Processing method and device for encryption and decryption algorithm in software, equipment and medium

Abstract

The invention provides a processing method and device for encryption and decryption algorithms in software, equipment and a medium, and the method comprises the steps: determining a keyword, and determining a code line corresponding to the keyword in a program code file loaded into a running memory based on the keyword; wherein the program code file is non-encrypted content; analyzing a function type based on the code content of the code line; based on the function type, operation data corresponding to the function type are obtained, and the operation data comprise parameters and return values of the function; and determining an encryption and decryption rule of the function type based on the parameter and the return value of the function. According to the method, the security defense means of the APP is broken through through the obtained encryption and decryption rule, the vulnerability is tried to be found, and the verification of the security test is achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for processing encryption and decryption algorithms in software. Background Art

[0002] In the field of APP security testing, as the attack and defense technologies continue to upgrade, existing APPs often use shells and traffic encryption to defend against common security attacks. As a security tester, you need to break through the APP's security defense measures during the testing process to try to find vulnerabilities.

[0003] Traffic decryption is an important part of security testing. Common decryption methods are to reverse analyze the APK file and find the encryption algorithm from the code. Or run the APP, capture the traffic package and analyze the encrypted content to obtain the encryption algorithm.

[0004] When decrypting the APP encryption algorithm, it takes a lot of time and manpower to perform reverse analysis. When decrypting the encrypted APP data message traffic, if the security reinforcement cannot be cracked, the code cannot be analyzed. As a result, the data message cannot be decrypted.

[0005] When cracking the encryption of APP data message traffic, technicians need to have certain skills. Summary of the invention

[0006] In view of the problems existing in the prior art, the present invention provides a method, device, equipment and medium for processing encryption and decryption algorithms in software.

[0007] The present invention provides a method for processing an encryption and decryption algorithm in software, comprising: Determine a keyword, and determine a code line corresponding to the keyword in a program code file loaded into the running memory based on the keyword; wherein the program code file is non-encrypted content; Analyze the function type based on the code content of the code line; Based on the function type, acquiring operation data corresponding to the function type, the operation data including parameters and return values ​​of the function; Based on the parameters and return value of the function, encryption and decryption rules of the function type are determined.

[0008] According to a method for processing an encryption and decryption algorithm in software provided by the present invention, the method further includes: The function type is analyzed based on the code content of the code line, including: Extracting coding features in the code content according to the code content of the code line; According to the code content of the code line, obtaining context code content associated with the code content; Extracting coding features from the context code content; A function type is determined based on coding features in the code content and coding features in the context code content.

[0009] According to a method for processing an encryption and decryption algorithm in software provided by the present invention, determining the function type based on the coding features in the code content and the coding features in the context code content includes: The coding features in the code content are filtered out in a first feature library to obtain a first result; wherein the first feature library stores the correspondence between the coding features in the code content and the function type; The coding features in the context code content are filtered out in a second feature library to obtain a second result; wherein the second feature library stores the corresponding relationship between the coding features in the code content, the coding features in the context code content and the function type; Based on the first result and the second result, a function type is determined.

[0010] According to a method for processing encryption and decryption algorithms in software provided by the present invention, the encryption and decryption rules of the function type are determined based on the parameters and return values ​​of the function, including: Based on the parameters and return values ​​of the function, determining the changing rules between the parameters and the return values; Analyze the calling rules of the function type based on the characteristics of the function call stack; Based on the change rule and the calling rule, an encryption and decryption rule of the function type is determined.

[0011] The present invention also provides a device for processing encryption and decryption algorithms in software, comprising: A search module, used to determine a keyword, and based on the keyword, determine a code line corresponding to the keyword in a program code file loaded into the running memory; wherein the program code file is non-encrypted content; An analysis module, used for analyzing the function type based on the code content of the code line; An acquisition module, configured to acquire, based on the function type, operation data corresponding to the function type, wherein the operation data includes parameters and return values ​​of the function; The determination module is used to determine the encryption and decryption rules of the function type based on the parameters and return values ​​of the function.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any one of the above-mentioned methods for processing encryption and decryption algorithms in software is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for processing encryption and decryption algorithms in software.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for processing encryption and decryption algorithms in software.

[0015] The present invention provides a method, device, equipment and medium for processing encryption and decryption algorithms in software, which searches for the required content in the non-encrypted code content in the running memory, and estimates the rules of the encryption and decryption algorithms used in the encrypted content of the software based on the searched content. Based on the estimated rules, the security defense means of the APP are broken through to try to find loopholes and achieve security test verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of a method for processing encryption and decryption algorithms in software provided by the present invention.

[0018] Figure 2 It is a structural schematic diagram of a device for processing encryption and decryption algorithms in software provided by the present invention.

[0019] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Combine the following Figure 1-Figure 3 The present invention describes the method, device, equipment and medium for processing encryption and decryption algorithms in software.

[0022] Figure 1 A schematic diagram of a process for processing an encryption and decryption algorithm in software provided by the present invention is shown in FIG. Figure 1 , the method comprises the following steps: Step 11: determining a keyword, and determining a code line corresponding to the keyword in a program code file loaded into the running memory based on the keyword; wherein the program code file is non-encrypted content; Step 12: Analyze the function type based on the code content of the code line; Step 13: Based on the function type, obtain the operation data corresponding to the function type, where the operation data includes the parameters and return value of the function; Step 14: Determine the encryption and decryption rules of the function type based on the function's parameters and return values.

[0023] Regarding steps 11 to 14, it should be noted that in the field of APP security testing, as the attack and defense technologies continue to upgrade, APPs often use shells and traffic encryption to defend against common security attacks. As a security tester, you need to break through the APP's security defense measures during the testing process to try to find vulnerabilities.

[0024] When the software is running in the terminal, the code of the apk package of the software will be loaded into the terminal's running memory. If the code of the apk package contains encrypted content, it needs to be decrypted before loading into the terminal's running memory. It can be seen that regardless of whether the code content is encrypted or decrypted, the state of the code content in the running memory is in plain text. Therefore, for software files with encrypted content, the required content can be searched in the non-encrypted code content in the running memory, and the rules of the encryption and decryption algorithm used in the encrypted content of the software can be estimated based on the searched content. Based on the estimated rules, break through the security defense measures of the APP to try to find vulnerabilities and achieve security test verification.

[0025] Based on the above-mentioned design concept, the method needs to obtain a keyword for search, which can be determined by analyzing the characteristics of various known encryption and decryption functions in the code file. Then the keyword is searched through the program code files of the non-encrypted content loaded into the terminal's running memory to obtain the code line containing the keyword.

[0026] Then, the code content of the obtained code line is analyzed to see whether it has function characteristics. After the analysis, the function type that may be used by the software is obtained.

[0027] Then, the software is actually executed on the terminal to obtain operation data. At this time, the operation data corresponding to the function type is filtered out based on the obtained function type. The operation data can reflect the parameters and return values ​​of the function during execution.

[0028] Finally, the numerical change process of these parameters and return values ​​is analyzed to determine the encryption and decryption rules of the function type. Based on the estimated rules, the security defense measures of the APP are broken to try to find vulnerabilities and achieve security test verification.

[0029] The method for processing encryption and decryption algorithms in software provided by the present invention searches for the required content in the non-encrypted code content in the running memory, and estimates the rules of the encryption and decryption algorithms used in the encrypted content of the software based on the searched content. Based on the estimated rules, the security defense means of the APP are broken through to try to find loopholes and achieve security test verification.

[0030] In a further method of the above method, the explanation of the process of analyzing the function type based on the code content of the code line is as follows: According to the code content of the code line, the coding features in the code content are extracted; According to the code content of the code line, obtain the context code content associated with the code content; Extracting coding features from contextual code content; The function type is determined based on coding features in the code content and coding features in the context code content.

[0031] In this regard, it should be noted that, in the present invention, the compilation of the code has its own characteristics, and therefore, coding features can be extracted from the code content of the retrieved code lines.

[0032] Since a single line of code may not fully express the code execution function, the context code content associated with the code content can be obtained. Accordingly, the encoding features in the context code content are also extracted.

[0033] Since these encoding features are associated with function types, the function types can be estimated based on these acquired encoding features.

[0034] Furthermore, it is necessary to explain the process of determining the function type based on the coding features in the code content and the coding features in the context code content, as follows: The coding features in the code content are filtered out in a first feature library to obtain a first result; wherein the first feature library stores the correspondence between the coding features in the code content and the function type; The coding features in the context code content are filtered out in a second feature library to obtain a second result; wherein the second feature library stores the corresponding relationship between the coding features in the code content, the coding features in the context code content and the function type; Based on the first result and the second result, a function type is determined.

[0035] In this regard, it should be noted that, in the present invention, the first feature library stores the correspondence between the coding features in the code content and the function types.

[0036] For example, coding feature A in the code content—function type Z—50% means that the coding feature in the code content is A, and the probability of being function type Z is 50%.

[0037] Coding feature A in the code content—function type X—30%, which means that the coding feature in the code content is A, and the probability of being function type X is 30%.

[0038] Coding feature A in the code content—function type C—30%, which means that the coding feature in the code content is A, and the probability of becoming function type C is 20%.

[0039] The second feature library stores the correspondence between the coding features in the code content, the coding features in the context code content, and the function types.

[0040] For example, coding feature A in code content—coding feature Q in context code content—function type X—30%. The coding feature A in the code content represented by this code is combined with coding feature Q in context code content, and the probability of function type X is 30%.

[0041] For example, coding feature A in the code content—coding feature Q in the context code content—function type Z—20%. The coding feature A in the code content represented by this code is combined with coding feature Q in the context code content, and the probability of it becoming function type Z is 20%.

[0042] For example, coding feature A in the code content—coding feature Q in the context code content—function type V—50%. The coding feature A in the code content represented by this code is combined with the coding feature Q in the context code content, and the probability of it becoming function type V is 50%.

[0043] At this time, based on the above-mentioned first result and second result, the sum of the probabilities of each function type can be calculated.

[0044] For example, coding feature A in the code content—function type Z—50% means that the coding feature in the code content is A, and the probability of becoming function type Z is 50%, and coding feature A in the code content—coding feature Q in the context code content—function type Z—20% means that the coding feature A in the code content and the coding feature Q in the context code content are combined, and the probability of becoming function type Z is 20%, and the sum of the probabilities of obtaining function type Z is 70%.

[0045] Accordingly, the probability of function type X is 60%, function type C is 20%, and function type V is 50%.

[0046] All the function types that can be determined are Z. That is, based on the first result and the second result, the function type with the largest sum of probabilities is selected as the determined function type.

[0047] In the further method of the above method, the processing process of determining the encryption and decryption rules of the function type based on the parameters and return values ​​of the function is mainly explained as follows: Based on the function's parameters and return values, determine the changing rules between the parameters and return values; Analyze the calling rules of function types based on the characteristics of the function's call stack; Determine the encryption and decryption rules of the function type based on the change rules and calling rules.

[0048] In this regard, it should be noted that in the present invention, during the execution of a function, parameters may be input and return values ​​may be returned. Therefore, for changes in such numerical values, the change pattern between the parameters and the return values ​​may be preliminarily predicted.

[0049] It is not easy to determine the encryption and decryption rules of the function type simply by relying on the change rules. Therefore, based on the characteristics of the function call stack, the calling rules of the function type are analyzed. The calling rules can represent the changes in the calling address of the information during the calling process, and the calling address can represent the usage status of the information at the address.

[0050] To this end, the encryption and decryption rules of the function type are predicted based on the combination of the change rules and the calling rules.

[0051] The present invention searches for the required content in the non-encrypted code content in the running memory, and estimates the rules of the encryption and decryption algorithms used in the encrypted content of the software based on the searched content. Based on the estimated rules, the security defense means of the APP are broken through to try to find loopholes and achieve security test verification.

[0052] The following is a description of a device for processing encryption and decryption algorithms in software provided by the present invention. The device for processing encryption and decryption algorithms in software described below and the method for processing encryption and decryption algorithms in software described above can refer to each other.

[0053] Figure 2 A schematic diagram of the structure of a device for processing encryption and decryption algorithms in software provided by the present invention is shown. Figure 2 The device includes a search module 21, an analysis module 22, an acquisition module 23 and a determination module 24, wherein: A search module 21, used to determine a keyword, and based on the keyword, determine a code line corresponding to the keyword in a program code file loaded into the running memory; wherein the program code file is non-encrypted content; An analysis module 22, used to analyze the function type based on the code content of the code line; An acquisition module 23, configured to acquire operation data corresponding to the function type based on the function type, the operation data including parameters and return values ​​of the function; The determination module 24 is used to determine the encryption and decryption rules of the function type based on the parameters and return values ​​of the function.

[0054] In a further embodiment of the above device, the analysis module is specifically used for: According to the code content of the code line, the coding features in the code content are extracted; According to the code content of the code line, obtain the context code content associated with the code content; Extracting coding features from contextual code content; The function type is determined based on coding features in the code content and coding features in the context code content.

[0055] In a further device of the above device, the analysis module, in the process of determining the function type based on the coding features in the code content and the coding features in the context code content, is specifically used to: The coding features in the code content are filtered out in a first feature library to obtain a first result; wherein the first feature library stores the correspondence between the coding features in the code content and the function type; The coding features in the context code content are filtered out in a second feature library to obtain a second result; wherein the second feature library stores the corresponding relationship between the coding features in the code content, the coding features in the context code content and the function type; Based on the first result and the second result, a function type is determined.

[0056] In a further device of the above device, the determining module is specifically used for: Based on the function's parameters and return values, determine the changing rules between the parameters and return values; Analyze the calling rules of function types based on the characteristics of the function's call stack; Determine the encryption and decryption rules of the function type based on the change rules and calling rules.

[0057] The device for processing encryption and decryption algorithms in software provided by the present invention searches for the required content in the non-encrypted code content in the running memory, and estimates the rules of the encryption and decryption algorithms used in the encrypted content of the software based on the searched content. Based on the estimated rules, the security defense means of the APP are broken through to try to find loopholes and achieve security test verification.

[0058] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 31 (processor), a communication interface 32 (Communications Interface), a memory 33 (memory) and a communication bus 34, wherein the processor 31, the communication interface 32, and the memory 33 communicate with each other through the communication bus 34. The processor 31 may call the logic instructions in the memory 33 to execute a method for processing the encryption and decryption algorithm in the software, the method comprising: determining a keyword, and determining a code line corresponding to the keyword in a program code file loaded into the running memory based on the keyword; wherein the program code file is non-encrypted content; analyzing the function type based on the code content of the code line; obtaining the running data corresponding to the function type based on the function type, the running data including the parameters and return value of the function; determining the encryption and decryption rules of the function type based on the parameters and return value of the function.

[0059] In addition, the logic instructions in the above-mentioned memory 33 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0060] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the processing method of the encryption and decryption algorithm in the software provided by the above-mentioned methods, and the method includes: determining a keyword, and based on the keyword, determining a code line corresponding to the keyword in a program code file loaded into the running memory; wherein the program code file is non-encrypted content; based on the code content of the code line, analyzing the function type; based on the function type, obtaining running data corresponding to the function type, the running data including the function parameters and return value; based on the function parameters and return value, determining the encryption and decryption rules of the function type.

[0061] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the processing method for the encryption and decryption algorithm in the software provided by the above-mentioned methods, the method comprising: determining a keyword, and based on the keyword, determining a code line corresponding to the keyword in a program code file loaded into the running memory; wherein the program code file is non-encrypted content; based on the code content of the code line, analyzing the function type; based on the function type, obtaining running data corresponding to the function type, the running data including the parameters and return value of the function; based on the parameters and return value of the function, determining the encryption and decryption rules of the function type.

[0062] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0063] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing encryption and decryption algorithms in software, characterized in that: include: Determine a keyword, and determine a code line corresponding to the keyword in a program code file loaded into the running memory based on the keyword; wherein the program code file is non-encrypted content; Analyze the function type based on the code content of the code line; Based on the function type, acquiring operation data corresponding to the function type, the operation data including parameters and return values ​​of the function; Based on the parameters and return value of the function, encryption and decryption rules of the function type are determined.

2. The method for processing encryption and decryption algorithms in software according to claim 1, characterized in that: The function type is analyzed based on the code content of the code line, including: Extracting coding features in the code content according to the code content of the code line; According to the code content of the code line, obtaining context code content associated with the code content; Extracting coding features from the context code content; A function type is determined based on coding features in the code content and coding features in the context code content.

3. The method for processing encryption and decryption algorithms in software according to claim 2, characterized in that: The determining the function type based on the coding features in the code content and the coding features in the context code content includes: The coding features in the code content are filtered out in a first feature library to obtain a first result; wherein the first feature library stores the correspondence between the coding features in the code content and the function type; The coding features in the context code content are filtered out in a second feature library to obtain a second result; wherein the second feature library stores the corresponding relationship between the coding features in the code content, the coding features in the context code content and the function type; Based on the first result and the second result, a function type is determined.

4. The method for processing encryption and decryption algorithms in software according to claim 1, characterized in that: The step of determining the encryption and decryption rules of the function type based on the parameters and return value of the function includes: Based on the parameters and return values ​​of the function, determining the changing rules between the parameters and the return values; Analyze the calling rules of the function type based on the characteristics of the function call stack; Based on the change rule and the calling rule, an encryption and decryption rule of the function type is determined.

5. A device for processing encryption and decryption algorithms in software, characterized in that: include: A search module, used to determine a keyword, and based on the keyword, determine a code line corresponding to the keyword in a program code file loaded into the running memory; wherein the program code file is non-encrypted content; An analysis module, used for analyzing the function type based on the code content of the code line; An acquisition module, configured to acquire, based on the function type, operation data corresponding to the function type, wherein the operation data includes parameters and return values ​​of the function; The determination module is used to determine the encryption and decryption rules of the function type based on the parameters and return values ​​of the function.

6. The device for processing encryption and decryption algorithms in software according to claim 5, characterized in that: The analysis module is specifically used for: Extracting coding features in the code content according to the code content of the code line; According to the code content of the code line, obtaining context code content associated with the code content; Extracting coding features from the context code content; A function type is determined based on coding features in the code content and coding features in the context code content.

7. The device for processing encryption and decryption algorithms in software according to claim 5, characterized in that: The analysis module, in the process of determining the function type based on the coding features in the code content and the coding features in the context code content, is specifically used to: The coding features in the code content are filtered out in a first feature library to obtain a first result; wherein the first feature library stores the correspondence between the coding features in the code content and the function type; The coding features in the context code content are filtered out in a second feature library to obtain a second result; wherein the second feature library stores the corresponding relationship between the coding features in the code content, the coding features in the context code content and the function type; Based on the first result and the second result, a function type is determined.

8. The device for processing encryption and decryption algorithms in software according to claim 5, characterized in that: The determination module is specifically used for: Based on the parameters and return values ​​of the function, determining the changing rules between the parameters and the return values; Analyze the calling rules of the function type based on the characteristics of the function call stack; Based on the change rule and the calling rule, an encryption and decryption rule of the function type is determined.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for processing the encryption and decryption algorithm in the software is implemented as described in any one of claims 1-4.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for processing the encryption and decryption algorithm in the software is implemented as described in any one of claims 1 to 4.

Images