Process injection method and related equipment

Abstract

The embodiment of the invention provides a process injection method and related equipment, which are used for solving the problem of process injection of a binary file. The method comprises the steps of obtaining a target thin binary file in binary files; analyzing a file header and a loading instruction segment of the target thin binary file to obtain a blank area between the last loading instruction in the target thin binary file and the initial position of the data segment; generating a dynamic library dependency instruction according to the dynamic library information on which the binary file depends; calculating the address size of a target space occupied by the dynamic library dependency instruction; if the size of the target space address is larger than that of the blank area, obtaining a system architecture of the target thin binary file; calculating a target offset of the initial position of the data segment according to the system architecture and the size of the target space address; offsetting the initial position of the data segment by a target offset to obtain an increased blank area; and inserting a dynamic library dependency instruction into the increased blank area to realize process injection of the binary file.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security, and in particular to a process injection method and related equipment. Background Art

[0002] The main method of dynamic library injection on the early macOS platform was environment variable injection. By adding the environment variable "DYLD_INSERT_LIBRARIES=$Path" to the process to be executed, the dependent library represented by Path can be injected into the process. The process injected with the dynamic library is called a safe process and can access files and other data in the workspace. Among them, process injection is the basis of sandbox products and the prerequisite for the sandbox function to take effect. As a security mechanism, the sandbox belongs to virtualization technology, which provides an isolated environment for the executing program and restricts the files accessed and modified by the program to the isolated environment through redirection and other methods, so as to isolate and protect the operating system. Therefore, the injection described in this application aims to better protect user data and privacy from being stolen.

[0003] However, with the introduction of ARM architecture chips and protection mechanisms such as system integrity protection (SIP), the method of injecting dynamic libraries based on environment variables is subject to considerable restrictions. The SIP mechanism is enabled by default in the macOS system, and the method of injecting environment variables will become invalid after SIP is enabled. In addition, even if SIP is turned off, the macOS kernel level also greatly restricts this method, and even directly invalidates all environment variables starting with "DYLD_" to limit the tampering of the application layer with the process. Therefore, with the update of the macOS system and hardware, the method of injecting dynamic libraries based on environment variables at the application layer no longer works.

[0004] Therefore, how to solve the problem of failure of early environment variable injection is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a process injection method and related devices for solving the problem of process injection of binary files.

[0006] A first aspect of an embodiment of the present application provides a process injection method, including: Obtain a target thin binary file from a Mach-O format binary file, wherein the target thin binary file includes a file header, a load instruction segment, and a data segment; Parsing the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction in the target thin binary file and the starting position of the data segment; Generate a dynamic library dependency instruction according to the dynamic library information on which the Mach-O format binary file depends; Calculate the target space address size occupied by the dynamic library dependent instructions; If the target space address size is larger than the blank area, obtaining the system architecture of the target thin binary file; Calculating a target offset of a starting position of the data segment according to the system architecture and the target space address size; offsetting the starting position of the data segment by the target offset to obtain an enlarged blank area; The dynamic library dependency instruction is inserted into the enlarged blank area to implement process injection of the Mach-O format binary file.

[0007] Optionally, before offsetting the starting position of the data segment by the target offset to obtain the enlarged blank area, the method further includes: Removing signature information of the load instruction segment in the target thin binary file; After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The target thin binary file into which the dynamic library dependency instruction is inserted is re-signed.

[0008] Optionally, calculating the target offset of the starting position of the data segment according to the system architecture and the target space address size includes: Determining, according to the system architecture, an alignment data block size of a memory page of the system architecture; If the target space address size is an integer multiple of the alignment data block size, the target space address size is determined as the target offset; If the target space address size is a non-integer multiple of the alignment data block size, the target offset is determined to be greater than the target space address size and a minimum integer multiple of the alignment data block size.

[0009] Optionally, before obtaining the thin binary file in the Mach-O format binary file, the method further includes: Parsing a file header of the Mach-O format binary file to determine a file type of the Mach-O format binary file, wherein the file type includes a fat binary file and a thin binary file, and the fat binary file includes a plurality of thin binary files; If the Mach-O format binary file is a fat binary file, obtaining multiple thin binary files in the fat binary file respectively; Determine any thin binary file among the plurality of thin binary files as the target thin binary file; After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: According to the size of the dynamic library dependency instruction and the size of the target thin binary file before the dynamic library dependency instruction is inserted, a data value representing the size of the target thin binary file in the target thin binary file after the dynamic library dependency instruction is inserted is updated.

[0010] Optionally, the method further comprises: Determining a first target thin binary file among the plurality of thin binary files; For multiple target thin binary files after the first target thin binary file, according to the order of the multiple target thin binary files, the offset of the file header of the Nth target thin binary file after the first target thin binary file is correspondingly increased by N*target offset, wherein N≥1.

[0011] Optionally, after inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The offset of the target load instruction segment contained in the target thin binary file is increased by the target offset, wherein the target load instruction segment is an instruction segment representing an address and an offset in the load instruction segment.

[0012] Optionally, after inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: A blank field is inserted at the starting point of the data segment of the target thin binary file, wherein the size of the blank field is the target offset.

[0013] Optionally, after inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The offset of the target data segment contained in the target thin binary file is increased by the target offset, wherein the target data segment is a data segment representing an address or a pointer in the data segment.

[0014] Optionally, the dynamic library dependency instruction includes an instruction name, an instruction size and information about the dynamic library, wherein the information about the dynamic library includes a path of the dynamic library, or at least one of a timestamp of the dynamic library and a version number of the dynamic library, and the path of the dynamic library; The calculating the target space address size occupied by the dynamic library dependent instruction includes: Obtaining the instruction size of the dynamic library dependent instruction and the length of the dynamic library path; The target space address size is calculated according to the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

[0015] A second aspect of an embodiment of the present application provides a process injection system, including: An acquisition unit, configured to acquire a target thin binary file from a binary file in a Mach-O format, wherein the target thin binary file includes a file header, a load instruction segment, and a data segment; A parsing unit, used for parsing the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction in the target thin binary file and the starting position of the data segment; A generating unit, configured to generate a dynamic library dependency instruction according to the dynamic library information on which the Mach-O format binary file depends; A calculation unit, used for calculating the target space address size occupied by the dynamic library dependent instructions; The acquisition unit is further configured to acquire the system architecture of the target thin binary file when the target space address size is larger than the blank area; The calculation unit is further used to calculate the target offset of the starting position of the data segment according to the system architecture and the target space address size; An offset unit, used for offsetting the starting position of the data segment by the target offset to obtain an enlarged blank area; The insertion unit is used to insert the dynamic library dependency instruction into the enlarged blank area to achieve process injection of the Mach-O format binary file.

[0016] A third aspect of an embodiment of the present application provides a computer device, including: CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the process injection method described in the first aspect.

[0017] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the process injection method described in the first aspect.

[0018] A fifth aspect of an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer, the computer executes the process injection method described in the first aspect.

[0019] It can be seen from the above technical scheme that the embodiment of the present application has the following advantages: through a process injection method disclosed in the embodiment of the present application, a target thin binary file in a Mach-O format binary file is first obtained, and the target thin binary file includes a file header, a load instruction segment and a data segment; then the file header and the load instruction segment of the target thin binary file are parsed to obtain a blank area between the last load instruction and the starting position of the data segment in the target thin binary file; then, according to the dynamic library information on which the Mach-O format binary file depends, a dynamic library dependency instruction is generated; secondly, the target space address size occupied by the dynamic library dependency instruction is calculated; if the target space address size is larger than the blank area, the system architecture of the target thin binary file is obtained; then, according to the system architecture and the target space address size, the target offset of the starting position of the data segment is calculated; the starting position of the data segment is offset by the target offset to obtain the enlarged blank area; finally, the dynamic library dependency instruction is inserted into the enlarged blank area to realize process injection of the Mach-O format binary file.

[0020] It can be seen that the embodiment of the present application implements process injection by inserting dynamic library dependency instructions in the blank area between the load instruction and the data segment. This method of inserting dynamic library dependency instructions in the blank area between the load instruction and the data segment is not restricted by the SIP mechanism, so it improves the stability of process injection and system compatibility compared to the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0022] Figure 1 A Mach-O file structure diagram disclosed in an embodiment of the present application; Figure 2 A flowchart of a process injection method disclosed in an embodiment of the present application; Figure 3 A flowchart of another process injection method disclosed in an embodiment of the present application; Figure 4 A flowchart of another process injection method disclosed in an embodiment of the present application; Figure 5 A flowchart of another process injection method disclosed in an embodiment of the present application; Figure 6A flowchart of another process injection method disclosed in an embodiment of the present application; Figure 7 A flowchart of another process injection method disclosed in an embodiment of the present application; Figure 8 A schematic diagram of the structure of a process injection system disclosed in an embodiment of the present application; Fig. 9 A schematic diagram of the structure of a process injection device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] It should be noted in advance that this application has been applied to the Mac unified endpoint management (UEM) sandbox product, and the application scenario is application encapsulation. The ARM architecture macOS sandbox uses this solution to insert dependent library instructions into the binary when importing the application or binary execution to achieve application encapsulation and process injection. The process injected with the dynamic library is called a safe process, which can access files and other data in the workspace. Process injection is the basis of the sandbox product and the prerequisite for the sandbox function to take effect. Sandbox (also translated as sandbox) is a security mechanism and a virtualization technology. It provides an isolated environment for the executing program and restricts the files accessed and modified by the program to the isolated environment through redirection and other methods. Sandboxes are usually used to isolate and protect operating systems, and are also used for isolation between virtual environments and real environments, as well as between virtual environments. Among them, a dynamic link library (dynamic library) is a module containing functions and data that can be used by other applications or dynamic libraries. Dynamic linking allows a process to determine the export functions of a dependent library at load time or runtime. On the macOS platform, dynamic libraries are referred to as dylib. Application packaging refers to re-signing and packaging the application installation package (Android, iOS, macOS platform installation package program) and adding some new features to the running package program. For the convenience of description, the above terms will not be explained in the following.

[0025] To facilitate the description of the difference between the process injection method implemented in the embodiment of the present application and the original binary file, Figure 1 A Mach-O file structure diagram is given.

[0026] like Figure 1As shown, Mach-O files can be divided into two categories: fat binary and thin binary. Fat binary contains multiple architectures. On the macOS platform, fat binary generally contains x86_64 and arm64 architectures. The Fat Header in the fat binary contains a summary of the thin binary information contained in the file (such as the data starting point or the size of the space occupied by the binary of each architecture). The thin binary contains information such as the file header (Mach Header), load command segment (Load Commands), data segment (Segment Data), code signature (Code Signature), etc., where the Mach header of the thin binary indicates the number of load commands and the size of the space occupied. The load command segment includes one or more segment commands (Segment Command). After the valid content of the load command segment and before the valid content of the data segment, there is a blank area where instructions can be inserted. The binary of each architecture needs to insert dynamic library dependency instructions, because the macOS system on the ARM platform can also run the binary of the x86 architecture based on Rosetta escape. It should be noted that Rosetta is a binary compiler software designed to run software developed for the Power PC platform on Intel-based Mac computers. It is currently used to run software developed for the Intel platform on ARM-based Mac computers. Load Commands are part of the executable file in macOS and are used to instruct the dynamic linker to load the program with various information. Load Command contains a series of instructions that describe the various properties and requirements of the program, such as specifying the program's entry point, the location of the dynamic link library, the executable code segment, the data segment, and so on. These instructions are parsed by the dynamic linker when the executable file is loaded to determine the environment and resources required for the program to run.

[0027] based on Figure 1The described Mach-O file architecture, the following is a description of the method of process injection in the embodiment of the present application. Specifically, for the original Mach-O binary file, a dynamic library dependency instruction is written. If there is no space for the binary to write, the binary data after the write position is offset to leave enough space, and the offset data is corrected. Among them, for the Mach-O format, the Section name for recording the binary dependency library is Load Commands, and the instruction name is LC_LOAD_DYLIB. The present invention is to add a dynamic library dependency instruction LC_LOAD_DYLIB, the instruction content is the dynamic library path to be injected, and is written to the blank area at the end of the target binary Load Commands. For most binaries, due to memory alignment, there will be blank areas with no content between each Section. If the blank area is large enough to accommodate the dynamic library dependency instruction to be written, it can be written directly. But there are some exceptions. There is not enough blank area at the end of a small number of binary Load Commands Sections. If the instruction is forcibly added, the valid data of the binary will be overwritten, resulting in abnormal binary operation or even inability to run. In view of this situation, the present invention proposes a method for binary data offset, which offsets the data after the Load Commands area by a specified size, and then expands the effective space of the Load Commands area. At this time, there is enough blank area at the tail to accommodate the newly added instructions. After the data is offset, the offset data needs to be corrected, and the data representing the pointer or address in the data is mainly corrected to avoid pointing failure. Before modifying the binary data, the binary signature information needs to be removed, and the data needs to be re-signed after the data is modified.

[0028] For easier understanding, please refer to Figure 2 , Figure 2 This is a flowchart of a process injection method disclosed in an embodiment of the present application, including steps 201 to 208.

[0029] 201. Get the target thin binary file in the Mach-O format binary file.

[0030] Depend on Figure 1 As can be seen from the description, the dynamic library dependency instructions are mainly injected into the blank area between the load instruction segment and the data segment in the thin binary file. Therefore, it is necessary to obtain the target thin binary file in the Mach-O format binary file. It is not difficult to understand that if Figure 1 As shown, the target thin binary file includes a file header, a load instruction segment and a data segment.

[0031] In one specific embodiment, in a binary file in Mach-O format, if the binary file is a fat binary file, the fat binary file may include one or more thin binary files, wherein the file formats of the thin binary files are the same, and thus, the target thin binary file may be considered as any thin binary file among all the thin binary files. Furthermore, by traversing all architectures in the binary file in Mach-O format, all target thin binary files in the fat binary file may be determined. It is not difficult to understand that any thin binary file corresponds to a system architecture.

[0032] In another specific embodiment, if the binary file in Mach-O format is a thin binary file, then the thin binary file is the target thin binary file in the embodiment of the present application.

[0033] 202. Parse the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction and the start position of the data segment in the target thin binary file.

[0034] Based on step 201, the file header and the load instruction segment of the target thin binary file can be parsed, thereby obtaining the blank area between the last load instruction and the start position of the data segment in the target thin binary file.

[0035] In this embodiment, binary file parsing mainly includes parsing file headers and instruction loading segments. Among them, the file header refers to the starting area of ​​the binary file. For thin binary files, since the file header Mach Header of the thin binary file is the starting point of the binary data of the architecture to which it belongs, it records the number of instructions and the size of the space occupied by the current architecture. At the same time, the file size of the Mach Header is a fixed value, such as 4k or 2k, etc. (the file size of the Mach Header is not limited here). Therefore, by parsing the file header of the target thin binary file, the number of corresponding loading instruction segments and the size of the space occupied by them can be clearly known. Then, by the parsed number and the size of the space occupied, all loading instructions in the loading instruction segment can be traversed and parsed. Therefore, by parsing all loading instructions, one of the loading instructions can be found, and the loading instruction is an instruction for recording the data (_TEXT) segment code (_text) area. Therefore, according to the instruction, the starting position of the code area can be obtained. Among them, the code area is the first data area of ​​the data segment. Therefore, combined with the number of loading instruction segments described above and the size of the space occupied by them, and the position of the corresponding code area, the specific position of the blank area in the target thin binary file can be determined. It is not difficult to understand that the blank area before the code area and after the last instruction in the instruction segment is where the dynamic library dependency instructions are inserted.

[0036] Therefore, combined with the above description, it can be seen that the target thin binary file format in the Mach-O format binary file is an instruction segment + blank area + code area, and the position before the last instruction to the code area is a blank area. The structure of the file header (also called the architecture header) and the instruction segment is fixed, and its composition is described by a defined structure. The file header mainly contains the supported CPU architecture, the number of instructions in the instruction segment and the occupied space, etc., and parsing the file header is also to obtain this information. There are many types of instructions in the instruction segment, such as the LC_LOAD_DYLIB often mentioned here to describe the loading of dependent libraries, and the LC_SEGMENT_64 that describes the data area (Section), LC_CODE_SIGNATURE that describes the signature data area, etc., and the ones related to this application are LC_LOAD_DYLIB and LC_SEGMENT_64.

[0037] 203. Generate dynamic library dependency instructions according to the dynamic library information that the Mach-O format binary file depends on.

[0038] For the dynamic library information that needs to be called, it is necessary to generate dynamic library dependency instructions based on the dynamic library information that the Mach-O format binary file depends on.

[0039] In one of the specific embodiments, since the dynamic library information cannot be directly inserted into the Mach-O format binary file, it is necessary to generate an instruction to call the dynamic library information, and the instruction is the dynamic library dependency instruction described above. Specifically, the dynamic library dependency instruction at least includes the calling path of the dynamic library, and in addition, it may also include the instruction name, instruction size or dynamic library information (timestamp or version number), etc. Specifically, the content contained in the dynamic library dependency instruction is not limited here.

[0040] 204. Calculate the target space address size occupied by the dynamic library dependent instructions.

[0041] After the dynamic library dependency instructions are generated, the address size of the space occupied by the dynamic library dependency instructions can be calculated.

[0042] In one specific embodiment, the address space occupied by the dynamic library dependent instruction can be calculated first, and then the dynamic library path length corresponding to the dynamic library call can be calculated, so as to determine the target space address size according to the address space occupied by the dynamic library path length and the address space occupied by the dynamic library dependent instruction. That is to say, when calculating the target space address size, it is necessary not only to calculate the instruction size of the dynamic library dependent instruction, but also to calculate the size of the dynamic library path length. For ease of understanding and description, please refer to Figure 6 The embodiment shown.

[0043] 205. When the target space address size is larger than the blank area, the system architecture of the target thin binary file is obtained.

[0044] After determining the target space address size, the target space address size and the size of the blank area can be determined. Therefore, if the target space address size is larger than the blank area, the system architecture of the target thin binary file is obtained. Because the alignment size of the data block in the memory page is different for different system architectures, this will result in different offsets when calculating the offset.

[0045] In one of the specific embodiments, when it is determined that the target space address size is larger than the blank area, the forced insertion of instructions and the subsequent re-signing will cause the code area of ​​the data segment to be overwritten, causing binary operation abnormalities, so the code area and the subsequent data need to be offset. Since the data block alignment size of the memory pages of different system architectures is different during the data offset process, the data block alignment size of the memory page must be considered during the execution of the data offset. Therefore, the system architecture of the target thin binary file needs to be obtained at this time. For example, for the x86_64 architecture, the memory page is 4K aligned, but for the arm64 architecture, the memory page is 16K aligned. The process of determining the target offset according to the system architecture will be described in detail in the following steps and will not be repeated here.

[0046] In another specific embodiment, if the target space address size is not larger than the blank area, the dynamic library dependency instruction can be directly inserted into the blank area, thereby achieving process injection of the Mach-O format binary file.

[0047] 206. Calculate the target offset of the starting position of the data segment according to the system architecture and the target space address size.

[0048] Specifically, due to different system architectures, the alignment size of data blocks in memory pages is different. For example, the data blocks in the memory pages of the x86_64 architecture are aligned to 4K, while the data blocks in the memory pages of the arm64 architecture are aligned to 16K. In addition, the existing data in the binary file has been aligned according to the size of the corresponding data block during the writing process. Therefore, when determining the target offset, the alignment of the inserted data must also be considered.

[0049] For example, when the system architecture is x86_64, the size of the data block in the memory page is aligned with 4K. If the calculated target space size is 7K, and considering the alignment size of the data block of the dynamic library dependent instruction to be inserted, the minimum target offset is determined to be 8K. Of course, it can also be 12K or 16K, as long as it is greater than 7K and is an integer multiple of 4K.

[0050] For easier understanding, you can also refer to Figure 4The embodiment shown.

[0051] 207. The starting position of the data segment is offset by the target offset to obtain an enlarged blank area.

[0052] After the target offset is determined, the start position of the data segment can be offset by the target offset to obtain an enlarged blank area.

[0053] In one of the specific embodiments, for the first data area of ​​the data segment, i.e., the code area, a blank field needs to be added at the data start point, and the size of the blank field is the target offset. Here, the field indicating the area size of the code area or instruction segment is not enlarged, because the purpose of the offset is to increase the blank area, not to expand the existing area, and only the field indicating the current architecture size is enlarged.

[0054] 208. Insert dynamic library dependency instructions into the enlarged blank area to achieve process injection of Mach-O format binary files.

[0055] After obtaining the enlarged blank area, the dynamic library dependency instruction can be inserted into the enlarged blank area to achieve process injection of the Mach-O format binary file.

[0056] It can be seen that this embodiment implements process injection by inserting dynamic library dependency instructions in the blank area between the load instruction and the data segment. This method of inserting dynamic library dependency instructions in the blank area between the load instruction and the data segment is not restricted by the SIP mechanism, so it improves the stability of process injection and the compatibility of the system.

[0057] In one of the feasible technical solutions, since the Mach-O binary file also has signature information, please refer to Figure 3 , Figure 3 A flowchart of another process injection method disclosed in an embodiment of the present application.

[0058] 301. Remove the signature information of the load instruction segment in the target thin binary file.

[0059] based on Figure 1 and Figure 2 Description, in this embodiment, step 301 can be performed before step 208.

[0060] Specifically, since the dynamic library dependency instruction is added without changing the binary signature, the binary data block hash value contained in the signature cannot match the modified binary and the verification fails, and the program still cannot run. Also, because the signature information is located at the end of the load instruction segment, it is not convenient to remove the old signature information after appending the instruction. Therefore, the embodiment of the present application can remove the binary signature information before appending the instruction.

[0061] In one specific embodiment, the signature information at the end of the load instruction segment can be removed by cleaning or correcting the information of the space address corresponding to the signature information.

[0062] After the signature information is removed, if a dynamic library dependency instruction is inserted into the increased blank area, step 302 is triggered.

[0063] 302. Re-sign the target thin binary file into which the dynamic library dependency instruction is inserted.

[0064] Because dynamic library dependency instructions are inserted into the enlarged blank area, in order to ensure data correctness, the embodiment of the present application needs to re-sign the binary file after the dynamic library dependency instructions are inserted to ensure the correctness of subsequent data verification.

[0065] Specifically, when signing a binary file, as an optional implementation, the target thin binary file is generally cut according to a preset data block size, and an irreversible algorithm (such as a hash algorithm) is used to first calculate the hash value of each data block size, and finally the hash value of each data block is calculated again to obtain the final signature value.

[0066] Furthermore, since there may be multiple thin binary files in a Mach-O format binary file, each thin binary file needs to be re-signed.

[0067] Because the embodiment of the present application has completed the removal of the old signature before inserting the dynamic library dependency instruction into the target thin binary file, and re-executed the writing of the new signature after inserting the dynamic library dependency instruction, and this method of removing the old signature in advance improves the convenience of writing the new signature, thereby correspondingly improving the convenience of binary file encapsulation in the embodiment of the present application, and correspondingly avoiding the problem of process startup failure caused by signature verification failure.

[0068] Based on step 206, the process of determining the target offset is described in detail below. Figure 4 , Figure 4 The detailed steps of step 206 are as follows: 401. Determine the alignment data block size of the system architecture memory page according to the system architecture.

[0069] according to Figure 1 As shown, the fat binary file includes multiple target thin binary files, and each thin binary file corresponds to a system architecture, and the Mach-O binary files are divided into at least two system architectures, x86_64 and arm64, and the alignment size of the data block in the memory page of each system architecture is also different. Therefore, considering the alignment problem of the data inserted into the dynamic library dependent instruction, the embodiment of the present application needs to take the system architecture into consideration when determining the target offset.

[0070] In one of the specific embodiments, since the memory page alignment data block of the x86_64 architecture is 4K aligned, the memory page alignment data block of the arm64 architecture is 16K aligned.

[0071] 402. When the target space address size is an integer multiple of the alignment data block size, the target space address size is determined as the target offset.

[0072] Get the above Figure 2 In the embodiment, the target space address size calculated in step 204 is compared to determine whether the target space address size is an integer multiple of the alignment data block size. Thus, when the target space address size is an integer multiple of the alignment data block size, the target space address size can be determined as the target offset.

[0073] For ease of understanding, the following example is used to illustrate, assuming that the system architecture in the embodiment of the present application is x86_64, and the data block alignment size of the corresponding memory page is 4K. If the target space size calculated in step 204 is an integer multiple of 4K, such as 4K, 8K, 16K, ..., 4NK (N is a positive integer), the target space address size is used as the target offset.

[0074] 403. When the target space address size is a non-integer multiple of the alignment data block size, the target offset is determined to be greater than the target space address size and a minimum integer multiple of the alignment data block size.

[0075] Different from step 402, in step 403 of this embodiment, when the target space address size is a non-integer multiple of the alignment data block size, the target offset can be determined to be greater than the target space address size and the minimum integer multiple of the alignment data block size.

[0076] In one specific embodiment, for example, for the x86_64 system architecture, since the alignment block size is 4K, when the target space address size is 6K, in order to achieve an offset that is a non-integer multiple of the alignment block size (4K), 4K*2=8K>6K, the target offset can be determined as 8K. It is not difficult to understand that 8K is greater than the target space address size 6K and is the minimum integer multiple of the alignment block size 4K.

[0077] In addition, for the arm64 system architecture, since the alignment block size is 16K, when the target space address size is 42K, in order to achieve an offset that is an integer multiple of the alignment block size (16K), 16K*3=48K>42K, the target offset can be determined as 48K. It is not difficult to understand that 48K is greater than the target space address size 42K and is the minimum integer multiple of the alignment block size 16K.

[0078] A process injection method disclosed in this embodiment determines the target offset of the target thin binary file, so that the dynamic library dependency instructions can be inserted into the blank area in a minimally restrictive manner (minimizing the binary file memory as much as possible), and the subsequent binary data offset and offset data correction can be completed, thereby improving the feasibility of the solution.

[0079] For Mach-O binary files, there may be multiple thin binary files in the fat binary file. Therefore, after the offset of the first target thin binary file, the subsequent target thin binary files will be offset backwards in sequence. The following describes the correction process of the offsets of multiple target thin binary files after the first target thin binary file. Please refer to Figure 5 , Figure 5 A flowchart of another process injection method disclosed in an embodiment of the present application.

[0080] 501. Determine a first target thin binary file among multiple thin binary files.

[0081] like Figure 1 As shown, when the Mach-O binary file is a fat binary file, because the fat binary file generally includes multiple thin binary files, therefore, in order to facilitate the subsequent offset of multiple thin binary data and the correction of offset data, it is necessary to determine the first target thin binary file among the multiple thin binary files. It is not difficult to understand that the first target thin binary file can be understood as the first thin binary file located under the file header of the fat binary file.

[0082] In one specific embodiment, see Figure 1 , Figure 1The Thin Binary1 in the file can be understood as the first thin binary file, that is, the first target thin binary file described above. Specifically, by parsing the Fat header of the fat binary file, wherein the Fat header contains the information summary of the thin binary contained in the Mach-O format binary file. Among them, the information summary records the data starting point and occupied space size of each architecture binary in the fat binary file. Specifically, the data starting point and occupied space size of each architecture binary can be understood as the data starting point of each thin binary file and the occupied space size of each thin binary file, and the corresponding system architecture is written in the file header of each thin binary file. At the same time, the Fat Header is also the starting point of the fat binary data. It should be noted here that after clarifying the data starting point of each thin binary file and the occupied space size of each thin binary file, the arrangement order of each thin binary file can also be clearly known.

[0083] 502. For multiple target thin binary files after the first target thin binary file, according to the order of the multiple target thin binary files, the offset of the file header of the Nth target thin binary file after the first target thin binary file is correspondingly increased by N*target offset.

[0084] Based on step 501, for multiple target thin binary files after the first target thin binary file, the offset of the file header of the Nth target thin binary file after the first target thin binary file can be increased by N*target offset according to the order of the multiple target thin binary files.

[0085] In one specific embodiment, after determining the target offset, if the first thin binary file is inserted after the dynamic library dependency instruction, then the offsets of multiple target thin binary files after the first target thin binary file need to be modified in sequence.

[0086] For example, the first target thin binary file is offset by the target offset, that is, the corresponding blank area is filled. If the size of the filled blank area is 16K, the offset of the second architecture Mach Header also needs to be increased by 16K, and the offset of the third architecture Mach Header needs to be increased by 32K. And so on. The offset of the file header of the Nth target thin binary file after the first target thin binary file needs to be increased by N×target offset (N is a positive integer). When correcting the data representing the address / pointer / offset in each architecture, it is necessary to uniformly increase 16K, because the data in each architecture is calculated relative to the position of the Mach Header of this architecture. For details, please refer to Figure 7 The embodiment shown.

[0087] Through a process injection method disclosed in this embodiment, each target thin binary file in a Mach-O format binary file needs to be offset according to the relevant offset, so as to minimize the occurrence of path errors or call errors when the environment variables are subsequently called, thereby ensuring the accuracy of the operation of the binary file and its dynamic library dependent instructions.

[0088] Since the target space size depends on the instruction size of the dynamic library dependent instructions, the following describes the process of calculating the size of the dynamic library dependent instructions. Figure 6 , Figure 6 A flowchart of another process injection method disclosed in an embodiment of the present application.

[0089] 601. Obtain the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

[0090] Specifically, since the dynamic library dependency instruction includes at least the path of the dynamic library, it may also include Instruction name, instruction size and dynamic library information, wherein the dynamic library information includes the path of the dynamic library, or at least one of the timestamp of the dynamic library and the version number of the dynamic library, and the path of the dynamic library. Therefore, in order to calculate the target space address size occupied by the dynamic library dependent instruction, it is necessary to obtain the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

[0091] In one specific embodiment, the instruction size of the dynamic library dependent instruction at least includes the space address size occupied by the instruction name and dynamic library information, etc. Since there is a corresponding dynamic library calling path when calling a dynamic library, the length of the dynamic library path also needs to be obtained.

[0092] It is not difficult to understand that when calculating the size of dynamic library dependent instructions, the length of the dynamic library path needs to be calculated. At the same time, since the dynamic library path exists in the form of addr in the memory page, it is necessary to round it to a multiple of 8 as the final instruction size, which will not be described in detail here.

[0093] 602. Calculate the target space address size according to the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

[0094] After obtaining the instruction size of the dynamic library dependent instructions and the length of the dynamic library path, the target space address size can be calculated.

[0095] In one of the specific embodiments, in order to ensure that there is still margin after inserting the instruction and adding the signature information, otherwise the content of the data segment may be overwritten. Therefore, it is necessary to comprehensively consider the space address size occupied by the instruction size of the dynamic library dependent instruction and the length of the dynamic library path that calls the dynamic library, so as to calculate the final target space address size.

[0096] A process injection method disclosed in this embodiment calculates the instruction size of the dynamic library dependent instructions and the length of the dynamic library path, and determines the final target space address size, thereby ensuring that there is still a margin after inserting the instructions and adding signature information, thereby ensuring the correctness of the operation of the dynamic library dependent instructions and binary files.

[0097] After inserting the dynamic library dependent instructions into the enlarged blank area, it is also necessary to correct the data in the instruction loading segment or data area and code area. Figure 7 , Figure 7 A flowchart of another process injection method disclosed in an embodiment of the present application.

[0098] 701. Parse a file header of a Mach-O format binary file to determine a file type of the Mach-O format binary file.

[0099] Specifically, because the file type of the binary file is recorded in the file header, the file type of the Mach-O format binary file can be determined by parsing the file header of the Mach-O format binary file. It is not difficult to understand that the file type includes fat binary files and thin binary files, and the fat binary file includes multiple thin binary files.

[0100] In one specific embodiment, because the file headers of different types of binary files are different, such as the file header of a fat binary file is a Fat Header, and the file header of a thin binary file is a Mach Header, therefore, by parsing the file header of a Mach-O format binary file, it is possible to determine whether the file type of the Mach-O format binary file is a fat binary file or a thin binary file by the type of the file header.

[0101] 702. When the Mach-O format binary file is a fat binary file, multiple thin binary files in the fat binary file are obtained respectively.

[0102] Therefore, when the Mach-O format binary file is a fat binary file, multiple thin binary files in the fat binary file are obtained respectively.

[0103] In one specific embodiment, in combination Figure 1As shown, when the first file header of the parsed Mach-O format binary file is a Fat Header, it can be determined that the Mach-O format binary file is a fat binary file, and multiple thin binary files can be determined through the information summary of the thin binary contained in the Fat Header.

[0104] It is not difficult to understand that when the Mach-O format binary file is a Mach Header, it can be determined that the current binary file is a thin binary file.

[0105] 703. Determine any thin binary file among the multiple thin binary files as a target thin binary file.

[0106] After multiple thin binary files are obtained based on step 702, any binary file among the multiple thin binary files can be determined as a target thin binary file.

[0107] In one specific embodiment, since the methods of determining whether the blank area is sufficient and parsing the loading instruction segment are similar among multiple thin binary files, the execution steps of any thin binary file can be used as a reference for the execution steps of other thin binary files, thereby any thin binary file can be determined as a target thin binary file.

[0108] 704. Obtain a target thin binary file in a Mach-O format binary file.

[0109] 705. Parse the file header and the load instruction segment of the target thin binary file to obtain the blank area between the last load instruction and the start position of the data segment in the target thin binary file.

[0110] 706. Generate dynamic library dependency instructions according to the dynamic library information that the Mach-O format binary file depends on.

[0111] 707. Calculate the target space address size occupied by the dynamic library dependent instructions.

[0112] 708. When the target space address size is larger than the blank area, the system architecture of the target thin binary file is obtained.

[0113] 709. Calculate the target offset of the starting position of the data segment according to the system architecture and the target space address size.

[0114] 710. Offset the start position of the data segment by the target offset to obtain an enlarged blank area.

[0115] 711. Insert dynamic library dependency instructions into the enlarged blank area to achieve process injection of Mach-O format binary files.

[0116] It should be noted that steps 704 to 711 are Figure 2 The description in the embodiment is similar and will not be repeated here.

[0117] 712. Update the data value representing the size of the target thin binary file in the target thin binary file after the dynamic library dependency instruction is inserted according to the size of the dynamic library dependency instruction and the size of the target thin binary file before the dynamic library dependency instruction is inserted.

[0118] After inserting the dynamic library dependency instruction into the enlarged blank area, the data value representing the size of the target thin binary file in the target thin binary file after inserting the dynamic library dependency instruction can be updated according to the size of the dynamic library dependency instruction and the size of the target thin binary file before inserting the dynamic library dependency instruction.

[0119] In one of the specific embodiments, since the target thin binary file expands the target space address size and inserts the dynamic library dependency instruction, the size of the target thin binary file will also change accordingly. Therefore, it is necessary to update the data value representing the size of the target thin binary file in the target thin binary file after the dynamic library dependency instruction is inserted. It is not difficult to understand that the corresponding updated value should include the size of the dynamic library dependency instruction.

[0120] 713. Increase the offset of the target load instruction segment contained in the target thin binary file by the target offset.

[0121] After obtaining the target binary file for inserting dynamic library dependency instructions, because the target thin binary file contains the instruction segment of the address and offset, it is also necessary to increase the offset of the target loading instruction segment contained in the target thin binary file by the target offset. Here, the target loading instruction segment is the instruction segment representing the address and offset in the loading instruction segment.

[0122] In one specific embodiment, after determining the target offset, since the thin binary file of each architecture is offset in the blank area by the target offset, data in the instruction load segment also needs to be corrected. The types of corrections include data representing addresses and offsets in instructions such as offset and addr, and the correction method is to add the target offset to the original value.

[0123] 714. Insert a blank field at the starting point of the data segment of the target thin binary file.

[0124] In order to obtain the enlarged blank area, the embodiment of the present application can insert a blank field at the starting point of the data segment of the target thin binary file. The size of the blank field here is the target offset.

[0125] In one of the specific embodiments, for the first data area, i.e., the code area, a blank field needs to be added at the start of the data, and the size of the blank field is the target offset. Here, the field indicating the area size of the code area or instruction segment is not enlarged, because the purpose of the offset is to increase the blank area, not to expand the existing area. Only the field indicating the current architecture size is enlarged.

[0126] 715. Increase the offset of the target data segment contained in the target thin binary file by the target offset.

[0127] In addition, the offset of the target data segment also needs to be corrected. Here, the target data segment is a data segment representing an address or a pointer in the data segment.

[0128] In one of the specific embodiments, for the data in the code area and the data area, the data representing the pointer / address must be corrected. For example, for the general data area (such as _got, _la_symbol_ptr), the OC data area (such as _objc_selrefs, _objc_protorefs_DATA), the virtual data area (such as _objc_const, _data), etc., the correction method is generally to add the target offset to the original value. Depending on the different programming languages ​​that need to be supported, the scope of the area to be corrected is also different. For example, C / C++ (Core Foundation), Objective-C, Swift, etc. all have related data areas. If you need to support the offset of the binary written in the related language, you need to implement the offset correction of the corresponding language data area.

[0129] Through the process injection method disclosed in this embodiment, it is necessary to understand that process injection is the basis of the UEM sandbox function and the prerequisite for realizing the sandbox security mechanism. After the process is injected, the isolation and secure access of the sandbox confidential data can be realized through the injected code. The method of inserting dynamic library dependency instructions to realize process injection proposed in the present invention can replace the earlier method based on environment variable injection. After Apple has launched the ARM architecture machine and SIP mechanism, the method based on environment variable injection has been unable to take effect, and even the macOS kernel level directly invalidates all environment variables starting with "DYLD_" to limit the application layer from tampering with the process. The method of inserting dynamic library instructions proposed in the present invention can be used normally on both new and old macOS systems, and has good stability and system compatibility.

[0130] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0131] The above describes in detail the method for injection in the embodiment of the present application. Next, the system for process injection in the embodiment of the present application is described. Figure 8 , an embodiment of the process injection system in the embodiment of the present application includes: An acquisition unit 801 is used to acquire a target thin binary file in a Mach-O format binary file, where the target thin binary file includes a file header, a load instruction segment, and a data segment; A parsing unit 802 is used to parse the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction and the start position of the data segment in the target thin binary file; A generating unit 803 is used to generate a dynamic library dependency instruction according to the dynamic library information on which the Mach-O format binary file depends; A calculation unit 804 is used to calculate the target space address size occupied by the dynamic library dependent instructions; The acquisition unit 801 is further used to acquire the system architecture of the target thin binary file when the target space address size is larger than the blank area; The calculation unit 804 is further used to calculate the target offset of the starting position of the data segment according to the system architecture and the target space address size; The offset unit 805 is further used to offset the starting position of the data segment by a target offset to obtain an enlarged blank area; The inserting unit 806 is used to insert the dynamic library dependency instruction into the enlarged blank area to achieve process injection of the Mach-O format binary file.

[0132] Exemplarily, the system further includes: a removal unit 807 and a signature unit 808; A removal unit 807, used to remove the signature information of the load instruction segment in the target thin binary file; The signing unit 808 is used to re-sign the target thin binary file into which the dynamic library dependency instruction is inserted.

[0133] Exemplarily, the system further includes: a determination unit 809; The determining unit 809 is used to determine the alignment data block size of the system architecture memory page according to the system architecture; The determining unit 809 is further configured to determine the target space address size as the target offset when the target space address size is an integer multiple of the alignment data block size; The determining unit 809 is further configured to determine the target offset to be greater than the target space address size and to be a minimum integer multiple of the alignment data block size when the target space address size is a non-integer multiple of the alignment data block size.

[0134] Exemplarily, the system further includes: an updating unit 810; The parsing unit 802 is further used to parse the file header of the Mach-O format binary file to determine the file type of the Mach-O format binary file, wherein the file type includes a fat binary file and a thin binary file, and the fat binary file includes multiple thin binary files; The acquisition unit 801 is further configured to respectively acquire multiple thin binary files in the fat binary file when the Mach-O format binary file is a fat binary file; The determining unit 809 is further configured to determine any thin binary file among the plurality of thin binary files as a target thin binary file; The updating unit 810 is used to update the data value representing the size of the target thin binary file in the target thin binary file after the dynamic library dependency instruction is inserted according to the size of the dynamic library dependency instruction and the size of the target thin binary file before the dynamic library dependency instruction is inserted.

[0135] Exemplarily, the system further includes: an adding unit 811; The determining unit 809 is further configured to determine a first target thin binary file among the plurality of thin binary files; The adding unit 811 is used to increase the offset of the file header of the Nth target thin binary file after the first target thin binary file by N*target offset according to the order of the multiple target thin binary files, where N≥1.

[0136] Exemplarily, the system further includes: The adding unit 811 is further configured to increase the offset of the target loading instruction segment contained in the target thin binary file by the target offset, wherein the target loading instruction segment is an instruction segment representing an address and an offset in the loading instruction segment.

[0137] Exemplarily, the system further includes: The inserting unit 806 is further configured to insert a blank field at the starting point of the data segment of the target thin binary file, wherein the size of the blank field is the target offset.

[0138] Exemplarily, the system further includes: The adding unit 811 is further used to increase the offset of the target data segment contained in the target thin binary file by the target offset, wherein the target data segment is a data segment representing an address or a pointer in the data segment.

[0139] Exemplarily, the dynamic library dependency instruction includes an instruction name, an instruction size, and information about the dynamic library, wherein the information about the dynamic library includes a path of the dynamic library, or at least one of a timestamp of the dynamic library and a version number of the dynamic library, and the path of the dynamic library; the system includes: The acquisition unit 801 is specifically used to acquire the instruction size of the dynamic library dependent instruction and the length of the dynamic library path; The calculation unit 804 is specifically used to calculate the target space address size according to the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

[0140] See below Fig. 9 , a schematic diagram of a process injection device disclosed in an embodiment of the present application includes: CPU 901, memory 905, input / output interface 904, wired or wireless network interface 903 and power supply 902; The memory 905 is a temporary storage memory or a permanent storage memory; The CPU 901 is configured to communicate with the memory 905 and execute the instructions in the memory 905 to perform the aforementioned Figures 2 to 7 The method of process injection in any of the illustrated embodiments.

[0141] The embodiment of the present application also provides a chip system, characterized in that the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or instruction to execute the aforementioned Figures 2 to 7 The method of process injection in any one of the embodiments shown.

[0142] The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium includes instructions, when the instructions are executed on a computer, the computer executes the aforementioned Figures 2 to 7 The method of process injection in any one of the embodiments shown.

[0143] The present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the aforementioned Figures 2 to 7 The method of process injection in any one of the embodiments shown.

[0144] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0145] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0148] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A process injection method, characterized in that: include: Obtain a target thin binary file from a Mach-O format binary file, wherein the target thin binary file includes a file header, a load instruction segment, and a data segment; Parsing the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction in the target thin binary file and the starting position of the data segment; Generate a dynamic library dependency instruction according to the dynamic library information on which the Mach-O format binary file depends; Calculate the target space address size occupied by the dynamic library dependent instructions; If the target space address size is larger than the blank area, obtaining the system architecture of the target thin binary file; Calculating a target offset of a starting position of the data segment according to the system architecture and the target space address size; offsetting the starting position of the data segment by the target offset to obtain an enlarged blank area; The dynamic library dependency instruction is inserted into the enlarged blank area to implement process injection of the Mach-O format binary file.

2. The method according to claim 1, characterized in that Before offsetting the starting position of the data segment by the target offset to obtain the enlarged blank area, the method further includes: Removing signature information of the load instruction segment in the target thin binary file; After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The target thin binary file into which the dynamic library dependency instruction is inserted is re-signed.

3. The method according to claim 1, characterized in that The calculating the target offset of the starting position of the data segment according to the system architecture and the target space address size includes: Determining, according to the system architecture, an alignment data block size of a memory page of the system architecture; If the target space address size is an integer multiple of the alignment data block size, the target space address size is determined as the target offset; If the target space address size is a non-integer multiple of the alignment data block size, the target offset is determined to be greater than the target space address size and a minimum integer multiple of the alignment data block size.

4. The method according to claim 1, characterized in that: Before obtaining the thin binary file in the Mach-O format binary file, the method further includes: Parsing a file header of the Mach-O format binary file to determine a file type of the Mach-O format binary file, wherein the file type includes a fat binary file and a thin binary file, and the fat binary file includes a plurality of thin binary files; If the Mach-O format binary file is a fat binary file, obtaining multiple thin binary files in the fat binary file respectively; Determine any thin binary file among the plurality of thin binary files as the target thin binary file; After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: According to the size of the dynamic library dependency instruction and the size of the target thin binary file before the dynamic library dependency instruction is inserted, a data value representing the size of the target thin binary file in the target thin binary file after the dynamic library dependency instruction is inserted is updated.

5. The method according to claim 4, characterized in that The method further comprises: Determining a first target thin binary file among the plurality of thin binary files; For multiple target thin binary files after the first target thin binary file, according to the order of the multiple target thin binary files, the offset of the file header of the Nth target thin binary file after the first target thin binary file is correspondingly increased by N*target offset, wherein N≥1.

6. The method according to claim 4, characterized in that After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The offset of the target load instruction segment contained in the target thin binary file is increased by the target offset, wherein the target load instruction segment is an instruction segment representing an address and an offset in the load instruction segment.

7. The method according to claim 4, characterized in that After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: A blank field is inserted at the starting point of the data segment of the target thin binary file, wherein the size of the blank field is the target offset.

8. The method according to claim 4, characterized in that After inserting the dynamic library dependency instruction into the enlarged blank area, the method further includes: The offset of the target data segment contained in the target thin binary file is increased by the target offset, wherein the target data segment is a data segment representing an address or a pointer in the data segment.

9. The method according to any one of claims 1 to 8, characterized in that The dynamic library dependency instruction includes an instruction name, an instruction size and information about the dynamic library, wherein the information about the dynamic library includes a path of the dynamic library, or at least one of a timestamp of the dynamic library and a version number of the dynamic library, and the path of the dynamic library; The calculating the target space address size occupied by the dynamic library dependent instruction includes: Obtaining the instruction size of the dynamic library dependent instruction and the length of the dynamic library path; The target space address size is calculated according to the instruction size of the dynamic library dependent instruction and the length of the dynamic library path.

10. A process injection system, characterized in that: The system comprises: An acquisition unit, configured to acquire a target thin binary file from a binary file in a Mach-O format, wherein the target thin binary file includes a file header, a load instruction segment, and a data segment; A parsing unit, used for parsing the file header and the load instruction segment of the target thin binary file to obtain a blank area between the last load instruction in the target thin binary file and the starting position of the data segment; A generating unit, configured to generate a dynamic library dependency instruction according to the dynamic library information on which the Mach-O format binary file depends; A calculation unit, used for calculating the target space address size occupied by the dynamic library dependent instructions; The acquisition unit is further configured to acquire the system architecture of the target thin binary file when the target space address size is larger than the blank area; The calculation unit is further used to calculate the target offset of the starting position of the data segment according to the system architecture and the target space address size; An offset unit, used for offsetting the starting position of the data segment by the target offset to obtain an enlarged blank area; The insertion unit is used to insert the dynamic library dependency instruction into the enlarged blank area to achieve process injection of the Mach-O format binary file.

11. A computer device, characterized in that: The device comprises: CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply; The memory is a transient storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the process injection method described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer is caused to execute the process injection method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises instructions, and when the instructions are executed on a computer, the computer is caused to execute the process injection method according to any one of claims 1 to 9.

Images