Executable program intercepting method and device, equipment and storage medium
By calling the handler at the kernel level of the operating system to obtain the binary file and file path of the executable file, and intercepting and judgment at the user level, the problem of high complexity of obtaining source code and complexity of dynamic library injection scheme in the existing technology is solved, and the problem of high complexity of obtaining source code and dynamic library injection scheme in realization Intercepting static links and embedded functions improves the interception efficiency and comprehensiveness of executable programs.
Patent Information
- Application Number
- CN202411155844.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-22
- Publication Date
- 2025-01-10
AI Technical Summary
The prior art has problems in executable program interception with high complexity of obtaining complete source code, complexity and stability of dynamic library injection schemes, and invalid interception of static linking and embedded function.
By calling the handler from the preset program list at the operating system kernel level, obtaining the binary file and file path of the executable file, and intercepting and judgment at the user level, avoiding modification and recompiling of the source code, and realizing static linking and Monitoring and intercepting embedded functions.
Improve the interception efficiency and comprehensiveness of executable programs, avoid the complexity and instability of dynamic library injection, realize system call monitoring of all executable programs, significantly improve detection accuracy and system response to complex threats ability.
Smart Images
Figure CN119299117A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to an executable program interception method, device, equipment and storage medium. Background Art
[0002] In operating systems, especially systems like Linux, executable programs are almost everywhere. In many business scenarios, especially in the field of security software, it is necessary to obtain the contents of executable program files to be executed and parse these contents to determine whether the program is a malicious program and to block or release it.
[0003] Currently, the interception of executable programs can be done by recompiling and inserting detection code into the source code of the executable program so that detection can be performed when the executable program is started. Although this method can effectively detect when the executable program is started, it requires that the complete source code must be obtained, and the recompiling process is relatively complicated and difficult. Summary of the invention
[0004] The present application provides an executable program interception method, apparatus, device and storage medium, which can improve the efficiency and comprehensiveness of executable program interception.
[0005] In order to achieve the above objectives, this application adopts the following technical solutions:
[0006] In a first aspect of an embodiment of the present application, a method for intercepting an executable program is provided, the method comprising:
[0007] When detecting that the executable file is executed, the system kernel calls a processing program from a preset program list according to a first processing function; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located at the first position in the program list;
[0008] Obtaining a binary file and a file path of the executable file using the processing program, and transmitting the binary file and the file path to a user layer;
[0009] At the user layer, it is determined whether the executable file is intercepted according to the binary file and / or the file path.
[0010] As a possible implementation manner, before detecting that the executable file is executed, the method further includes:
[0011] The registration function in the system kernel is called to add the structure of the processing program to the first position in the program list.
[0012] As a possible implementation manner, the using the processing program to obtain the binary file of the executable file includes:
[0013] Parsing the executable file using the processing program to obtain a binary file of the executable file;
[0014] Alternatively, the processing program is used to obtain the file path of the executable file, and the file path is transmitted to the user layer, so as to obtain the binary file from the user layer according to the file path.
[0015] As a possible implementation manner, determining at the user layer whether the executable file is intercepted according to the binary file and / or the file path includes:
[0016] A second processing function preset in the user layer is used to determine whether the executable file is intercepted based on the binary file and the file path.
[0017] As a possible implementation manner, the determining whether the executable file is intercepted based on the binary file and the file path by using the second processing function preset in the user layer includes:
[0018] Using the second processing function to detect the character string and the function in the binary file, to obtain a first detection result;
[0019] Using the second processing function to detect the storage location corresponding to the file path and the files in the storage location, to obtain a second detection result;
[0020] Determine whether the executable file is intercepted according to the first detection result and / or the second detection result.
[0021] As a possible implementation manner, determining whether the executable file is intercepted according to the first detection result and / or the second detection result includes:
[0022] Generate a return value according to the first detection result and / or the second detection result, and transmit the return value to the system kernel;
[0023] The system kernel determines whether the executable file is intercepted according to the return value.
[0024] As a possible implementation manner, the method further includes:
[0025] If the processing time of determining whether the executable file is intercepted based on the binary file and the file path by using the second processing function of the user layer is greater than a preset time, the executable file is executed.
[0026] A second aspect of an embodiment of the present application provides an executable program interception device, the device comprising:
[0027] A calling module, configured to, when detecting that the executable file is executed, cause the system kernel to call a processing program from a preset program list; wherein the processing program is a program pre-registered in the program list, and the processing program is located at the first position in the program list;
[0028] an acquisition module, used for acquiring a binary file and a file path of the executable file by using the processing program, and transmitting the binary file and the file path to a user layer;
[0029] A determination module is used to determine whether the executable file is intercepted based on the binary file and / or the file path at the user layer.
[0030] According to a third aspect of an embodiment of the present application, there is provided an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method for intercepting the executable program in the first aspect of the embodiment of the present application is implemented.
[0031] According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for intercepting the executable program in the first aspect of the embodiments of the present application is implemented.
[0032] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:
[0033] The method for intercepting an executable program provided in an embodiment of the present application is that when it is detected that an executable file is executed, the system kernel calls a handler according to a first processing function from a preset program list; wherein the first processing function corresponding to the handler is pre-registered in the program list, and the first processing function is located at the first position in the program list; then the handler is used to obtain the binary file and file path of the executable file, and the binary file and the file path are transmitted to the user layer, and finally at the user layer, it is determined whether the executable file is intercepted according to the binary file and / or file path. In this way, the executable file is detected and intercepted at the operating system kernel level, without modifying or recompiling the source code of the executable program, which can improve the efficiency and comprehensiveness of intercepting the executable program. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Figure 1 A flowchart of an executable program interception method provided in an embodiment of the present application;
[0035] Figure 2 A structural diagram of an executable program interception device provided in an embodiment of the present application;
[0036] Figure 3 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0038] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.
[0039] Additionally, the use of “based on” or “according to” is meant to be open and inclusive, as a process, step, calculation, or other action “based on” or “according to” one or more conditions or values may, in practice, be based on additional conditions or beyond values.
[0040] In operating systems, especially systems like Linux, executable programs are almost everywhere. In many business scenarios, especially in the field of security software, it is necessary to obtain the contents of executable program files to be executed and parse these contents to determine whether the program is a malicious program and to block or release it.
[0041] Currently, the interception of executable programs can be done by recompiling and inserting detection code into the source code of the executable program so that detection can be performed when the executable program is started. Although this method can effectively detect when the executable program is started, it requires that the complete source code must be obtained, and the recompiling process is relatively complicated and difficult.
[0042] Another method is to use the LD_PRELOAD injection method, by writing and compiling a dynamic library containing the detection code, and then setting the LD_PRELOAD environment variable when running the parent program to inject the dynamic library into the parent program. In the dynamic library, the execve method is intercepted by the Hook technology, and the detection code is executed before the child program starts. However, this method is complex and unstable. Although this method can realize the detection when the child program starts without modifying the source code of the parent program, for example, LD_PRELOAD cannot take effect for statically linked subprograms or functions directly included in the executable file.
[0043] In other words, the current interception method for executable programs has the following problems:
[0044] The difficulty of obtaining the complete source code for recompiling: Many programs, especially commercial software, do not provide source code, and users cannot obtain and modify these programs. Even for open source software, obtaining the complete source code, understanding its structure and making modifications requires a high level of professional skills and sufficient time. Recompiling the entire program involves complex compilation environment configuration and dependency management. If there is a lack of in-depth understanding of the original code, it is easy to introduce errors or cause the compilation process to fail.
[0045] Complexity and stability issues of dynamic library injection scheme: LD_PRELOAD is a method of injecting custom code while the program is running by preloading a dynamic link library. This method relies on the dynamic link mechanism of the operating system and requires writing and compiling a special dynamic library and injecting it into the target program through environment variables. This ensures that the injected code is compatible with the target program and its operating environment. Due to differences in various programs and operating system versions, dynamic library injection may cause unexpected conflicts, memory leaks, or program crashes, making it difficult to ensure the stability and reliability of the system.
[0046] Ineffective interception of statically linked and embedded functions: The LD_PRELOAD method can only intercept functions called through dynamic link libraries, and is ineffective for statically linked programs and embedded functions that execute executable programs. Static link programs embed all dependent library functions directly into the executable file during compilation, and do not rely on external dynamic libraries during runtime, resulting in LD_PRELOAD being unable to redirect these function calls. Similarly, embedded functions are directly inserted into the code during compilation, bypassing the dynamic linking process, which makes the dynamic library-based redirection method unable to work on these functions.
[0047] In order to solve the above problems, the present application embodiment provides an executable program interception method, such as Figure 1 As shown, the method comprises the following steps:
[0048] Step 101, when detecting that an executable file is executed, the system kernel calls a processing program from a preset program list according to a first processing function; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located first in the program list.
[0049] The processing list may be a format list in the Linux kernel symbol table kallsyms. The processing function corresponding to the processing program, that is, the first processing function, is pre-registered in the program list, and the first processing function is located at the first position in the program list.
[0050] It should be noted that in the operating system, taking Linux as an example, there are two layers at a macro level, namely the kernel layer and the user layer. The kernel layer is mainly responsible for some system-level operations, memory management, IO operations, process management, file system, etc. The user layer mainly runs various applications, such as browsers, word processors, image editors, etc.
[0051] The program list includes identifiers or structures of multiple programs. When executing a file, the system kernel needs to traverse the programs in the program list in sequence and call the matching program to execute the file according to the file header information of the execution file.
[0052] Optionally, before detecting that the executable file is executed in step 101, the method further includes: calling a registration function in the system kernel to add the structure of the processing program to the first position in the program list.
[0053] The registration function may be a register_binfmt function, and the prototype of the registration function is defined as: int register_binfmt (struct linux_binfmt*fmt), wherein the struct linux_binfmt structure includes relevant information of the processing program, such as a first processing function pointer and the like.
[0054] Furthermore, by adding the structure of the processing program to the first position in the program list, when the executable file is executed, the processing program can be called first to detect the executable program.
[0055] Step 102: Utilize the processing program to obtain the binary file and the file path of the executable file, and transmit the binary file and the file path to the user layer.
[0056] Step 103: Determine at the user layer whether the executable file is intercepted according to the binary file and / or file path.
[0057] If it is determined according to the binary file and / or the file path that the executable file has no abnormality, the executable file continues to be executed; if it is determined according to the binary file and / or the file path that the executable file has an abnormality, the execution process of the executable file is interrupted.
[0058] The method for intercepting an executable program provided in an embodiment of the present application is that when it is detected that an executable file is executed, the system kernel calls a handler from a preset program list, wherein the handler is a program pre-registered in the program list, and the handler is located at the first position in the program list, and then uses the handler to obtain the binary file and file path of the executable file, and transmits the binary file and the file path to the user layer, and finally determines at the user layer whether the executable file is intercepted based on the binary file and / or file path. In this way, the executable file is detected and intercepted at the operating system kernel level, without modifying or recompiling the source code of the executable program, which can improve the efficiency and comprehensiveness of intercepting the executable program.
[0059] Optionally, the process of using the processing program to obtain the binary file of the executable file in step 102 may be:
[0060] Parsing the executable file using the processing program to obtain a binary file of the executable file;
[0061] Alternatively, the processing program is used to obtain the file path of the executable file, and the file path is transmitted to the user layer, so as to obtain the binary file from the user layer according to the file path.
[0062] In the actual execution process, when an executable file is detected to be executed, the system kernel will call the handler. This handler will first read the path of the executable file and its binary content. Here, the file reading function provided by the kernel is used to complete these operations and record them according to the requirements.
[0063] Optionally, the above step 103 determines at the user layer whether the executable file is intercepted according to the binary file and / or the file path, including:
[0064] A second processing function preset in the user layer is used to determine whether the executable file is intercepted based on the binary file and the file path.
[0065] Specifically, the above-mentioned using the second processing function preset in the user layer to determine whether the executable file is intercepted based on the binary file and the file path includes:
[0066] Using the second processing function to detect the character string and the function in the binary file, to obtain a first detection result;
[0067] The second processing function is used to detect the storage location corresponding to the file path and the files in the storage location to obtain a second detection result; and according to the first detection result and / or the second detection result, it is determined whether the executable file is intercepted.
[0068] In the actual execution process, the character strings and functions in the binary file can be detected. If the character strings and functions include sensitive information or sensitive instructions, it can be determined that the binary file includes abnormal information, and the first detection result obtained indicates that the binary file includes abnormal information. The sensitive information and sensitive instructions are information or instructions related to malicious network behavior.
[0069] It is also possible to detect whether there is an abnormality in the storage location and the files in the storage location by detecting the storage location corresponding to the file path. If so, a second detection result is obtained indicating that the binary file includes abnormal information.
[0070] Further, the process of determining whether the executable file is intercepted according to the first detection result and / or the second detection result may be:
[0071] A return value is generated according to the first detection result and / or the second detection result, and the return value is transmitted to the system kernel, and the system kernel determines whether the executable file is intercepted according to the return value.
[0072] During the actual execution process, the detection function may generate a return value according to the first detection result and / or the second detection result, and transmit the return value to the system kernel, and the system kernel determines whether the executable file is intercepted according to the return value.
[0073] According to the return value of the second processing function of the user layer, the kernel decides whether to continue to execute the executable file. If the return value indicates that the executable file has no exception, the kernel will enter the process of loading and executing the executable file. If the return value indicates that the executable file has an exception, the kernel will terminate the process of executing the executable file and return an error code.
[0074] Optionally, the method further includes: if the processing process of determining whether the executable file is intercepted based on the binary file and the file path using the second processing function of the user layer is greater than a preset time length, then executing the executable file.
[0075] That is, if the processing of the second processing function at the user layer times out, in order to ensure user experience, the system will authorize the continued execution of the executable file by default.
[0076] The interception method of the executable program provided in the embodiment of the present application is that when the executable file is detected to be executed, the system kernel calls the processing program according to the first processing function from the preset program list; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located in the first place in the program list; then the processing program is used to obtain the binary file and file path of the executable file, and the binary file and the file path are transmitted to the user layer, and finally the user layer determines whether the executable file is intercepted according to the binary file and / or the file path. In this way, the executable file is detected and intercepted at the operating system kernel level, without modifying or recompiling the source code of the executable program, which can improve the interception efficiency and comprehensiveness of the executable program. In addition, the method of the present application avoids the complexity and instability of dynamic library injection, and improves the simplicity and reliability of the solution. At the same time, it can monitor all system calls that execute executable programs, including static link programs and embedded functions, to achieve more comprehensive interception and control. Further, from a practical point of view, the method of the present application overcomes many shortcomings of previous detection and interception methods, and can significantly improve the generalization ability and detection accuracy. This method not only expands the scope of application of detection and interception, but also significantly improves the system's ability to cope with complex threat environments and the accuracy of detection, providing users with more reliable and efficient security protection.
[0077] like Figure 2 As shown, an embodiment of the present application provides an executable program interception device, the device comprising:
[0078] The calling module 11 is used for, when detecting that the executable file is executed, the system kernel calls the processing program according to the first processing function from the preset program list; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located at the first position in the program list;
[0079] An acquisition module 12, configured to acquire a binary file and a file path of the executable file by using the processing program, and transmit the binary file and the file path to a user layer;
[0080] The determination module 13 is used to determine whether the executable file is intercepted according to the binary file and / or the file path at the user layer.
[0081] In one embodiment, the device further includes a configuration module 14, and the configuration module 14 is specifically configured to:
[0082] The registration function in the system kernel is called to add the structure of the processing program to the first position in the program list.
[0083] In one embodiment, the acquisition module 12 is specifically used for:
[0084] Parsing the executable file using the processing program to obtain a binary file of the executable file;
[0085] Alternatively, the processing program is used to obtain the file path of the executable file, and the file path is transmitted to the user layer, so as to obtain the binary file from the user layer according to the file path.
[0086] In one embodiment, the determination module 13 is specifically configured to:
[0087] A second processing function preset in the user layer is used to determine whether the executable file is intercepted based on the binary file and the file path.
[0088] In one embodiment, the determination module 13 is specifically configured to:
[0089] Using the second processing function to detect the character string and the function in the binary file, to obtain a first detection result;
[0090] Using the second processing function to detect the storage location corresponding to the file path and the files in the storage location, to obtain a second detection result;
[0091] Determine whether the executable file is intercepted according to the first detection result and / or the second detection result.
[0092] In one embodiment, the determination module 13 is specifically configured to:
[0093] Generate a return value according to the first detection result and / or the second detection result, and transmit the return value to the system kernel;
[0094] The system kernel determines whether the executable file is intercepted according to the return value.
[0095] In one embodiment, the determination module 13 is further configured to:
[0096] If the processing time of determining whether the executable file is intercepted based on the binary file and the file path by using the second processing function of the user layer is greater than a preset time, the executable file is executed.
[0097] The executable program interception device provided in this embodiment can execute the above-mentioned executable program interception method embodiment, and its implementation principle and technical effect are similar, which will not be elaborated here.
[0098] For the specific definition of the interception device of the executable program, please refer to the definition of the interception method of the executable program above, which will not be repeated here. The various modules in the above-mentioned interception device of the executable program can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor of the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0099] The execution subject of the interception method of the executable program provided in the embodiment of the present application can be an electronic device, which can be a computer device, a terminal device, a server or a server cluster, and the embodiment of the present application does not make any specific limitations on this.
[0100] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of the present application. Figure 3 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor is used to provide computing and control capabilities. The memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The computer program can be executed by the processor to implement the steps of the interception method of the executable program provided in each of the above embodiments. The internal memory provides a cached operating environment for the operating system and the computer program in the non-volatile storage medium.
[0101] Those skilled in the art will understand that Figure 3 The internal structure diagram of the electronic device shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0102] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the interception method of the executable program in the embodiment of the present application are implemented.
[0103] In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer instructions. When the computer instructions execute the various steps of the interception method executed by the executable program in the method flow shown in the above method embodiment.
[0104] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer execution instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).
[0105] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0106] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A method for intercepting an executable program, characterized in that: The method comprises: When detecting that the executable file is executed, the system kernel calls a processing program from a preset program list according to a first processing function; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located at the first position in the program list; Obtaining a binary file and a file path of the executable file using the processing program, and transmitting the binary file and the file path to a user layer; At the user layer, it is determined whether the executable file is intercepted according to the binary file and / or the file path.
2. The method according to claim 1, characterized in that Before detecting that the executable file is executed, the method further includes: The registration function in the system kernel is called to add the structure of the processing program to the first position in the program list.
3. The method according to claim 1, characterized in that The step of obtaining the binary file of the executable file by using the processing program includes: Parsing the executable file using the processing program to obtain a binary file of the executable file; Alternatively, the processing program is used to obtain the file path of the executable file, and the file path is transmitted to the user layer, so as to obtain the binary file from the user layer according to the file path.
4. The method according to claim 1, characterized in that Determining at the user layer whether the executable file is intercepted according to the binary file and / or the file path includes: A second processing function preset in the user layer is used to determine whether the executable file is intercepted based on the binary file and the file path.
5. The method according to claim 4, characterized in that The determining whether the executable file is intercepted based on the binary file and the file path by using the second processing function preset in the user layer includes: Using the second processing function to detect the character string and the function in the binary file, to obtain a first detection result; Using the second processing function to detect the storage location corresponding to the file path and the files in the storage location, to obtain a second detection result; Determine whether the executable file is intercepted according to the first detection result and / or the second detection result.
6. The method according to claim 5, characterized in that The determining, according to the first detection result and / or the second detection result, whether the executable file is intercepted includes: Generate a return value according to the first detection result and / or the second detection result, and transmit the return value to the system kernel; The system kernel determines whether the executable file is intercepted according to the return value.
7. The method according to claim 4, characterized in that The method further comprises: If the processing time of determining whether the executable file is intercepted based on the binary file and the file path by using the second processing function of the user layer is greater than a preset time, the executable file is executed.
8. An executable program interception device, characterized in that: The device comprises: A calling module, configured to, when detecting that the executable file is executed, cause the system kernel to call a processing program from a preset program list according to a first processing function; wherein the first processing function corresponding to the processing program is pre-registered in the program list, and the first processing function is located at the first position in the program list; an acquisition module, used for acquiring a binary file and a file path of the executable file by using the processing program, and transmitting the binary file and the file path to a user layer; A determination module is used to determine whether the executable file is intercepted based on the binary file and / or the file path at the user layer.
9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method for intercepting the executable program according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method for intercepting the executable program according to any one of claims 1 to 7 is implemented.