the loading command, the loader will set the permissions for the corresponding memory area, including readable, writable, and executable permissions.

[0043] 5. Initialization: The loader will execute the program's initialization code, initialize global variables, and prepare to execute the program's entry function.

[0044] From the above loading process, we can know that the information in the fields such as virtual memory address, file offset value and size in the load command is very important. They specify the layout and position of the program (which can be understood as Mach-o file, or executable file) in the virtual memory, as well as the position and size of the data pointed to by each load command in the executable file. Based on this information, the loader maps each part of the program to the specified memory virtual address, and finds the correct position in the file according to the file offset value to map the data to the virtual address, thereby ensuring that the program can be executed correctly in memory.

[0045] Taking the aforementioned __TEXT segment as an example, it usually contains references to segments loaded into memory, such as function calls, global variable access, etc. If there is a problem with the setting of these mutually referenced virtual memory addresses, the program may not be able to access the data correctly at runtime, resulting in runtime errors in the program. Specifically, when the __TEXT segment references the addresses of other segments, these references will appear in the code or instructions of the __TEXT segment in some form, which may be function calls, or global variable access, etc. When loading an executable file, the loader will map the __TEXT segment to the corresponding location in memory based on the virtual memory address of the __TEXT segment. At the same time, the loader will also map these segments to the corresponding virtual memory addresses based on the virtual memory addresses of other segments. Therefore, the address references of the __TEXT segment to other segments are closely related to the virtual memory address, and the loader needs to ensure that the address references in the __TEXT segment match the actual locations of other segments in memory.

[0046] However, the key information such as the virtual memory address, file offset value and size carried by each segment in the executable file has been determined when the program is compiled and linked, and the program linker will write the mutual reference addresses between these segments into the executable file according to the virtual memory addresses of each segment for use in runtime mapping when the program is loaded.

[0047] When the reserved space is not enough to accommodate the new load command, the data area is moved back and blank characters are inserted in the load command area to store the injected load command, which will cause the Mach header load command area to become larger. After the Mach-o file is loaded into the memory, the data area behind the Mach header load command area will also move back. The original addresses referenced by each sub-segment in the __TEXT load command area are the addresses before the blank characters are inserted. Therefore, the addresses referenced by each other after the executable file is loaded into the memory are also the addresses mapped before the blank characters are inserted. After the blank characters are artificially inserted, the mutual references of these addresses will not match the actual positions, causing program errors, crashes and other problems.

[0048] At present, the common practice is to adjust the values ​​of fields such as the virtual memory address and file offset value in each load command after inserting blank characters, and add the number of inserted blank characters (such as blank characters with a length of 4K) to it, so that after the artificial insertion of blank characters, the addresses of the sub-segments in each load command will reference each other and match the actual position. However, this practice is equivalent to changing the virtual memory address generated by the linker and the mutual reference addresses between the sub-segments of each load command generated according to the address. Therefore, this practice requires traversing the entire executable file and adjusting the address references related to the virtual memory address in all sub-segments of all load command areas. The workload is relatively large (equivalent to doing the work of the program linker), and secondly, if the modification coverage is incomplete, it will cause the injected program to be abnormal or even crash directly.

[0049] In order to solve the above technical problems, a static injection method and storage medium are provided in an embodiment of the present application, which releases a part of the space occupied by the original load command in the load command area to write the load command of the injection library. In this way, even if the reserved space is insufficient, the load command of the injection library can still be accommodated, thereby ensuring the successful implementation of the injection. At the same time, since the storage space of the original load command is released, and the released space is the same as the space occupied by the inserted blank character, after the blank character is inserted, the load command of the injection library written by the blank character will not cause the length of the load command area to change. The program loader allocates virtual memory space for each segment of the executable file according to the virtual memory address and file offset information in the load command and maps the data of each segment from the disk to the virtual memory so that the position is consistent with that before the blank character is inserted. There is no need to adjust the address reference related to the virtual memory address, and the mutual reference of these addresses is not affected to ensure that the injected program can run normally and stably, reducing the information that needs to be modified, reducing the pressure of adjustment, and making it less likely to have loading errors.

[0050] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0051] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0052] The present application provides a static injection method for any electronic device based on the Mach core, such as a mobile phone based on the iOS operating system, a notebook based on the MacOS operating system, etc. In some embodiments, the process of the static injection method is as follows: Figure 3 As shown, the following steps are included:

[0053] Step 100: Reduce the space occupied by the first target load command in the load command area of ​​the executable file by a target length, wherein the reduction of the space occupied by the first target load command does not affect the normal loading of the executable file.

[0054] Step 200, inserting a blank character in the load command area, wherein the target length is equal to the length of the blank character.

[0055] Step 300: Write a second target load command in a blank character, wherein the second target load command is used to load the injection library.

[0056] Step 400, according to the reduction of the space occupied by the first target load command, adjust the position information of the corresponding load command, wherein the position information includes the virtual memory size, the virtual memory address, and the file offset value.

[0057] In this way, since the space occupied by the first target load command in the load command area is reduced by the target length without affecting the normal loading of the executable file, and the target length is equal to the length of the blank character to be inserted in the load command area, it is realized that the space for inserting enough blank characters is provided by the shortened target length without affecting the normal loading of the executable file, so as to write the second target load command for loading the injection library. At the same time, the shortened length of the first target load command is equal to the length of the newly inserted blank character, so that the space occupied by the load command area as a whole remains unchanged before and after the injection, and the file position of the data area does not need to change, and there is no need to modify the reference address information in the data area to adapt to the file position change of the data area. It is only necessary to adjust the position information including the virtual memory size, virtual memory address, and file offset value of the corresponding load command in the load command area, so that the normal loading and running of the executable file can be guaranteed, and the information required to be adjusted during static injection is reduced, which is conducive to reducing or avoiding errors in the loading and running process of the executable file, simplifying the processing of static injection, reducing the difficulty of implementing static injection, and improving the success rate of static injection.

[0058] In order to facilitate those skilled in the art to better understand the above embodiments, they will be explained below.

[0059] In step 100, the first target load command is a load command in which any originally occupied space in the load command area is reduced without affecting the normal loading of the executable file, wherein there may be only one load command belonging to the first target load command, or there may be multiple load commands belonging to the first target load command. This is not limited in the embodiment of the present application, and the specific load command used as the first target load command is not limited in the embodiment of the present application, and can be flexibly set according to needs.

[0060] For example, in some embodiments, the first target load command includes a load command with a type value of 0x19 and a name of __PAGEZERO, wherein, since the load command with a type value of 0x19 and a name of __PAGEZERO is used to define the starting position and size of the first memory page in the virtual memory space of the process, after it is used as the first target load command, even if the recording command is processed, it will not affect the original function of the executable file. That is to say, with the load command with a type value of 0x19 and a name of __PAGEZERO as the first target load command, after the storage space is reduced, the executable file can not only maintain normal loading, but also maintain its functionality intact.

[0061] For example, in some embodiments, the first target loading command also includes several loading commands whose calling frequency of the process corresponding to the executable file is very low and which do not affect the process to implement the corresponding function.

[0062] Of course, the above is only an example of the first target load command. In other embodiments, other load commands may be used as the first target load command, which will not be listed here one by one.

[0063] In step 100, the specific length of the target length is not limited. It is understandable that since there is reserved space in the load command area that can be used to write the load command, and it is not required that all the space released by the target length be occupied, the setting of the target length is relatively flexible.

[0064] For example, in some embodiments, the target length can be determined as the length of the second target load command for loading the injection library plus the blank area that needs to be added for alignment. In this way, the target length is sufficient to write the second target load command for loading the injection library without occupying the reserved space, so the reserved space is retained, so that sufficient resources can be reserved for other requirements in the future, avoiding the problem of insufficient space support when the executable file needs to be further expanded.

[0065] For example, in some embodiments, the target length can be determined as the length of the second target load command for loading the injection library minus the length of the reserved space plus the blank area that needs to be added for alignment, so that the space occupied by the first target load command needs to be reduced by a smaller length, and the impact on the original load command in the load command area will be reduced to a relatively small length. It should be noted that at this time, the blank area needs to be inserted into a position that is continuously distributed with the reserved space, otherwise, the second target load command for loading the injection library will not have enough space to write.

[0066] For another example, in some embodiments, the target length may be the length of one or more first target load commands, and the length of one or more first target load commands plus the size of the reserved space is greater than the length of the second target load command used to load the injection library. In other words, the target length is characterized as the number of first target load commands, and a single first target load command is directly deleted to free up space, without calculating the specific value of the target length, and without adaptively adjusting the first target load command to meet the requirements, so that the implementation is more concise, more efficient, and less difficult.

[0067] It can be seen that the reduction of the occupied space can be achieved by shortening the first target load command or deleting the first target load command. That is, in some embodiments, reducing the space occupied by the first target load command in the load command area of ​​the executable file by the target length can be achieved by shortening at least one first target load command and / or deleting at least one first target load command to reduce the space occupied by all first target load commands by the target length. In this embodiment, the number of deleted or shortened first target load commands is not limited.

[0068] Of course, the above is only an exemplary description of reducing the space occupied by the first target load command. In other embodiments, other methods may be used to achieve this, which will not be listed here one by one.

[0069] It should also be noted that, as mentioned above, for alignment purposes, the target length is usually an integer multiple of 4K (generally speaking, inserting 4K of blank characters is sufficient and no more is needed. Of course, if there are specific requirements, it is also possible to specify inserting 8K, 12K, etc. of blank characters).

[0070] To help those skilled in the art better understand the implementation of step 100, an example is given below.

[0071] In some embodiments, Figure 4 As shown, reducing the space occupied by the first target load command in the load command area of ​​the executable file by the target length can be achieved by the following steps:

[0072] Step 101, shorten the target length of the load command with the type value of 0x19 and the name of __PAGEZERO.

[0073] Among them, the contents of the load commands with type value 0x19 and name __PAGEZERO are all "0", so the target length is shortened, that is, the "0" of the target length is deleted, which will not be repeated here.

[0074] Of course, the above embodiments should not constitute a limitation on the embodiments of the present application. For example, the length of the load command with a type value of 0x19 and a name of __PAGEZERO is shortened to the first target length, and another load command is deleted. The length of the deleted load command is the second target length, wherein the first target length + the second target length = the target length, etc., which will not be elaborated here.

[0075] In step 200, the insertion position of the blank character is not limited. It can be understood that the position of the load command in the load command area is allowed to be moved. Therefore, the insertion position of the blank character can be flexibly set according to requirements.

[0076] For example, in some embodiments, it may be desirable to minimize the impact on the original load commands in the load command area. In this case, the command is inserted after the maximum reserved space of the continuous distribution to fully utilize the reserved space and reduce the adjustments required for the original load commands in the load command area.

[0077] For example, in some embodiments, the command is inserted after all the load commands, so that the relative position of the original load commands in the load command area will remain unchanged, avoiding the destruction of the associated characteristics of the original load commands in the load command area and reducing the impact on the original load commands in the load command area.

[0078] For example, in some embodiments, the command is inserted after the first target load command. In this way, the position of the original load command in the load command area after all the first target load commands will remain unchanged, that is, the number of load commands that need to adjust the position information is reduced, thereby further reducing the complexity of static injection and reducing the difficulty of implementing static injection.

[0079] Of course, the above is only an exemplary description of the blank character insertion position. In other embodiments, other insertion positions may be used, which will not be described in detail here.

[0080] It should be noted that the length of the blank character needs to be equal to the target length, that is, the storage space that is released in step 100 is equal to the storage space that the blank character needs to occupy. It is understandable that if the length of the blank character is greater than the target length, then in order to insert the blank character, the data area after the load command area needs to be moved backward to provide enough space to insert the blank character; if the length of the blank character is less than the target length, then the length of the load command area will become smaller, and the data area after the load command area needs to be moved forward (the data area is not migrated, and the essence is to continue to insert some blank characters in the data area, and the inserted blank characters will be consistent with the target length at this time). Both of the above situations will cause the position of the data area in the file to change, so both need to adjust the reference address in the data area, otherwise the loading operation error will be caused due to incorrect reference address. In other words, the length of the blank character is equal to the target length, so that the size of the load command area remains unchanged, so the position of the data area will also remain unchanged, and there is no need to adjust the reference address in the data area, which reduces the content that needs to be modified during the static injection process and reduces the complexity and difficulty of static injection.

[0081] In order to help those skilled in the art better understand step 200, an example will be given below.

[0082] In some embodiments, Figure 5 As shown, inserting blank characters in the load command area can be achieved in the following ways:

[0083] Step 201, inserting a blank character after all load commands in a load command area, wherein a target length is equal to a length of the blank character.

[0084] In this way, a blank character is inserted at the end of the load command area to avoid affecting other load commands.

[0085] Of course, the above embodiments should not constitute a limitation on the embodiments of the present application. As mentioned above, blank characters can also be inserted at other positions, which will not be described in detail here.

[0086] In step 300, as described above, the space occupied when writing the second target load command for loading the injection library may only come from the reduced target length of the first target load command, or may come from the reduced target length of the first target load command and the reserved space, etc. Therefore, the method of writing the second target load command in blank characters will also have different adaptability.

[0087] For example, in some embodiments, writing the second target load command in a blank character can be achieved in the following manner: writing the complete second target load command in a blank character. Wherein, the length of the blank character is greater than the length of the second target load command. Furthermore, considering that the length of the aforementioned blank character may not be exactly the length of the second target load command, the starting position of the second target load command in the blank character can also be flexibly set to a certain extent, such as writing the second target load command from the first character position of the blank character, or writing the second target load command from the preset position of the blank character, etc., which is not specifically limited in this embodiment. In this way, the occupation of the reserved space is avoided, so that other functions can still be provided through the reserved space in the future.

[0088] For example, in some embodiments, the second target load command can be written in a blank character by the following method: when the blank character and the reserved space of the load command area are continuously distributed, the second target load command is written in the blank character and the reserved space. That is to say, a part of the second target load command for loading the injection library is written in the blank character, and a part is written in the reserved space, so that the complete second target load command for loading the injection library is written in the load command area. In this way, the reserved space can be fully utilized, the pressure of reducing the space occupied by the first target load command is reduced, and the impact on the first target load command is reduced.

[0089] Of course, the above is only an exemplary description of the writing method of the second target load command for loading the injection library. In other embodiments, other methods can be used to implement it, which will not be listed here one by one.

[0090] In order to help those skilled in the art better understand the above step 300, an example will be given below to illustrate it.

[0091] In some embodiments, writing the second target load command in a blank character may be implemented in the following manner: writing a load command entry of type LC_LOAD_DYLIB for loading the injection library starting from the first position of the blank character.

[0092] Of course, the above embodiments should not constitute a limitation on the embodiments of the present application. As mentioned above, the load command for loading the injection library can also be written in other ways, which will not be described in detail here.

[0093] In step 400, the specific adjustment method of the load command is not limited. It can be understood that, as mentioned above, there are many possible ways to reduce the space occupied by the first target load command, and there are also many possible ways to insert blank characters. Therefore, after steps 100 and 200, the actual distribution of each load command in the load command area in the file will be different, and whether each load command needs to be adjusted, the specific parameters that need to be adjusted, and the specific values ​​of each parameter that need to be adjusted will all be different. For specific situations, please refer to the description document of the load command related to the Mach-o file.

[0094] In order to help those skilled in the art better understand step 400, an example will be given below to illustrate it.

[0095] In some embodiments, it is assumed that reducing the space occupied by the first target load command in the load command area of ​​the executable file by the target length is achieved by shortening the target length of the load command with a type value of 0x19 and a name of __PAGEZERO. Inserting blank characters in the load command area is achieved by inserting blank characters after all load commands in the load command area. In this case, Figure 6 As shown, according to the reduction of the space occupied by the first target load command, the position information of the corresponding load command is adjusted, which can be achieved in the following way:

[0096] Step 401, subtract the target length from the virtual memory size of the load command with the type value of 0x19 and the name of __PAGEZERO.

[0097] Step 402, subtract the target length and the file offset value from the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO and add the target length.

[0098] Step 403, increase the file offset value of the load command whose type value is not 0x19 by the target length.

[0099] In this way, by providing corresponding accurate adjustments for various types and names of loading commands, the position information of the adjusted loading commands accurately matches the actual position, so that after the executable file is loaded, there will be no loading and running abnormalities caused by position errors.

[0100] Of course, the above is only an exemplary explanation of the adjustment of the position information of the load command. In other embodiments, other methods can be used to implement it. For example, when the load command with a type value of 0x19 and a name of __PAGEZERO is shortened to a target length and the insertion position of the blank character is after the load command with a type value of 0x19, the object that needs to be adjusted is mainly: the load command with a type value of 0x19, and other load commands are not involved, so they will not be described one by one here.

[0101] On the basis of the above embodiments, it can also be understood that, as shown in the above example, when the location information of the load command is adaptively adjusted, the specific parameters of the location information will be changed. At this time, for the load command with a type value of 0x33, since the data section of the data area pointed to by the load command stores the symbol information exported by the dynamic linker, this information is organized in the form of a prefix tree. Among them, each node of the prefix tree represents a character. Starting from the root node, a symbol name can be uniquely determined through different paths. The address information corresponding to the symbol name is stored in the leaf node, and the address is also referenced in a similar way using the file offset value. Therefore, it is necessary to traverse each leaf node in the prefix tree and add its file offset value to the number of blank characters filled. This adjustment will bring another problem. After adding the blank character value, the data value will become larger, and the area where the original executable file stores this prefix tree may not be able to accommodate it. In order to solve this problem, in some embodiments, such as Figure 7 As shown, after adjusting the position information of the corresponding load command according to the reduction of the space occupied by the first target load command, the following steps are also included:

[0102] Step 500, in the data area of ​​the executable file, move the data section pointed to by the load command with the type value of 0x33 from the current file location to another file location and modify the load command with the type value of 0x33 to point to the moved another file location.

[0103] In this way, by modifying the storage location of the data pointed to by the load command with the type value of 0x33, the data pointed to by the load command with the type value of 0x33 can be fully accommodated. Figure 8 As shown, Figure 8 The left side is a schematic diagram of the structure of the data area before the data storage location is modified with a load command of type value 0x33. Figure 8 The right side is a schematic diagram of the structure of the data area before the data storage location is modified, with the type value being 0x33.

[0104] It should be noted that the above embodiment does not specifically limit the other file location to which the data segment pointed to by the load command with a type value of 0x33 is moved.

[0105] For example, in some embodiments, the other file location is located after the locations of all other data sections in the data area. In this way, the locations of other data segments can remain unchanged, and the characteristics of the data segment pointed to by the load command with a type value of 0x33 determine that there will be no mutual reference between it and other data segments, so there is no need to modify the reference address in other data segments, avoiding modification of the data segments, simplifying the implementation of static injection, and reducing the difficulty of static injection.

[0106] For example, in some embodiments, another file position includes the position of the data segment pointed to by the load command with the type value of 0x33. Specifically, the starting position of the data segment pointed to by the load command with the type value of 0x33 remains unchanged, and the subsequent data segments are moved backward, thereby releasing enough storage space to accommodate data for the data segment pointed to by the load command with the type value of 0x33. In this way, the relative order between different data segments pointed to by load commands with different type values ​​does not change, avoiding affecting the relevance between data of different files.

[0107] Of course, the above is only an exemplary description of the moving method of the data segment pointed to by the load command with the type value of 0x33. In some embodiments, it can also be implemented by other methods, which will not be described here one by one.

[0108] In order to facilitate those skilled in the art to better understand the above embodiments, examples are given below.

[0109] In some embodiments, the static injection method includes the following steps:

[0110] 1. Open the executable file and parse its load command area and insert X blank characters at the end of the load command area. The data in the data area after the load command area are all moved to the back of the newly inserted X blank characters accordingly.

[0111] 2. Parse the load command area, find the load command with type value 0x19 and name __PAGEZERO, and modify the value corresponding to its virtual memory address size field to the original value minus X (the virtual memory size of this load command is generally much larger than 4K), and keep other fields unchanged.

[0112] 3. Parse the load command area, traverse all load commands with type value 0x19 (generally, common names of load commands with type value 0x19 include __TEXT, __DATA_CONST, __DATA, __LINKEDIT, etc.), and modify the values ​​corresponding to the VM Address and file offset fields of these load commands and their sub-segments. Among them, the value corresponding to the virtual memory address field is the original value minus X, and the value corresponding to the file offset value field is the original value plus X.

[0113] 4. Parse the load command area. If a load command with a type value of 0x22 is found, modify the values ​​of its fields Rebase infooffset, Bind info offset, Lazy binding info offset, Weak binding info offset, and Export info offset to the original values ​​plus X.

[0114] 5. Parse the load command area. If a load command with a type value of 0x2 is found, modify its field string tableoffset value to the original value plus X.

[0115] 6. Parse the load command area. If a load command with a type value of 0xB is found, modify the value of its field indsym tableoffset to the original value plus X.

[0116] 7. Parse the load command area. If a load command with a type value of 0x3, 0x16, 0x21, 0x29, 0x2C, 0x31, 0x34, or 0x35 is found, modify the value of its field file offset to the original value plus X. The positions of the fields file offset corresponding to the above different types of load commands may be inconsistent. In specific implementation, the position of the field file offset is determined according to the actual situation and then modified accordingly.

[0117] 8. Parse the load command area. If a load command with a type value of 0x33 is found, copy the prefix tree, and then traverse each node of the prefix tree. For the leaf node, add the value of the field file offset to the number of blank characters to be filled. Store the newly adjusted prefix tree at the end of the executable file, and then adjust the file offset of the load command with a type value of 0x33 to point to the new storage location of the prefix tree.

[0118] Of course, the above is only an exemplary description. The implementation of the relevant steps in the embodiment of the present application does not necessarily have to be implemented as in the previous embodiment, and will not be described in detail here.

[0119] It should be noted that the steps with the same labels in the above embodiments have substantially the same meanings and are implemented in substantially the same manner, and will not be described in detail here.

[0120] It should also be noted that the corresponding drawings of all the above embodiments are only examples of the execution order of each step. It can be understood that the execution order of the steps can be adjusted without affecting the implementation of the method. For example, step 200 and step 400 can be executed simultaneously, or step 400 can be executed first and then step 300, etc., which will not be described one by one here.

[0121] In order to facilitate those skilled in the art to better understand the effect of the static injection method provided by the above embodiment, Fig. 9 and Fig.10 To explain, Fig. 9 and Fig.10 The positions indicated by the two ends of the dotted line are the same.

[0122] like Fig. 9 As shown, when the reserved space is insufficient, the starting position of the data area in the existing solution will be moved from address A to address B, so that the space between address A and address B can be written with the load command (LC2) for loading the injection library. As data segment 1 (Segment 1) in the data area references data segment 2 (Segment 2), the address used for its reference to data segment 2 needs to consider the change from address A to address B.

[0123] like Fig.10 As shown, in the case of insufficient reserved space, in the solution provided by the above embodiment (taking the load command (LC1) with a shortened type value of 0x19 and a name of __PAGEZERO and the load command (LC2) for loading the injection library as an example, the end position of the load command with a type value of 0x19 and a name of __PAGEZERO is moved from position C to position D, other load commands are moved to after position D, and the vacated position is written to LC2. At this time, the position of the data area does not change relative to before injection.

[0124] Depend on Fig. 9 and Fig.10 It can be seen that the executable file does not have enough reserved space to store the new load command for loading the injection library, and the target application (Application, APP) can also be statically injected by inserting the load command corresponding to the injection library, and there is no need to adjust the mutual address references between the sub-segments of the Mach-o load command area, which improves the universal applicability and compatibility of the static injection solution.

[0125] Furthermore, based on the static injection method provided in the above embodiment, after static injection of the executable file, the generated executable file will have the following data structure:

[0126] The file header specifies the architecture of the executable file;

[0127] The load command area, located after the file header, is used to specify the logical structure of the executable file and its layout in virtual memory;

[0128] The data area is located after the load command area and includes the original data defined by each load command in the load command area.

[0129] Compared with the aforementioned existing static injection solution, the executable file before the static injection and the executable file after the static injection have a load command area with the same virtual memory size.

[0130] Furthermore, in some embodiments, if, as described in the aforementioned embodiments, during the injection process, the file position of the data section pointed to by the load command with a type value of 0x33 is adjusted, then at this time, in the executable file before static injection and the executable file after static injection, the file position of the data section pointed to by the load command with a type value of 0x33 is different.

[0131] For example, in some embodiments, reference Figure 8 In the statically injected executable file, the data section pointed to by the load command with type value 0x33 is located after the positions of all other data sections in the data area of ​​the executable file.

[0132] In some embodiments, if, as described in the above embodiments, the first load command includes a load command with a type value of 0x19 and a name of __PAGEZERO, then in the executable file before static injection and the executable file after static injection, the virtual memory size of the load command with a type value of 0x19 and a name of __PAGEZERO is different. In other words, the load command with a type value of 0x19 and a name of __PAGEZERO is used as a first load command to yield space to the second load command for loading the injection library. It should be noted that at this time, it is not limited whether other load commands are used to yield space for the second load command, and the write position of the second load command is not limited.

[0133] For example, in some embodiments, reference Fig.10, only the load command with type value 0x19 and name __PAGEZERO is used as the first load command, and other load commands are not used to make space for the second load command. At this time, relative to the executable file before static injection, in the executable file after static injection, the virtual memory address of the load command with type value 0x19 and name not __PAGEZERO reduces the target length, the target length is greater than the length of the second load command (i.e., the load command of the injection library newly added during the static injection process), the target length is N*4K, N is a positive integer, in order to meet the alignment requirements of the executable file while making space enough to write the second load command, to ensure that the second load command can be successfully written.

[0134] For example, based on the above example, in some embodiments, the second load command can also be configured to be written at the end of the command area. Fig.10 , in the data structure of the executable file, the second load command is located after all other load commands in the load command area. Correspondingly, at this time, other load commands will be immediately after the load command with the type value of 0x19 and the name of __PAGEZERO. Therefore, the virtual memory address of the load command with the type value of 0x19 and the name not __PAGEZERO reduces the target length, and the file offset value increases the target length. The file offset value of the load command with the type value not 0x19 increases the target length. This can ensure that the parameter information of each load command is consistent with the actual distribution, avoiding errors caused by the inconsistency between the parameters and the actual situation during the loading and running process.

[0135] For another example, in some embodiments, the second load command does not use the preset space before injection. In this case, the file header includes a blank character at the end, i.e., the preset space. Of course, the second load command can also use the preset space, etc. In this case, in the executable file after static injection, the changes in the parameters of each load command will be uncertain, and the size of the parameter changes of each load command will not be described one by one here.

[0136] It can also be understood that, due to the insertion of blank characters, when the second load command does not occupy all the blank character areas, some blank character positions will be reserved. That is, in some embodiments, if a blank character is inserted at the end of the load command area during static injection, then in the executable file after static injection, the end of the load command area is a blank character, so that the second load command in the load command area can be aligned.

[0137] Of course, the above is only an exemplary description of the data structure obtained after processing by the static injection method provided in the embodiment of the present application, and will not be described in detail here.

[0138] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0139] Another aspect of the present application embodiment further provides an electronic device, such as Fig.11 As shown, it includes: at least one processor 1101; and a memory 1102 that is communicatively connected to the at least one processor 1101; wherein the memory 1102 stores instructions that can be executed by the at least one processor 1101, and the instructions are executed by the at least one processor 1101 so that the at least one processor 1101 can execute the static injection method described in any of the above method embodiments.

[0140] Among them, the memory 1102 and the processor 1101 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 1101 and the memory 1102 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are all well known in the art, and therefore, are not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 1101 is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor 1101.

[0141] The processor 1101 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 1102 can be used to store data used by the processor 1101 when performing operations.

[0142] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program, which implements the static injection method provided in the above embodiment when executed by a processor.

[0143] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0144] On the other hand, the embodiment of the present application also provides a computer-readable storage medium storing a computer program. The computer program includes an executable file obtained after static injection as described in any of the previous embodiments. The known file is stored in a storage medium, and when needed, it will be loaded into a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) so that it can be executed according to the relevant instructions in the executable file to provide services to users. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or CD-ROM and other media that can store program codes.

[0145] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A static injection method, characterized in that: include: reducing the space occupied by the first target load command in the load command area of ​​the executable file by a target length, wherein the reduction of the space occupied by the first target load command does not affect the normal loading of the executable file; inserting a blank character in the load command area, wherein the target length is equal to the length of the blank character; By writing a second target load command in the blank character, wherein the second target load command is used to load the injection library; According to the reduction of the space occupied by the first target load command, the position information of the corresponding load command is adjusted, wherein the position information includes the virtual memory size, the virtual memory address, and the file offset value.

2. The static injection method according to claim 1, characterized in that: After adjusting the location information of the corresponding load command according to the reduction of the space occupied by the first target load command, the method further includes: In the data area of ​​the executable file, the data section pointed to by the load command with the type value of 0x33 is moved from the current file position to another file position and the load command with the type value of 0x33 is modified to point to the moved another file position.

3. The static injection method according to claim 2, characterized in that: The another file position is located after the positions of all other data sections in the data area.

4. The static injection method according to any one of claims 1 to 3, characterized in that: The first target load command includes a load command with a type value of 0x19 and a name of __PAGEZERO.

5. The static injection method according to any one of claims 1 to 3, characterized in that: The inserting of blank characters into the load command area comprises: The blank character is inserted after all the load commands in the load command area.

6. The static injection method according to claim 5, characterized in that: The step of reducing the space occupied by the first target load command in the load command area of ​​the executable file by a target length includes: shortening the target length by a load command with a type value of 0x19 and a name of __PAGEZERO; The adjusting the position information of the corresponding load command according to the reduction of the space occupied by the first target load command includes: Subtract the target length from the virtual memory size of the load command with type value 0x19 and name __PAGEZERO; Subtract the target length and the file offset value from the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO and add the target length; The file offset value of the load command whose type value is not 0x19 is increased by the target length.

7. The static injection method according to any one of claims 1 to 3, characterized in that: The step of writing the second target load command into the blank character comprises: In a case where the blank character and the reserved space of the load command area are continuously distributed, the second target load command is written in the blank character and the reserved space.

8. The static injection method according to any one of claims 1 to 3, characterized in that: The step of reducing the space occupied by the first target load command in the load command area of ​​the executable file by a target length includes: At least one of the first target load commands is shortened, and / or at least one of the first target load commands is deleted, so as to reduce the space occupied by all the first target load commands by the target length.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the static injection method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program is an executable file obtained after static injection, wherein the executable file before static injection and the executable file after static injection have load command areas with the same virtual memory size.

11. The computer-readable storage medium according to claim 10, wherein: In the executable file before static injection and the executable file after static injection, the file location pointed to by the data section pointed to by the load command with the type value of 0x33 is different.

12. The computer-readable storage medium according to claim 11, wherein: In the executable file after static injection, the data section pointed to by the load command with a type value of 0x33 is located after the positions of all other data sections in the data area of ​​the executable file.

13. The computer-readable storage medium according to any one of claims 10 to 12, characterized in that: In the executable file before static injection and the executable file after static injection, the virtual memory size of the load command with a type value of 0x19 and a name of __PAGEZERO is different.

14. The computer-readable storage medium according to claim 13, wherein: Compared to the executable file before static injection, in the executable file after static injection, the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO reduces the target length, the virtual memory address of the load command with a type value of 0x19 and a name other than __PAGEZERO reduces the target length, the file offset value increases the target length, and the file offset value of the load command with a type value other than 0x19 increases the target length; The target length is not less than the length of the load command of the injection library newly added during the static injection process, and the target length is N*4K, where N is a positive integer.

15. The computer-readable storage medium according to any one of claims 10 to 12, characterized in that: In the executable file after static injection, the tail of the load command area is a blank character.

Images