Data transmission method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a data transmission method and device, equipment and a storage medium. Encrypted data and encrypted secret key data of an application program can be collected in a more hidden mode. The method comprises the steps that a form operation is executed on a current thread of a target application program in a system calling mode to create a target sub-process, an hprofDumPeap function in a system library is called based on the target sub-process to generate a target file corresponding to a java layer, and the target file comprises target encrypted data; carrying out hook based on a dodlopen function of a system library so as to monitor all shared object SO files; performing Hook on a preset function of each SO file in all the SO files on the basis of a got hook mode so as to monitor the memory use condition of each SO file; determining unreleased memory data of all the SO files according to the memory use condition of each SO file, wherein the unreleased memory data comprises a target secret key corresponding to the target encrypted data; and transmitting the target encrypted data and the target secret key to a server through different network channels.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a data transmission method, device, equipment and storage medium. Background Art

[0002] The video format of existing live video broadcasts is a universal format, so anyone who obtains the playback address of the video stream can use a video player to play it. Therefore, it is very easy for other platforms to steal the video and play it on that platform, so that the platform can play its own advertisements to make profits. At the same time, although different users now obtain different video stream addresses of the same video stream, the video stream data they pull is the same, so as long as there is a video stream address, the complete video stream data can be obtained.

[0003] At present, the conventional data collection and transmission methods on the market are easily detected and cracked by irregular behaviors as they are constantly cracked. Therefore, it is necessary to find some more covert means.

[0004] The existing solutions transmit the collected watermark data on the Android platform, which is usually directly used to calculate the authentication algorithm of the video stream address. Therefore, it is easy to be cracked and obtained by irregular behavior. Therefore, more covert means are needed to hide the collected watermark data, device information, etc. Summary of the invention

[0005] The embodiments of the present invention provide a data transmission method, apparatus, device and storage medium, which adopt a more covert method than the existing one when collecting encrypted data or encrypted key data, so that the collected data is not easily discovered by irregular behavior. Therefore, when the data is used to identify irregular behavior, the accuracy of the identified irregular behavior is higher.

[0006] A first aspect of the present invention provides a data transmission method, comprising:

[0007] Perform a fork operation on the current thread of the target application through a system call to create a target child process

[0008] Based on the target child process, calling the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application, the target file including the target encrypted data corresponding to the target application;

[0009] Hooking based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0010] Hooking a preset function of each SO file in all the SO files based on the gothook method to monitor the memory usage of each SO file;

[0011] Determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data;

[0012] The target encrypted data and the target key are transmitted to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0013] A second aspect of the present invention provides a data transmission device, comprising:

[0014] Create a module to perform a fork operation on the current thread of the target application through a system call to create a target child process

[0015] A generation module, used to call the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application based on the target subprocess, wherein the target file includes target encrypted data corresponding to the target application;

[0016] A first monitoring module is used to hook based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0017] A second monitoring module is used to hook a preset function of each SO file in all the SO files based on a gothook method to monitor the memory usage of each SO file;

[0018] A determination module, configured to determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes a target key corresponding to the target encrypted data;

[0019] A transmission module is used to transmit the target encrypted data and the target key to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0020] A third aspect of an embodiment of the present invention provides an electronic device, including a memory and a processor, wherein the processor is configured to implement the steps of the data transmission method described in the first aspect when executing a computer management program stored in the memory.

[0021] A fourth aspect of an embodiment of the present invention provides a computer-readable storage medium on which a computer management program is stored. When the computer management program is executed by a processor, the steps of the data transmission method described in the first aspect are implemented.

[0022] In summary, it can be seen that in the embodiment provided by the present invention, the encrypted data is stored in the Java layer of the Android program in advance, and the encrypted key data is stored in the native layer of the Android program in advance, thereby generating the encrypted data of the Java layer of the target application by calling the hprofDumpHeap function in the system library, and monitoring the preset function of the SO file loaded in the application, thereby monitoring the memory usage of the SO file, and obtaining the unreleased memory data, which includes the encrypted key data. Whether collecting encrypted data or encrypted key data, a more covert method is adopted compared to the existing method, so that the collected data is not easily discovered by irregular behavior. Therefore, when the data is used to identify irregular behavior, the accuracy of the identified irregular behavior is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of a data transmission method according to an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a virtual structure of a data transmission device provided by an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the hardware structure of a data transmission device provided by an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of an embodiment of an electronic device provided by an embodiment of the present invention;

[0027] Figure 5 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] In the following description, specific embodiments of the present invention will be described with reference to steps and symbols performed by one or more computers, unless otherwise stated. Therefore, these steps and operations will be mentioned several times as being performed by a computer, and computer execution referred to herein includes operations by a computer processing unit of electronic signals representing data in a structured form. This operation converts the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise change the operation of the computer in a manner familiar to testers in the field. The data structure maintained by the data is a physical location in the memory, which has specific characteristics defined by the data format. However, the principles of the present invention are described in the above text, which does not represent a limitation, and testers in the field will understand that the various steps and operations described below can also be implemented in hardware.

[0030] The principles of the present invention operate with many other general or special purpose computing, communication environments or configurations. Examples of well-known computing systems, environments and configurations suitable for use with the present invention may include, but are not limited to, handheld phones, personal computers, servers, multiprocessor systems, microcomputer-based systems, mainframe computers, and distributed computing environments, including any of the above systems or devices.

[0031] The terms "first", "second", and "third" in the present invention are used to distinguish different objects rather than to describe a specific order. In addition, the terms "include", "have", and any variations thereof are intended to cover non-exclusive inclusions.

[0032] Currently, the watermark data collected and transmitted on the Android platform is usually directly used to calculate the authentication algorithm of the video stream address, so it is easy to be cracked and obtained by irregular behavior.

[0033] The present invention starts from the Android program and considers how to use a more covert way to transmit and collect device information and watermark data. Considering that the current Android program uses OOM (Out Of Memory) monitoring to monitor the memory usage in the life cycle of the APP, and the memory data and memory objects are collected during the OOM process, the information and watermark data to be reported are hidden in the OOM data during the collection process, thereby achieving a good concealment effect.

[0034] In addition, in the present invention, the encrypted data is stored in the Java layer of the Android program in advance, and the encrypted key data is stored in the native layer of the Android program, thereby collecting the encrypted data in the Java layer and collecting the encrypted key data in the native layer. Both the encrypted data and the encrypted key data are collected through conventional OOM data and reported to the server. The server will receive these two copies of OOM data, one is the OOM data hprof file collected from the Java layer, and the other is the OOM data collected from the native layer.

[0035] Since the hprof file format is public, the reported file can be parsed according to the hprof file format, and all objects and their data contents can be parsed out, and the encrypted collected data can be found according to the pre-set format rules. Similarly, for the OOM data reported by native, the encrypted key data can be directly parsed out. With these two pieces of data, the encrypted data can be decrypted using the key, thereby obtaining the original data and watermark data collected by the client. Then, the user's identity can be identified through the original data and watermark data, and it can be determined whether the video stream has been stolen.

[0036] The following describes the data transmission method from the perspective of the data transmission device. Figure 1 , Figure 1 A schematic flow chart of a data transmission method provided by an embodiment of the present invention includes:

[0037] 101. Perform a fork operation on the current thread of the target application through a system call to create a target child process.

[0038] In this embodiment, the data transmission device can perform a fork operation on the current thread of the target application program by means of a system call to create a target child process. Specifically, the data transmission device can pause the current thread, and call the fork system function by means of a system call to perform a fork operation to return to the first process; obtain the unique identifier PID of the first process; if the PID is 0, determine the first process as the target child process.

[0039] It should be noted that, in the Java layer of the target application, the data transmission device uses the hprof function provided by the system (HPROF (Heap Profile) file is a file format used to analyze memory usage in Android and Java environments. It can help developers understand the memory allocation status in the application, identify memory leaks and other memory-related issues), where hprof collects the memory data of the object, so the encrypted data stored in the Java layer can obtain the corresponding content through the data collected by OOM.

[0040] Considering that hprof will cause the target application (APP) to freeze, when executing hprof, you need to fork a child process to complete the entire operation, because the memory of the forked process and the current process is exactly the same. At the same time, calling hprof in the forked process will not affect the user's current APP, thereby not affecting the user's use of the APP. The specific implementation method is as follows:

[0041] Step 1: Pause the current thread.

[0042] In this step, the data transmission device forks a child process. Considering that the child process is exactly the same as the current process, it is necessary to suspend the current thread before performing the fork operation, and then resume the execution of the thread, so as to ensure that the current thread content does not change during the fork child process. First, the handle of the previous thread is obtained through the system function, and then the thread suspension function is called to suspend the current thread. The code is as follows:

[0043] {

[0044] auto*thread=current_thread(); / / Get the current thread handle thread;

[0045] suspend_runtime(thread); / / Suspend the execution of the current thread;}.

[0046] Step 2: Call the system function to fork a child process. The specific code is as follows:

[0047] int pid=fork(); / / Call the system function fork() to perform the fork operation and return the unique identifier of the process pid;

[0048] If (pid == 0) { / / If the value of pid is 0, it means that the child process currently returned is the fork.

[0049] }else{ / / If the value of pid is not 0, it means that the process currently returned is not a child process but an APP process.

[0050] resume_runtime(thread); / / Call the system function to resume the previously paused thread. Then the APP process continues to execute the functional operation of the app.

[0051] }

[0052] 102. Based on the target child process, call the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application.

[0053] In this embodiment, after creating the target child process, the data transmission device can call the hprofDumpHeap function in the system library based on the target child process to generate the target file corresponding to the java layer of the target application. That is, the entire hprof dump operation is completed by obtaining the hprofDumpHeap function in the system library libart.so. At this time, calling the hprofDumpHeap function will generate an hprof file. The hprof file includes all memory objects in the current java program, as well as the memory data corresponding to the objects. The encrypted data corresponding to the target application is also stored in the hprof file.

[0054] In one embodiment, the data transmission device may store the encrypted data and the encrypted key data in advance, as follows:

[0055] Collect device information of the target device corresponding to the target application;

[0056] Obtain the watermark data corresponding to the target application;

[0057] Encrypt the device information and watermark data using a preset encryption algorithm to obtain initial encrypted data;

[0058] Generate target encrypted data and target key according to the initial encrypted data and the encryption key corresponding to the preset encryption algorithm;

[0059] Store the target encrypted data in the Java layer of the target application, and store the target encryption key in the native layer of the target application.

[0060] In this embodiment, the data transmission device can collect device information of the target device. Specifically, the data transmission device can collect device information of the target device corresponding to the target application. The device information includes but is not limited to device name, unique identifier, network information, CPU information, device memory, installed application list, gyroscope information, sensor information, IP information and GPS information.

[0061] The data transmission device can obtain the watermark data corresponding to the target application according to various algorithms, or by receiving the watermark data sent by the server.

[0062] After obtaining the device information and the watermark data, the data transmission device can use the AES encryption algorithm (that is, the preset encryption algorithm, the AEC encryption algorithm is used as an example for explanation here, of course, other encryption algorithms can also be used for encryption, such as asymmetric encryption algorithms (RSA, DSA, ECC) to encrypt the device information and watermark information, and the specific details are not limited) to encrypt the watermark data and the device information to obtain initial encrypted data;

[0063] Afterwards, the data transmission device generates target encrypted data and a target key based on the initial encrypted data and the encryption key corresponding to the preset encryption algorithm; specifically, the data transmission device can determine the specific characters corresponding to the target application and the data length field of the initial encrypted data, and extract the first preset byte set in the initial encrypted data and the second preset byte set in the encryption key, and generate the target key based on the encryption key, specific characters, data length field and the first preset byte set; generate the target encrypted data based on the initial encrypted data, specific characters, data length bytes and the second preset byte set.

[0064] It should be noted that the encrypted data collected is usually larger than 1024 bytes, and the corresponding key for encrypting the collected data is usually larger than 256 bytes. Therefore, a certain format header can be added to facilitate subsequent search. The specific format is as follows:

[0065] The data format of the target encrypted data is as follows:

[0066] The specific character length is fixed at 8 bytes (specific characters) + the total data length field is 8 bytes (the data length of the initial encrypted data) + the first 32 bytes of the key data (that is, the second preset byte set, the first 32 bytes are used as an example here, of course, it can also be other byte numbers, and there is no specific limitation) + encrypted data (that is, the initial encrypted data);

[0067] The data format of the target key is as follows:

[0068] The specific character length is fixed at 8 bytes (specific characters) + the total data length field is 8 bytes (the data length of the initial encrypted data) + the first 32 bytes of the encrypted data (that is, the first preset byte set, which is explained here using the first 32 bytes as an example, of course, it can also be other numbers of bytes, and there is no specific limitation) + key data (encryption key). The specific characters can be transformed based on each version to improve security. At the same time, the encrypted data and the first 32 bytes of the key data are cross-stored, so it is not easy to find errors.

[0069] After obtaining the target encrypted data and target key, the data transmission device can store the target key in the native (C++ memory) object of the target application and store the target encrypted data in the Java layer object. Since the Java layer needs to send data to the server, the encrypted result data is placed in the Java layer to make it easier to send to the server. The native stores the key data. Without the key data, the encrypted data cannot be decrypted even if it is obtained.

[0070] 103. Hook the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application.

[0071] In this embodiment, the data transmission device can obtain the key data stored in the native layer. For the native layer, the data transmission device can obtain the memory allocation information, memory release information, call stack and data content corresponding to the call stack of all native layers; specifically, the data transmission device can monitor all loaded SO files of the target application by hooking the do_dlopen function of the system library / system / bin / linker when the target application is started.

[0072] 104. Based on the got hook method, hook the preset function of each SO file in all SO files to monitor the memory usage of each SO file.

[0073] In this embodiment, when the data transmission device monitors all SO files loaded by the target application, the first moment it senses that an SO is loaded into the target application, the data transmission device can hook the SO, hook the memory allocation and release operations, so as to obtain the memory usage of the SO, the memory usage includes the allocated memory start address recorded when the memory is allocated, the released memory start address recorded when the memory is released, and delete the address recorded when allocated at the same time, then the memory start address that is not released that is finally recorded is the memory address that is not released and is used by the current SO.

[0074] It should be noted that the preset function includes: memory allocation function and memory release function, wherein the memory allocation function includes but is not limited to Malloc, calloc, realloc, memalign, mmap and mmap64 functions; the memory release function includes but is not limited to free and munmap functions; the data transmission device can use the got hook method to hook these functions of so, so as to monitor the memory usage of so, including how much memory so uses, how much memory is not released, etc. For ease of understanding, the memory allocation function Malloc is used as an example for explanation below:

[0075] Gothooking malloc

[0076] Then replace the system's malloc with a pre-written function

[0077] void*malloc_proxy(size_t size){

[0078] Then all calls to malloc in this so will call the pre-written malloc_proxy function.

[0079] It should be noted that, taking into account factors such as program performance, the data transmission device will not monitor all memory allocations, but will determine the size of the currently allocated memory. If the size exceeds a certain size, it will monitor it. If the size of the currently allocated memory exceeds the preset size, the original malloc will be called to allocate memory, and then the starting address and size of the allocated memory, as well as the current call stack, will be recorded; if the size of the currently allocated memory does not exceed the preset size, the original system's malloc will be directly called for memory allocation.

[0080] 105. Determine the unreleased memory data of all SO files according to the memory usage of each SO file.

[0081] In this embodiment, after monitoring the memory usage of each SO file, the data transmission device can determine the unreleased memory data of all SO files according to the memory usage of each monitored SO file, and the unreleased memory data includes the target key corresponding to the target encrypted data. Specifically, the data transmission device can extract the allocated memory starting address set and the released memory starting address set corresponding to the target SO file in the memory usage, and the target SO file is any SO file among all SO files; match the allocated memory starting address set with the released memory starting address set to obtain an allocated memory starting subset that has not been successfully matched; determine the target allocated memory starting address whose data amount of memory data in the allocated memory starting address subset is within a preset range; and determine the memory data corresponding to the target memory allocated starting address as the unreleased memory data.

[0082] That is, the data transmission device first determines the starting address and data size recorded when allocating memory in the memory usage, and then matches the memory starting address recorded when allocating memory and the starting address of released memory recorded when releasing memory, and obtains the memory starting address recorded when the memory is allocated that is not successfully matched. Then the memory starting address recorded when the memory is allocated that is not successfully matched is the memory starting address that is not released by the SO, and thus the data corresponding to the unreleased memory can also be obtained, and these data include the target key previously stored in native.

[0083] It should be noted that, since the data size of the target key previously stored in the native is in the range of 256 bytes to 1024 bytes, in order to avoid reporting too much data, after obtaining the unreleased memory data, the data transmission device can further filter the unreleased memory data based on the preset data size range, and filter other data whose data size is not within the preset data size range, and only report the memory data in this interval, so that the target key data can be reported to the server together with the native OOM data.

[0084] It should be noted that the target file can be obtained through steps 101 to 102, and the unreleased memory data can be obtained through steps 103 to 105. However, there is no restriction on the order of execution between steps 101 to 102 and steps 103 to 105. Steps 103 to 105 can be executed first, or steps 101 to 103 can be executed first, or they can be executed simultaneously, without specific limitation.

[0085] 106. Transmit the target encrypted data and the target secret key to the server through different network channels.

[0086] In this embodiment, after determining the target encrypted data and the target key, the data transmission device can transmit the target encrypted data and the target key to the server through different network channels. Specifically, the data transmission device can construct a first network channel based on a short connection and a second network channel based on a long connection; transmit the target encrypted data to the server through the first network channel, and transmit the target key to the server through the second network channel.

[0087] That is, the data transmission device collects two copies of OOM data, one is the hprof file of the Java layer (that is, the target file, which includes the target encrypted data), and the other is the OOM data of the native layer (that is, the unreleased memory data, which includes the target key). For security reasons, two different network channels can be selected, one using a short connection https request for reporting, and the other using a long connection for reporting. Since the hprof file is larger and requires a longer transmission time in the network, it is considered that hprof uses a long connection for reporting, while native OOM uses a short https connection for reporting. Reporting through two different network channels prevents irregular behavior from capturing the reported data through packet capture tools, thereby improving security.

[0088] It should be noted that encrypted data is collected at the Java layer, and encrypted key data is collected at the native layer. The data transmission device reports to the server through conventional OOM data collection. The server will receive two sets of data, one is the OOM data hprof file collected at the Java layer, and the other is the OOM data collected at the native layer.

[0089] Since the hprof file format is public, for data in the hprof file format, the reported file is parsed according to the hprof file format, and all objects and the data content of the objects are parsed from it. Then, according to the set encryption rules, the encrypted device data and watermark data can be found; similarly, for the OOM data reported by the native, the server can directly parse the encrypted key data from it. With these two pieces of data, the server can use the key to decrypt the encrypted data, thereby obtaining the device information data and watermark data collected by the client. After determining the device information data and watermark data, the server can identify the user's identity based on the data, and then determine whether there is a situation of stolen traffic.

[0090] In summary, it can be seen that in the present invention, the encrypted data is stored in the Java layer of the Android program in advance, and the encrypted key data is stored in the native layer of the Android program in advance, thereby generating the encrypted data of the Java layer of the target application by calling the hprofDumpHeap function in the system library, and monitoring the preset function of the SO file loaded in the application, thereby monitoring the memory usage of the SO file, and obtaining the unreleased memory data, which includes the encrypted key data. Whether collecting encrypted data or encrypted key data, a more covert method is adopted compared to the existing method, so that the collected data is not easily discovered by irregular behavior. Therefore, when the data is used to identify irregular behavior, the accuracy of the identified irregular behavior is higher.

[0091] The above describes the embodiment of the present invention from the perspective of a data transmission method. The following describes the embodiment of the present invention from the perspective of a data transmission device.

[0092] See also Figure 2 , a virtual structural diagram of a data transmission device in an embodiment of the present invention, the data transmission device 200 comprises:

[0093] The creation module 201 is used to perform a fork operation on the current thread of the target application program by means of a system call to create a target child process.

[0094] A generating module 202 is used to call the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application based on the target subprocess, wherein the target file includes target encrypted data corresponding to the target application;

[0095] A first monitoring module 203 is used to hook based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0096] The second monitoring module 204 is used to hook the preset function of each SO file in all the SO files based on the got hook method to monitor the memory usage of each SO file;

[0097] A determination module 205 is used to determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data;

[0098] The transmission module 206 is used to transmit the target encrypted data and the target key to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0099] In a possible design, the creation module 201 is specifically used for:

[0100] Pause the current thread, and call the fork system function to perform a fork operation by way of a system call to return to the first process;

[0101] Obtain the unique identifier PID of the first process;

[0102] If the PID is 0, the first process is determined as the target subprocess.

[0103] In a possible design, the determining module 205 is specifically used for:

[0104] Extracting an allocated memory start address set and a released memory start address set corresponding to a target SO file in the memory usage, wherein the target SO file is any one SO file among all the SO files;

[0105] Matching the allocated memory start address set with the released memory start address set to obtain an unmatched allocated memory start subset;

[0106] Determine a target allocated memory start address whose data amount of the memory data in the allocated memory start address subset is within a preset range;

[0107] The memory data corresponding to the target memory allocation start address is determined as the unreleased memory data.

[0108] In a possible design, the determining module 205 is further configured to:

[0109] Collecting device information of a target device corresponding to the target application;

[0110] Obtaining watermark data corresponding to the target application;

[0111] Encrypting the device information and the watermark data by using a preset encryption algorithm to obtain initial encrypted data;

[0112] Generate target encrypted data and a target key according to the initial encrypted data and the encryption key corresponding to the preset encryption algorithm;

[0113] The target encrypted data is stored in the Java layer of the target application, and the target encryption key is stored in the native layer of the target application.

[0114] In a possible design, the determination module 205 generates target encrypted data and a target key according to the initial encrypted data and the encryption key corresponding to the preset encryption algorithm, including:

[0115] Determining the specific characters corresponding to the target application and the data length field of the initial encrypted data;

[0116] Extracting a first preset byte set in the initial encrypted data and a second preset byte set in the encryption key;

[0117] Generate the target key according to the encryption key, the specific character, the data length field and the first preset byte set;

[0118] The target encrypted data is generated according to the initial encrypted data, the specific character, the data length byte and the second preset byte set.

[0119] In a possible design, the transmission module 206 is specifically used for:

[0120] A first network channel is constructed based on a short connection, and a second network channel is constructed based on a long connection;

[0121] The target encrypted data is transmitted to the server through the first network channel, and the target secret key is transmitted to the server through the second network channel.

[0122] above Figure 2 The data transmission device in the embodiment of the present invention is described from the perspective of modular functional entities. The data transmission device in the embodiment of the present invention is described in detail from the perspective of hardware processing. Figure 3 , a schematic diagram of an embodiment of a data transmission device 300 in an embodiment of the present invention, the data transmission device 300 comprises:

[0123] An input device 301, an output device 302, a processor 303 and a memory 304 (the number of the processor 303 can be one or more, Figure 3 In some embodiments of the present invention, the input device 301, the output device 302, the processor 303 and the memory 304 may be connected via a communication bus or other means, wherein: Figure 3 The communication bus connection is taken as an example.

[0124] Wherein, by calling the operation instruction stored in the memory 304, the processor 303 is used to perform the following steps:

[0125] Perform a fork operation on the current thread of the target application through a system call to create a target child process

[0126] Based on the target child process, calling the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application, the target file including the target encrypted data corresponding to the target application;

[0127] Hooking based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0128] Hooking a preset function of each SO file in all the SO files based on the gothook method to monitor the memory usage of each SO file;

[0129] Determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data;

[0130] The target encrypted data and the target key are transmitted to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0131] By calling the operation instructions stored in the memory 304, the processor 303 is also used to execute Figure 1 Any method in the corresponding embodiment.

[0132] See also Figure 4 , Figure 4 A schematic diagram of an electronic device according to an embodiment of the present invention.

[0133] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, including a memory 410, a processor 420, and a computer program 411 stored in the memory 410 and executable on the processor 420. When the processor 420 executes the computer program 411, the following steps are implemented:

[0134] Perform a fork operation on the current thread of the target application through a system call to create a target child process

[0135] Based on the target child process, calling the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application, the target file including the target encrypted data corresponding to the target application;

[0136] Hooking based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0137] Hooking a preset function of each SO file in all the SO files based on the gothook method to monitor the memory usage of each SO file;

[0138] Determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data;

[0139] The target encrypted data and the target key are transmitted to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0140] In the specific implementation process, when the processor 420 executes the computer program 411, it can achieve Figure 1 Any implementation manner in the corresponding embodiments.

[0141] Since the electronic device introduced in this embodiment is a device used to implement a data transmission device in the embodiment of the present invention, based on the method introduced in the embodiment of the present invention, technical personnel in this field can understand the specific implementation mode of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present invention is not introduced in detail here. As long as the equipment used by technical personnel in this field to implement the method in the embodiment of the present invention falls within the scope of protection of the present invention.

[0142] See also Figure 5 , Figure 5 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention.

[0143] like Figure 5 As shown, the embodiment of the present invention further provides a computer-readable storage medium 500, on which a computer program 511 is stored. When the computer program 511 is executed by a processor, the following steps are implemented:

[0144] Perform a fork operation on the current thread of the target application through a system call to create a target child process

[0145] Based on the target child process, calling the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application, the target file including the target encrypted data corresponding to the target application;

[0146] Hooking based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application;

[0147] Hooking a preset function of each SO file in all the SO files based on the gothook method to monitor the memory usage of each SO file;

[0148] Determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data;

[0149] The target encrypted data and the target key are transmitted to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

[0150] In the specific implementation process, the computer program 511 is executed by the processor to achieve Figure 1 Any implementation manner in the corresponding embodiments.

[0151] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0152] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] The embodiment of the present invention also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device executes the following Figure 1 The process in the corresponding embodiment.

[0157] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0158] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0159] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There are other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0160] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0162] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0163] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data transmission method, characterized in that: include: Perform a fork operation on the current thread of the target application through a system call to create a target child process Based on the target child process, calling the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application, the target file including the target encrypted data corresponding to the target application; Hooking based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application; Hook the preset function of each SO file in all the SO files based on the got hook method to monitor the memory usage of each SO file; Determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes the target key corresponding to the target encrypted data; The target encrypted data and the target key are transmitted to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

2. The method according to claim 1, characterized in that The fork operation is performed by a system call to create a target child process, including: Pause the current thread, and call the fork system function to perform a fork operation by way of a system call to return to the first process; Obtain the unique identifier PID of the first process; If the PID is 0, the first process is determined as the target subprocess.

3. The method according to claim 1, characterized in that Determining the unreleased memory data corresponding to all SO files according to the memory usage of each SO file includes: Extracting an allocated memory start address set and a released memory start address set corresponding to a target SO file in the memory usage, wherein the target SO file is any one SO file among all the SO files; Matching the allocated memory start address set with the released memory start address set to obtain an unmatched allocated memory start subset; Determine a target allocated memory start address whose data amount of the memory data in the allocated memory start address subset is within a preset range; The memory data corresponding to the target memory allocation start address is determined as the unreleased memory data.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Collecting device information of a target device corresponding to the target application; Obtaining watermark data corresponding to the target application; Encrypting the device information and the watermark data by using a preset encryption algorithm to obtain initial encrypted data; Generate target encrypted data and a target key according to the initial encrypted data and the encryption key corresponding to the preset encryption algorithm; The target encrypted data is stored in the Java layer of the target application, and the target encryption key is stored in the native layer of the target application.

5. The method according to claim 4, characterized in that The generating target encrypted data and target key according to the initial encrypted data and the encryption key corresponding to the preset encryption algorithm comprises: Determining the specific characters corresponding to the target application and the data length field of the initial encrypted data; Extracting a first preset byte set in the initial encrypted data and a second preset byte set in the encryption key; Generate the target key according to the encryption key, the specific character, the data length field and the first preset byte set; The target encrypted data is generated according to the initial encrypted data, the specific character, the data length byte and the second preset byte set.

6. The method according to any one of claims 1 to 3 and 5, characterized in that: The transmitting the target encrypted data and the target secret key to the server through different network channels comprises: A first network channel is constructed based on a short connection, and a second network channel is constructed based on a long connection; The target encrypted data is transmitted to the server through the first network channel, and the target secret key is transmitted to the server through the second network channel.

7. A data transmission device, characterized in that: include: Create a module to perform a fork operation on the current thread of the target application through a system call to create a target child process A generation module, used to call the hprofDumpHeap function in the system library to generate a target file corresponding to the Java layer of the target application based on the target subprocess, wherein the target file includes target encrypted data corresponding to the target application; A first monitoring module is used to hook based on the do_dlopen function of the system library to monitor all shared object SO files loaded in the target application; The second monitoring module is used to hook the preset function of each SO file in all the SO files based on the got hook method to monitor the memory usage of each SO file; A determination module, configured to determine the unreleased memory data of all the SO files according to the memory usage of each SO file, wherein the unreleased memory data includes a target key corresponding to the target encrypted data; A transmission module is used to transmit the target encrypted data and the target key to the server through different network channels, so that the server parses the target key and the target encrypted data to obtain the device information and watermark information corresponding to the target application, and performs detection based on the device information and the watermark information.

8. The device according to claim 7, characterized in that The determination module is specifically used for: Extracting an allocated memory start address set and a released memory start address set corresponding to a target SO file in the memory usage, wherein the target SO file is any one SO file among all the SO files; Matching the allocated memory start address set with the released memory start address set to obtain an unmatched allocated memory start subset; Determine a target allocated memory start address whose data amount of the memory data in the allocated memory start address subset is within a preset range; The memory data corresponding to the target memory allocation start address is determined as the unreleased memory data.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to implement the data transmission method as described in any one of claims 1 to 7 when executing a computer management program stored in the memory.

10. A computer-readable storage medium having a computer management program stored thereon, characterized in that: When the computer management program is executed by a processor, the data transmission method according to any one of claims 1 to 7 is implemented.

Images