Staint analysis method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a taint analysis method and device, electronic equipment and a readable storage medium, and belongs to the technical field of data processing. The method comprises the steps that a compiling instruction for the program content of an application program is received, and the program content comprises an application source code and a local source code; according to the compiling instruction, a local source code compiler is called to obtain an intermediate representation file of the local source code through an interception program, the interception program and the local source code compiler have a preset link relation, and the local source code compiler calls the interception program through the preset link relation to obtain the intermediate representation file of the local source code; the interception program is used for compiling a local source code into an intermediate representation file; according to the compiling instruction, calling an application source code compiler to compile the application source code to obtain an intermediate representation file of the application source code; and performing taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain a taint analysis result of the program content.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and specifically relates to a stain analysis method, device, electronic device and readable storage medium. Background Art

[0002] In Android application development, it is a common practice for the application source code layer to call local source code through JNI (Java Native Interface), which allows developers to take advantage of the high performance features of other languages ​​such as C / C++. However, this cross-language function call also brings some security risks and challenges, including:

[0003] Local source code may directly access device hardware or sensitive data. If not handled properly, it may lead to user privacy leakage. Vulnerabilities in local source code may be exploited, leading to malicious code execution, thereby controlling the entire application or even the device. Local source code may have higher system permissions. If used maliciously, it may lead to privilege escalation attacks. In order to ensure the security of the software, it is usually necessary to conduct a comprehensive analysis of the application source code and the local source code.

[0004] Since the program structure of mixed local source code is more complex, the difficulty of analysis and testing is increased. The current analysis tools have limited support for cross-language security analysis and it is difficult to effectively discover security risks in software projects. Therefore, it is difficult to perform taint analysis efficiently in cross-language scenarios. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a taint analysis method, device, electronic device and readable storage medium, which can solve the problem that it is difficult to perform taint analysis efficiently in a cross-language scenario.

[0006] In a first aspect, an embodiment of the present application provides a stain analysis method, the method comprising:

[0007] receiving a compile instruction for program content of an application program, wherein the program content includes application source code and local source code;

[0008] According to the compilation instruction, calling the local source code compiler to obtain the intermediate representation file of the local source code through the interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file;

[0009] According to the compilation instruction, the application source code compiler is called to compile the application source code to obtain an intermediate representation file of the application source code;

[0010] Perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content.

[0011] In a second aspect, an embodiment of the present application provides a stain analysis device, the device comprising:

[0012] A receiving module, used to receive a compile instruction for a program content of an application program, wherein the program content includes an application source code and a local source code;

[0013] an acquisition module, for invoking a local source code compiler to obtain an intermediate representation file of the local source code through an interception program according to a compilation instruction, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file;

[0014] A compiling module, used to call an application source code compiler to compile the application source code according to a compiling instruction, and obtain an intermediate representation file of the application source code;

[0015] The analysis module is used to perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0017] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.

[0019] In a sixth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the first aspect.

[0020] In an embodiment of the present application, a compilation instruction for a program content of an application is received, wherein the program content includes an application source code and a local source code; according to the compilation instruction, a local source code compiler is called to obtain an intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, so the local source code compiler can call the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program can compile the local source code into an intermediate representation file, which is convenient for subsequent analysis of the intermediate representation file of the local source code. Since the intermediate representation file of the local source code is generated from the local source code, the correspondence between the intermediate representation file of the local source code and the local source code is clear. According to the compilation instructions, the application source code compiler is called to compile the application source code to obtain the intermediate representation file of the application source code. Similarly, the correspondence between the intermediate representation file of the application source code and the application source code is also clear; taint analysis is performed on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis results of the program content. The taint analysis results of the program content can be traced back to the source code of the application program, which is convenient for problem location and repair. It can efficiently perform taint analysis in cross-language scenarios, which is convenient for accurate risk identification and optimization of security policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a flow chart of a stain analysis method provided in an embodiment of the present application;

[0022] Figure 2 is a flow chart of another stain analysis method provided in an embodiment of the present application;

[0023] Figure 3 is a flow chart of another stain analysis method provided in an embodiment of the present application;

[0024] Figure 4 is a structural diagram of a stain analysis device provided in an embodiment of the present application;

[0025] Figure 5 It is one of the hardware structure diagrams of the electronic device according to the embodiment of the present application;

[0026] Figure 6 This is the second schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings of the embodiments of the present application to clearly describe the technical solutions of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present application belong to the scope of protection of this application.

[0028] The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0029] The stain analysis method provided in the embodiment of the present application can be applied to at least the following application scenarios, which are described below.

[0030] In modern application development, the application source code layer and the local source code layer usually refer to different parts of the application, especially in Android development. The application source code layer usually refers to the code part written in Java, including the application's business logic, user interface, and interaction with the system. Java code can run on any platform that supports JVM.

[0031] The native source code layer refers to the code written in languages ​​such as C or C++, which usually interacts with the application source code layer through JNI (Java Native Interface). The native source code usually executes faster and is suitable for computing that requires high performance. It can directly call operating system functions and hardware interfaces.

[0032] Android applications allow the application source code layer to call local source code to implement cross-language function calls. In actual application development, local source code is used more frequently due to the following characteristics:

[0033] On the one hand, there are many specific hardware and underlying system interfaces on Android devices, which usually need to be accessed and controlled by native source code. For example, accessing hardware functions such as sensors, Bluetooth, and NFC. By calling native libraries through JNI, application source code can interact with these underlying hardware and system APIs, thereby implementing some functions that cannot be directly completed by application source code.

[0034] On the other hand, some computationally intensive tasks, such as image processing, audio and video encoding and decoding, will have performance bottlenecks if implemented using application source code. By implementing these performance-critical parts with local source code and then calling them through JNI, the overall performance of the application can be greatly improved. This is especially important for applications such as games and cameras that have high requirements for real-time and smoothness.

[0035] On the other hand, some applications may contain core algorithm logic or encryption mechanisms, and developers do not want these key codes to be decompiled or reverse analyzed. By implementing these key codes as local libraries and then calling them through JNI, the core logic can be hidden in the local source code, increasing the security of the application.

[0036] Therefore, the use of local source code through JNI in Android application development is indeed very common and widespread. Developers need to weigh various factors and reasonably use local source code to enhance the functionality, performance, and security of the application. This calling method is widely used in scenarios where the performance advantages of local source code need to be brought into play, such as image processing, video decoding, etc.

[0037] However, more and more studies and reports show that there may be serious security risks in cross-language function calls, leading to user privacy leakage and even arbitrary code execution. In addition, mixing local source code significantly increases the difficulty of program analysis and security testing, making such security risks more difficult to detect, including the following aspects:

[0038] On the one hand, calling local source code through JNI may lead to serious security issues such as user privacy leakage and arbitrary code execution. This is because local source code can directly access underlying system resources and memory. If there are vulnerabilities or it is maliciously exploited, it will pose a great threat to application and device security.

[0039] On the other hand, applications that mix application source code and native source code will greatly increase the complexity of program analysis and security testing. Many analysis tools only focus on the application source code part and cannot deeply analyze and test the native source code part called by JNI.

[0040] Current commercial analysis tools have very limited support for cross-language security analysis in Android applications. This limitation has resulted in many security risks not being discovered and fixed. The current conservative analysis strategy will result in a large number of false positives and omissions, and cannot effectively discover the real security risks in JNI calls.

[0041] Moreover, most existing technologies require decompiling the APK before analyzing the local source code. However, the decompiled code may be distorted, and factors such as missing symbol tables and compilation obfuscation make it difficult to directly locate and fix the problem.

[0042] In response to the problems arising in the related art, the embodiments of the present application provide a taint analysis method, device, electronic device and readable storage medium, which can solve the problem in the related art that it is difficult to efficiently perform taint analysis in a cross-language scenario.

[0043] The stain analysis method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0044] Figure 1 A flow chart of a stain analysis method provided in an embodiment of the present application.

[0045] like Figure 1 As shown, the stain analysis method may include steps 110 to 140, and the method is applied to a stain analysis device, as shown below:

[0046] Step 110, receiving a compile instruction for a program content of an application program, wherein the program content includes an application source code and a local source code;

[0047] Among them, compilation instructions are instructions used to instruct the compiler on how to process source code, usually including compilation options, target platform and other information.

[0048] Compilation instructions are the input of the compilation process, including source code files, compilation options, target platform and other information. Receiving compilation instructions is the first step in the compilation process. Compilation instructions can be received through command line parameters, configuration files or graphical interfaces.

[0049] Step 120, according to the compilation instruction, calling the local source code compiler to obtain the intermediate representation file of the local source code through the interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file;

[0050] Local source code compiler: A compiler used to compile local library source code, usually the compiler that comes with the system.

[0051] Interceptor: A special program that intercepts the call of the local source code compiler and obtains the intermediate representation file during the compilation process.

[0052] Intermediate representation file: An intermediate product generated during the compilation process, usually bytecode, for further analysis or optimization.

[0053] Exemplarily, the intermediate representation file can be a bc file of LLVM: .bc file is an LLVM bitcode file, which is an intermediate representation form and is usually used to optimize and generate machine code for the target platform. When building native code (such as C or C++), the compiler converts the code into LLVM bitcode for subsequent optimization and conversion. These files can be further processed by the LLVM tool chain, such as generating a final executable file or shared library.

[0054] The local source code compiler is usually a compiler that comes with the system and is used to compile the source code of the local library. The interception program intercepts the call of the compiler through a preset link relationship and obtains the intermediate representation file in the compilation process. During the compilation process, the interception program is linked to the local source code compiler through a preset link relationship.

[0055] When the compiler is called, the interception program intercepts the output of the compiler and generates an intermediate representation file. The interception program saves the intermediate products in the compilation process as the intermediate representation file.

[0056] In a possible embodiment, before step 120, the following steps may also be included:

[0057] Create a soft link of the interception program. The name of the soft link of the interception program is the same as the link name of the compiler.

[0058] According to the soft link of the intercepted program, the preset link relationship is determined.

[0059] A soft link points to a file or directory. By creating a soft link to the interception program and setting the name of the interception program's soft link to the same as the compiler's link name, you can intercept the compiler call during the compilation process.

[0060] The preset link relationship means that during the compilation process, the interception program is linked to the compiler through a soft link so that the compiler output can be intercepted when the compiler is called. Specifically, the soft link of the interception program can be linked to the compiler by setting environment variables, and verifying whether the preset link relationship is set successfully to ensure that the compiler call can be correctly intercepted during the compilation process.

[0061] First, find the full path and name of the compiler used in the application through the system environment variables. The compiler, such as clang or gcc, is described below:

[0062] C language family frontend for LLVM (clang), clang is a compiler front end for the C, C++, Objective-C, and Objective-C++ programming languages, used to generate intermediate representations of the Low Level Virtual Machine (LLVM).

[0063] The GNU Compiler Collection (gcc) is a set of programming language compilers that supports multiple programming languages, including C, C++, Objective-C, Fortran, Ada, Go, and D.

[0064] Then, write or obtain an interception program that can compile the native source code into an intermediate representation file, such as the Intermediate Representation (LLVM IR), and ensure that the interception program can accept the same command line parameters as the original compiler. LLVM IR is the intermediate representation of the LLVM compiler framework, which is used for optimization and code generation during the compilation process.

[0065] Write an interceptor that accepts the same command line arguments as the original compiler and compiles the native source code into an intermediate representation file. For example, use the LLVM toolchain to write an interceptor that can generate LLVM IR.

[0066] Next, create a soft link to link the interception program to the name of the compiler.

[0067] You can use the ln -s command to create a soft link of the intercepted program and set the name of the soft link to the same as the name of the compiler. For example, the name of the soft link can be " / usr / bin / clang" or " / usr / bin / gcc".

[0068] Creating soft links can replace or extend the functionality of the compiler without modifying the project configuration, mainly because soft links provide a flexible mechanism that allows you to dynamically point to different files without changing the original file path.

[0069] Specifically, a soft link is a special file that points to another file or directory. The soft link itself does not contain data, but only the path to the target file; when a program or user accesses a soft link, the operating system automatically redirects it to the target file. Therefore, for the caller, the soft link and the target file are transparent and indistinguishable.

[0070] By creating a soft link, linking the interceptor to the name of the compiler, you can replace the compiler without modifying the project configuration. For example, soft link " / usr / bin / gcc" to the interceptor " / path / to / interceptor", so that all commands calling gcc will actually call the interceptor; the interceptor can extend the compiler's functionality, such as generating intermediate representation files during the compilation process, without modifying the original compiler's code.

[0071] Applications usually specify the path and name of the compiler in configuration files or scripts. By creating soft links, you can dynamically replace or extend the compiler's functionality without modifying the application's configuration files. In a deployment environment, by creating soft links, you can easily switch compiler versions or features without reconfiguring.

[0072] Therefore, before step 120, by finding the full path and name of the compiler, writing or obtaining an interception program that can compile the local source code into an intermediate representation file, and creating a soft link to link the interception program to the name of the compiler, the process of intercepting the compiler call can be simplified. By setting a preset link relationship, the compiler call can be intercepted during the compilation process and an intermediate representation file can be generated. By automating the configuration and interception process, the development process is simplified, and the development efficiency and maintainability are improved.

[0073] In a possible embodiment, before step 120, the following steps may also be included:

[0074] Step 210, searching for the storage path of the software development kit SDK of the application;

[0075] Step 220, searching for the storage path of the local development kit NDK through the storage path of the SDK;

[0076] Step 230, adding intermediate representation compilation parameters to the compilation parameters of the NDK version of the compiler through the storage path of the NDK to obtain an interception program, and the intermediate representation compilation parameters are used to generate an intermediate representation file according to the local source code.

[0077] Among them, the Software Development Kit (SDK) is a set of tools and libraries provided for developing applications for a specific platform or framework. In Android development, the SDK provides all the tools and libraries required to develop Android applications. It helps developers access various features of the Android operating system, such as user interface components, file storage, networking, etc.

[0078] The Native Development Kit (NDK) is a toolkit for Android development that allows developers to write code for some applications using C and C++. In Android development, the NDK enables developers to write high-performance code, which is particularly suitable for applications that require high-performance computing or graphics processing, such as games or image processing applications. Through the NDK, developers can directly access the underlying system resources and improve the efficiency of applications.

[0079] Steps 210 to 230 are described in sequence below:

[0080] Step 210: It is necessary to determine which platform or framework the software project is developed based on, such as Android, iOS, Windows, etc. Depending on the project type, the SDK path is usually specified in the project's configuration file. For example, in an Android project, the SDK path is usually in the local.properties file or in an environment variable. To ensure that the found path is correct, you can verify it through the command line tool or the IDE's settings interface.

[0081] Step 220: Find the storage path of the local development kit (NDK) through the storage path of the SDK. In most cases, the NDK is installed together with the SDK, so the storage path of the NDK can be found under the storage path of the SDK. For example, in Android development, the NDK is usually located in the ndk folder under the SDK directory. If the NDK path is not directly displayed under the SDK path, you can check the configuration file or environment variables of the project to find the path of the NDK.

[0082] Step 230: First, you need to determine the compiler used in the NDK, such as clang or gcc. Then, add the intermediate representation compilation parameter to the compiler's compilation parameters. For example, if you are using clang, you may need to add a parameter similar to "-emit-llvm" to generate the intermediate representation file. Next, run the compilation command to ensure that the compiler generates the intermediate representation file. These files usually have the extension ".bc (Bitcode)" or ".ll (LLVM IR)".

[0083] By adding the intermediate representation compilation parameter to the NDK version of the compiler, the intermediate representation file (such as LLVM IR file) was successfully generated. The intermediate representation file is a high-level abstract representation of the source code, which is of great significance for subsequent code analysis, optimization, cross-platform compilation, etc.

[0084] For example, you first need to find the SDK installation location. You can check the local.properties file in the project root directory, which usually contains the SDK path. Next, the NDK is usually located in the ndk folder under the SDK directory, so you can find the specific NDK path. Finally, you need to modify the NDK compiler and add the intermediate representation compilation parameter to the compilation parameters of the NDK version of the compiler to obtain the interception program.

[0085] Therefore, by modifying the intercepted program obtained by the compiler, an intermediate representation file of the local source code can be obtained, and the intermediate representation file can be used for more in-depth code optimization and analysis.

[0086] Step 130, according to the compilation instruction, calling the application source code compiler to compile the application source code to obtain an intermediate representation file of the application source code;

[0087] Application source code compiler: A compiler used to compile application source code, usually as part of a development toolchain.

[0088] The application source code compiler is used to compile the source code of the application and generate an intermediate representation file, usually a bytecode. According to the compilation instructions, the application source code compiler is called to compile the application source code.

[0089] The compiler generates intermediate representation products during the compilation process and saves them as files.

[0090] The intermediate representation file of the application source code may include at least one of the following: classes, mergedManifests. The following are respectively described:

[0091] classes: are compiled Java class files that contain the bytecodes of all the Java source code in a project. The Java compiler compiles .java files into .class files, which can be executed by the Java Virtual Machine (JVM).

[0092] mergedManifests: It is the merged AndroidManifest.xml file, usually generated in an Android project. mergedManifests contains the configuration information of the application, such as permissions, component declarations, etc.

[0093] Step 140: Perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain taint analysis results of the program content.

[0094] Program content: includes application source code and local source code, that is, the source code of the application program and the source code of the local library. The application source code can be the source code of the application program, and the local source code can be the source code of the local library.

[0095] Taint analysis: A static analysis technique used to detect possible security vulnerabilities in a program, such as data leakage and injection attacks. By performing taint analysis on intermediate representation files, the taint propagation path in the data flow can be identified.

[0096] Specifically, the intermediate representation files of the application source code and the local source code can be loaded into the taint analysis tool. The taint analysis tool can analyze the intermediate representation files according to predefined rules and algorithms to identify the taint propagation path in the data flow. The taint analysis tool generates taint analysis results, which usually include potential security vulnerabilities, taint propagation paths and other information.

[0097] By receiving compilation instructions, calling the local source code compiler and the application source code compiler to generate intermediate representation files, and performing taint analysis on the intermediate representation files, the security, stability, and performance of the application are improved. By automating the compilation and analysis process, the development process is simplified and development efficiency is improved.

[0098] In a possible embodiment, step 140 includes:

[0099] Detect high-risk entry points of the application;

[0100] Taking the entry of the high-risk program of the application as the starting point, the intermediate representation file of the application source code and the intermediate representation file of the local source code are subjected to taint analysis to obtain the taint analysis result of the program content.

[0101] Among them, high-risk programs, in software development and security analysis, usually refer to those program components that may have security vulnerabilities or be maliciously exploited. High-risk programs include at least one of the following: general high-risk components, high-authority components, system broadcast components, dynamically loaded broadcasts, active components, lifecycle functions, dynamic broadcast receivers, bound services, and asynchronous communications.

[0102] The following is a description of each high-risk procedure:

[0103] Common high-risk components: usually parts of the application that are vulnerable to attack, such as improperly protected network communications, sensitive data processing, etc. Common high-risk components refer to components that are widely used in applications, such as network communication components, file operation components, etc. Common high-risk components usually involve operations on sensitive data, such as data transmission in network communications, and data reading and writing in file operations. Through taint analysis, data flows in these components can be detected to identify potential security vulnerabilities, such as data leakage, injection attacks, etc.

[0104] Through taint analysis, security vulnerabilities in common high-risk components can be discovered and repaired in a timely manner, improving the security of applications.

[0105] High-privilege components: have higher system privileges and may cause serious damage to the system if used maliciously. For example, system services, administrator privilege components, etc. These components usually have the ability to access sensitive resources. High-privilege components usually involve access to sensitive resources, such as system files, user data, etc. Through taint analysis, data flows in these components can be detected to identify potential security vulnerabilities, such as privilege escalation and data leakage.

[0106] Through taint analysis, security vulnerabilities in high-privilege components can be discovered and repaired in a timely manner to prevent privilege abuse and data leakage.

[0107] System broadcast components: can receive system-level broadcast messages. If not handled properly, it may lead to sensitive information leakage or system manipulation. For example, broadcast receivers, broadcast transmitters, etc. These components are usually used to monitor and process system events. System broadcast components usually involve monitoring and processing system events, such as changes in network status, changes in battery status, etc. Through taint analysis, the data flow in these components can be detected to identify potential security vulnerabilities, such as broadcast hijacking, data leakage, etc.

[0108] Through taint analysis, security vulnerabilities in system broadcast components can be discovered and repaired in a timely manner to prevent broadcast hijacking and data leakage.

[0109] Dynamically loaded broadcast: Dynamically loaded broadcast receivers may be registered at runtime and may be exploited by malicious code if insufficiently verified. Examples include dynamic broadcast receivers, dynamic broadcast transmitters, etc. These components are usually used to monitor and process dynamic events. Dynamically loaded broadcast components usually involve monitoring and processing dynamic events, such as dynamically loaded code, dynamically loaded resources, etc. Through taint analysis, data flows in these components can be detected to identify potential security vulnerabilities, such as dynamic code injection, data leakage, etc.

[0110] Through taint analysis, security vulnerabilities in dynamically loaded broadcast components can be discovered and repaired in a timely manner, preventing dynamic code injection and data leakage.

[0111] Activity components: Activity is a core component in Android applications. If it is exportable and unprotected, it may be illegally started by other applications. For example, Activity, Fragment, etc. These components usually involve user interaction and data display. Activity components usually involve user interaction and data display, such as user input, data display, etc. Through taint analysis, the data flow in these components can be detected to identify potential security vulnerabilities, such as input validation, data leakage, etc.

[0112] Through taint analysis, security vulnerabilities in active components can be discovered and repaired in a timely manner, improving the security of user interactions.

[0113] Lifecycle functions: These functions are called at different stages of the application lifecycle. If not handled properly, they may cause security issues such as data leakage. For example, onCreate, onDestroy, etc. These functions usually involve operations such as component initialization and destruction. Lifecycle functions usually involve operations such as component initialization and destruction, such as resource allocation and resource release. Through taint analysis, the data flow in these functions can be detected to identify potential security vulnerabilities, such as resource leakage and data leakage.

[0114] Through taint analysis, security vulnerabilities in lifecycle functions can be discovered and repaired in a timely manner to prevent resource and data leakage.

[0115] Dynamic broadcast receivers: Dynamically registered broadcast receivers may be exploited by malicious applications at runtime to receive sensitive broadcast messages. For example, dynamically registered broadcast receivers, dynamically unregistered broadcast receivers, etc. These receivers are usually used to monitor and process dynamic events. Dynamic broadcast receivers usually involve monitoring and processing dynamic events, such as dynamically registered code, dynamically unregistered code, etc. Through taint analysis, the data flow in these receivers can be detected to identify potential security vulnerabilities, such as dynamic code injection, data leakage, etc.

[0116] Through taint analysis, security vulnerabilities in dynamic broadcast receivers can be discovered and repaired in a timely manner, preventing dynamic code injection and data leakage.

[0117] Bound Service: Bound services can be bound to and interact with other applications. If the permissions are not properly controlled, the services may be abused. For example, bound services, remote services, etc. These services are usually used for inter-process communication (IPC). Bound services usually involve inter-process communication (IPC), such as data transmission, command execution, etc. Through taint analysis, the data flow in these services can be detected to identify potential security vulnerabilities, such as IPC attacks, data leakage, etc.

[0118] Through taint analysis, security vulnerabilities in bound services can be discovered and repaired in a timely manner to prevent IPC attacks and data leaks.

[0119] Asynchronous communication: If the asynchronous communication mechanism (such as callback, message queue, etc.) is not designed properly, it may lead to information leakage or malicious use. For example, asynchronous tasks (AsyncTask), callback functions (Callback), etc. These components are usually used for asynchronous operations and event processing. Asynchronous communication components usually involve asynchronous operations and event processing, such as asynchronous data transmission, asynchronous event processing, etc. Through taint analysis, the data flow in these components can be detected to identify potential security vulnerabilities, such as asynchronous data leakage, asynchronous event hijacking, etc.

[0120] Through taint analysis, security vulnerabilities in asynchronous communication components can be discovered and repaired in a timely manner, preventing asynchronous data leakage and event hijacking.

[0121] High-risk programs include general high-risk components, high-privilege components, system broadcast components, dynamically loaded broadcasts, active components, lifecycle functions, dynamic broadcast receivers, bound services, and asynchronous communications. These components usually involve operations on sensitive data, access to sensitive resources, monitoring and processing of system events, monitoring and processing of dynamic events, user interaction and data display, component lifecycle management, inter-process communication, asynchronous operations, and event processing. Through taint analysis, the data flows in these components can be detected to identify potential security vulnerabilities, such as data leakage, privilege escalation, broadcast hijacking, dynamic code injection, input validation, resource leakage, IPC attacks, asynchronous data leakage, and event hijacking. Therefore, by identifying and analyzing these high-risk programs, targeted security reinforcement can be carried out to reduce potential security vulnerabilities.

[0122] After identifying the high-risk programs, you can detect the entry points of the high-risk programs in the application. The entry point of the high-risk program refers to the starting point where security vulnerabilities may exist in the program. Determine the entry point of the high-risk program, such as function calls, event processing, life cycle functions, etc.

[0123] Taking the entry of the high-risk program of the application as the starting point, the intermediate representation file of the application source code and the intermediate representation file of the local source code are subjected to taint analysis. Specifically, the intermediate representation file of the application source code and the intermediate representation file of the local source code can be loaded. The intermediate representation file is an intermediate product generated during the compilation process and is used for further analysis or optimization. The intermediate representation file of the application source code can be loaded, that is, the intermediate representation file of the application source code is loaded into the taint analysis tool.

[0124] Set the entry point of the high-risk program as the starting point of the taint analysis; starting from the starting point, track the data flow and identify the potential taint propagation path. For example, track sensitive data flows such as user input, network data, and file operations; by analyzing the data flow, identify potential taint propagation paths, such as data leakage, injection attacks, etc. Finally, generate the taint analysis results, which usually include information such as potential security vulnerabilities, taint propagation paths, and sensitive data flows.

[0125] Through taint analysis, security vulnerabilities in the program can be discovered and repaired in a timely manner, improving the security of the application; by automating the taint analysis process, the development process is simplified and development efficiency is improved.

[0126] The above-mentioned step of detecting the entrance of the high-risk program of the application program may specifically include the following steps:

[0127] Get the application information of the application, which is used to describe the behavior, permissions and communication methods of the application;

[0128] According to the application information, the entry of the high-risk program of the application is detected.

[0129] Application information refers to various data and configurations related to an application, including but not limited to the application's attribute information, call permission information, system broadcast information, and protected broadcast information. Application information is used to describe and configure the application's behavior, permissions, and communication methods.

[0130] The application information is obtained by parsing the configuration files, code files and metadata files of the application; the configuration files include AndroidManifest.xml, the code files include Java source code and C / C++ source code, and the metadata files include classes.dex and resources.arsc.

[0131] Extract key information of application information, including: exportable attribute information, call permission information, system broadcast information and protected broadcast information.

[0132] According to the key information of the application information, the entry of the high-risk program of the application is detected.

[0133] Based on the application information, identify high-risk components in the application, such as network communication components, file operation components, system service components, etc. Determine the entry points of high-risk programs based on the behavior, permissions, and communication methods of high-risk components, such as function calls, event processing, life cycle functions, etc.; generate a list of entry points of high-risk programs for subsequent taint analysis.

[0134] By obtaining application information and detecting the entry points of high-risk programs, security vulnerabilities in the program can be discovered and repaired in a timely manner, thereby improving the security of the application. By automatically obtaining application information and detecting the entry points of high-risk programs, manual analysis errors are reduced and the maintainability of the system is improved. By automatically obtaining application information and detecting the entry points of high-risk programs, the development process is simplified and development efficiency is improved. By promptly repairing security vulnerabilities, the stability and security of the application are improved, and the user experience is enhanced.

[0135] Application information includes: exportable attribute information, call permission information, system broadcast information, and protected broadcast information. The following are explained separately:

[0136] Exportable property information: refers to the properties of components in an application that can be accessed by other applications (such as Activity, Service, BroadcastReceiver, etc.). If these components are mistakenly set to be exportable, they may be exploited by malicious applications.

[0137] Call permission information: refers to the permissions required by the application to perform certain operations, such as accessing the network, reading and writing storage, obtaining location information, etc. Improper permission settings may lead to privacy leaks or data security issues.

[0138] System broadcast information: refers to system-level broadcast messages that applications can receive. These messages may contain sensitive information or trigger certain critical operations.

[0139] Protected broadcast information: refers to broadcast messages that can only be received by system applications or applications with specific permissions. These messages usually involve system security or critical operations.

[0140] Based on the application information obtained, analyze which components or operations may become the entry points of high-risk programs. For example, an exportable Activity may become the entry point for launching malicious applications, or an operation with improper permission settings may become the entry point for data leakage. Identify and verify these potential high-risk entry points through a combination of static analysis and dynamic analysis.

[0141] Specifically, according to the application information, the entry of the high-risk program of the software project can be detected, which can include the following methods:

[0142] A. Analyze the AndoirdManifest.xml configuration file to find common high-risk components, high-privilege components, and system broadcast components;

[0143] B. Use Soot to load class files and find dynamically loaded broadcast and activity components. The activity component can be a high-risk Android Activity.

[0144] C. Identify the entry points of lifecycle functions, dynamic broadcast receivers, bound services, and asynchronous communications.

[0145] The following are explained in turn:

[0146] A. Analyze the AndoirdManifest.xml configuration file to find common high-risk components, high-privilege components, and system broadcast components.

[0147] AndroidManifest.xml is the configuration file of the Android application, which contains the application's components, permissions, configuration and other information. By analyzing this file, you can identify common high-risk components, high-privilege components, and system broadcast components. Parse AndroidManifest.xml: Use an XML parser to parse the AndroidManifest.xml file and extract the application's components, permissions, configuration and other information.

[0148] Based on the predefined high-risk component list, common high-risk components are identified, such as network communication components, file operation components, etc. Based on the permission configuration, high-privilege components are identified, such as components with network access rights and file read and write permissions. Based on the broadcast receiver configuration, system broadcast components are identified, such as broadcast receivers that receive system events.

[0149] Specifically, you can check whether there are unrestricted Activities that may be called by other applications. Similarly, check whether there are unrestricted Services that can be started by external applications. Also, look for components that request high permissions; you can focus on components that use sensitive APIs, which may involve access to private data. Check components that have registered system broadcasts, which can be called when specific events are triggered and are easily exploited by malicious applications.

[0150] Developers can specify whether a component is exported by setting the exported attribute of the component. In AndroidManifest.xml, a component can be instantiated by setting enabled, so when detecting exposed components, components whose enabled attribute is false must be excluded first.

[0151] Developers can specify whether a component is exported by setting the exported attribute of the component. Before Android 12, if any action attribute was set in the intent-filter subtag, exported defaulted to true. Considering that there are still a large number of devices that still use systems before Android 12, the detection of exposed components takes the above situation into consideration.

[0152] Dynamic registration can be obtained by analyzing the registration function call, and obtaining the component name and intent-filter by analyzing its parameters. Other rules are the same as dynamic registration.

[0153] In addition to setting the above permissions by directly setting related properties to determine whether a component can be accessed by external applications, in order to protect components from being called by untrusted external components, Android applications can also declare permissions for component calls. Only applications that obtain the permissions specified by the component can call the component. When an application calls the component but does not have the permissions declared by the component, the system will throw an exception.

[0154] Therefore, high-risk component detection must filter out components that declare permissions that cannot be obtained by third-party applications. Android allows components to specify the permissions required to call the component through the android:permission attribute. For ContentProvider, you can also declare the android:readPermission and android:writePermission attributes.

[0155] B. Use Soot to load class files and find dynamically loaded broadcast and activity components. The activity component can be a high-risk Android Activity:

[0156] Soot is a Java program analysis framework that can be used to statically analyze Java bytecode. By loading class files, you can find dynamically loaded broadcasts and active components. You can use Soot to load the class files of an application and obtain Java bytecode; by analyzing Java bytecode, you can find the code for dynamically loaded broadcasts, such as the code for dynamically registering broadcast receivers; by analyzing Java bytecode, you can find active components, such as high-risk Android Activities.

[0157] C. Identify the entry of lifecycle functions, the entry of dynamic broadcast receivers, the entry of bound services, and the entry of asynchronous communication:

[0158] By analyzing the Java bytecode, the entry of the lifecycle function is identified, such as onCreate, onDestroy, etc.; by analyzing the Java bytecode, the entry of the dynamic broadcast receiver is identified, such as the code for dynamically registering the broadcast receiver; by analyzing the Java bytecode, the entry of the bound service is identified, such as the code for binding the service; by analyzing the Java bytecode, the entry of the asynchronous communication is identified, such as asynchronous task (AsyncTask), callback function (Callback), etc.

[0159] Among them, the common life cycle functions include:

[0160] onCreate(): Called when the Activity is created. Used to initialize the interface and data, such as setting the layout and initializing variables.

[0161] onStart(): Called when the Activity becomes visible. Suitable for starting animations or loading data.

[0162] onResume(): Called when the Activity starts interacting with the user. You can resume animation or audio playback here.

[0163] onPause(): Called when another Activity is started. It can be used to save data or pause resources to reduce the usage of system resources.

[0164] onStop(): Called when the Activity is no longer visible. You can release resources that are no longer needed at this time, such as stopping background services.

[0165] onDestroy(): Called when the Activity is destroyed. Used to clean up resources and prevent memory leaks.

[0166] Among them, the entrance of the dynamic broadcast receiver:

[0167] registerReceiver(): Dynamically register a broadcast receiver at runtime to receive specific system broadcasts. The receiver needs to implement the BroadcastReceiver interface and register it in an Activity or Service.

[0168] Among them, the entry for binding service:

[0169] Binder: Used to provide a communication interface between the client and the Service. By inheriting the Binder class, you can return a service instance for the client to call.

[0170] Handler: Used to pass messages and execute tasks between the main thread and other threads. You can create a Handler in the Service to process client requests.

[0171] AIDL (Android Interface Definition Language): It is used to define the interface for cross-process communication, allowing different applications to call each other. By defining the interface through the AIDL file, the system will generate the corresponding code.

[0172] Among them, the entry of asynchronous communication:

[0173] AsyncTask: Used to perform operations in a background thread and update the UI after completion (deprecated). Implemented by extending the AsyncTask class. Thread and Runnable: Used to create and manage background threads. Execute long-running tasks by creating a Thread or implementing the Runnable interface. HandlerThread: Creates a thread with a message queue, suitable for handling asynchronous tasks. Process messages in this thread through Handler.

[0174] The above interfaces and methods are used in Android development to manage component lifecycles, handle broadcasts, implement service binding, and asynchronous communication.

[0175] Therefore, by detecting and identifying the entry points of high-risk programs, security vulnerabilities can be discovered and repaired in a timely manner, thereby improving the overall security of the application; identifying and processing high-risk entry points helps reduce the risk of applications being maliciously exploited and protects user data and privacy; analyzing call permission information can help developers better manage application permissions, ensure that only necessary permissions are requested, and reduce permission abuse; by monitoring system broadcast information and protected broadcast information, unauthorized applications can be prevented from interfering with the normal operation of the system and enhance system stability.

[0176] In summary, obtaining application information and detecting the entry points of high-risk programs is an important security analysis step, which helps to improve application security, reduce security risks, optimize permission management, enhance system stability, and ultimately improve user experience.

[0177] In a possible embodiment, step 140 includes:

[0178] Step 310, performing taint analysis on the intermediate representation file of the application source code to obtain the taint analysis result of the application source code; the taint analysis result of the application source code includes: the global call graph of the application source code, the reachable local API and the taint reachability information of the application source code; and,

[0179] Step 320, analyzing the intermediate representation file of the local source code to obtain the taint analysis result of the local source code, the taint analysis result of the local source code including: a call graph and taint call information of the local source code;

[0180] Step 330, obtaining the taint analysis result of the program content according to the taint analysis result of the application source code and the taint analysis result of the local source code.

[0181] Global call graph: A graph that describes the calling relationships of all functions in a program, used to analyze the calling relationships and data flows between functions.

[0182] Reachable local API: The local API that can be called in the program is used to analyze the program's access to local resources.

[0183] Taint reachability information: describes the path and location of tainted data propagation in the program, which is used to identify potential security vulnerabilities.

[0184] Call graph: a graph describing the calling relationships of functions in a program, used to analyze the calling relationships and data flows between functions. Global call graph of application source code: a graph describing the calling relationships of functions in application source code; call graph of local source code: a graph describing the calling relationships of functions in local source code.

[0185] Tainted call information: describes the propagation path and location of tainted data in function calls, which is used to identify potential security vulnerabilities.

[0186] Steps 310 to 330 are described below respectively:

[0187] Involving step 310: Loading the intermediate representation file of the application source code into the taint analysis tool. By analyzing the intermediate representation file, a global call graph of the application source code is generated to describe the calling relationships of all functions in the program. By analyzing the intermediate representation file, the local API that can be called in the application source code is identified to analyze the program's access to local resources. Starting from the taint source, the data flow is tracked to identify potential taint propagation paths. The taint reachability information of the application source code is generated to describe the path and location of the tainted data propagation in the program.

[0188] Determine the entry point of the application, starting from the entry point of the application, extract all possible call paths. Then, the Andersen algorithm can be used to generate a global call graph. The Andersen algorithm is a flow-invariant analysis technique used to generate a global call graph for a program. It builds a call graph by tracing alias relationships between variables.

[0189] Before step 310, the following steps may also be included: setting source rules and sink rules, that is, defining source and sink rules as needed, so as to identify the flow of tainted data during the analysis process.

[0190] Source: where data enters the application, such as user input, file reading, etc. Sink: where data is output, such as network request, file writing, etc.

[0191] Through the global call graph, the propagation path of the taint data is tracked, and the source and destination of each taint are recorded. During the analysis process, all reachable local APIs are recorded, including their call relationships and taint information. The taint analysis results are organized into a readable format, which can be a graphical call graph or a text report.

[0192] Therefore, by performing taint analysis on the intermediate representation file of the application source code and obtaining the taint analysis results of the application source code, data flow and potential security risks can be effectively tracked. This process can help developers identify possible vulnerabilities and unsafe API calls in the application.

[0193] Involving step 320: Taint analysis of local source code is used to detect possible security vulnerabilities in local source code. By tracing the data flow, potential taint propagation paths are identified. The intermediate representation file of the local source code is loaded into the taint analysis tool; by analyzing the intermediate representation file, a call graph of the local source code is generated to describe the function call relationship in the program; starting from the taint source, the data flow is traced to identify potential taint propagation paths; taint call information of the local source code is generated to describe the propagation path and position of the taint data in the function call.

[0194] In a possible embodiment, step 320 includes:

[0195] Through the taint analysis algorithm, the intermediate representation file of the local source code, the reachable local API and the taint reachability information of the application source code are analyzed to obtain the taint analysis result of the local source code.

[0196] The taint analysis algorithm may be PhASAR, which is a framework for program analysis and supports taint analysis and call graph generation.

[0197] Taint analysis is a static analysis technique used to detect possible security vulnerabilities in programs. It identifies potential taint propagation paths by tracing data flows. Taint analysis of local source code needs to combine taint reachable information of application source code and reachable local APIs to fully identify potential security vulnerabilities.

[0198] Specifically, the intermediate representation file of the local source code can be loaded into the taint analysis tool; the local API information accessible in the application source code can be loaded into the taint analysis tool for analyzing the access of the local source code to the local resources; the taint reachability information of the application source code can be loaded into the taint analysis tool for analyzing the taint propagation path in the local source code; the intermediate representation file of the local source code, the accessible local API and the taint reachability information of the application source code are analyzed through the taint analysis algorithm to identify potential taint propagation paths; the taint analysis results of the local source code are generated, including the call graph and taint call information, which describe the propagation path and position of the taint data in the function call.

[0199] By combining the taint reachability information of the application source code with the accessible local API, taint analysis of the local source code can more comprehensively identify potential security vulnerabilities and improve the security of the application; by automating the taint analysis process, manual analysis errors are reduced and the maintainability of the system is improved.

[0200] Involving step 330: Comprehensively applying the taint analysis results of the source code and the local source code to obtain the taint analysis results of the program content. By analyzing the global call graph, the reachable local API, the taint reachable information, the call graph and the taint call information, potential security vulnerabilities are identified.

[0201] Conduct a comprehensive analysis of the taint analysis results of the application source code and the local source code to identify potential security vulnerabilities; generate an analysis report based on the taint analysis results, including information such as potential security vulnerabilities, taint propagation paths, and sensitive data flows; visualize the taint analysis results through visualization tools to facilitate developers to understand and fix security vulnerabilities.

[0202] In a possible embodiment, step 330 includes:

[0203] Generate a global call graph based on the global call graph of the application source code and the call graph of the local source code;

[0204] According to the reachable local API, the taint reachable information of the application source code and the taint call information of the local source code, the global taint call result is obtained;

[0205] The global call graph and the global tainted call results are integrated to obtain the taint analysis results of the program content.

[0206] By integrating the call graph and tainted call information of the application source code and local source code, a global call graph and global tainted call results are generated, thereby obtaining the taint analysis results of the program content. The global call graph describes the call relationships of all functions in the program, and the global tainted call results describe the propagation path and location of the tainted data in the program.

[0207] Among them, the step of generating a global call graph based on the global call graph of the application source code and the call graph of the local source code includes: loading the global call graph of the application source code into the taint analysis tool; loading the call graph of the local source code into the taint analysis tool; integrating the global call graph of the application source code and the call graph of the local source code to generate a global call graph to describe all function call relationships in the program.

[0208] Extract information from the global call graph of the application source code and the call graph of the local source code, integrate the two call graphs, and generate a global call graph that contains all the call relationships between the application source code and the local source code. By analyzing the global call graph, you can identify cross-layer call relationships, such as how the application source code calls the local source code through JNI. The global call graph can accurately reflect the call relationships between the various components in the entire software project.

[0209] Among them, the step of obtaining the global taint call result according to the reachable local API, the taint reachable information of the application source code and the taint call information of the local source code includes: loading the reachable local API: loading the reachable local API information in the application source code into the taint analysis tool for analyzing the access of the local source code to the local resources; loading the taint reachable information of the application source code into the taint analysis tool for analyzing the taint propagation path in the local source code; loading the taint call information of the local source code into the taint analysis tool for analyzing the taint propagation path in the local source code.

[0210] Extract the tainted data path from the reachable local API, the tainted reachable information of the application source code and the tainted call information of the local source code; integrate this information to generate a global tainted call result containing all potential tainted data paths.

[0211] By analyzing the results of global taint calls, we can identify cross-layer taint propagation paths, such as when application source code data is passed to local source code via JNI. This ensures that the results of global taint calls can accurately reflect the propagation and impact of tainted data in the entire software project.

[0212] Finally, the reachable local API, the tainted reachable information of the application source code and the tainted call information of the local source code are integrated to obtain the global tainted call result, which describes the propagation path and location of the tainted data in the program.

[0213] The global call graph and global taint call results are integrated and analyzed to identify potential security vulnerabilities. The taint analysis results can also be used to generate an analysis report, including information such as potential security vulnerabilities, taint propagation paths, sensitive data flows, etc. The taint analysis results can also be visualized through visualization tools to facilitate developers to understand and fix security vulnerabilities.

[0214] Since the global call graph is a graph that integrates the calling relationships between application source code and local source code, it shows the call chain between various components in the entire software project; the global call graph helps developers understand the overall structure and calling process of the software, especially when performing performance optimization and security analysis.

[0215] The global taint call results combine the analysis results of the application source code and local source code taint information, showing the propagation path of tainted data in the entire software project. The global taint call results help developers identify and deal with potential security risks, especially the risks of data leakage and malicious exploitation.

[0216] Therefore, by generating a global call graph and global taint call results, the security of the software project can be comprehensively evaluated, including application source code and local source code. The global taint analysis results can help accurately identify potential risk points in data flow, so as to carry out targeted security reinforcement. The global taint analysis results provide data support for the formulation and optimization of security strategies, which helps to improve the security protection capabilities of the software.

[0217] By integrating the call graph and taint call information of the application source code and local source code to generate a global call graph and global taint call results, potential security vulnerabilities can be identified more comprehensively and the security of the application can be improved; by automating the taint analysis process, manual analysis errors are reduced and the maintainability of the system is improved.

[0218] In an embodiment of the present application, a compilation instruction for a program content of an application is received, wherein the program content includes an application source code and a local source code; according to the compilation instruction, a local source code compiler is called to obtain an intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, so the local source code compiler can call the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program can compile the local source code into an intermediate representation file, which is convenient for subsequent analysis of the intermediate representation file of the local source code. Since the intermediate representation file of the local source code is generated from the local source code, the correspondence between the intermediate representation file of the local source code and the local source code is clear. According to the compilation instructions, the application source code compiler is called to compile the application source code to obtain the intermediate representation file of the application source code. Similarly, the correspondence between the intermediate representation file of the application source code and the application source code is also clear; taint analysis is performed on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis results of the program content. The taint analysis results of the program content can be traced back to the source code of the application, which is convenient for problem location and repair. It can efficiently perform taint analysis in cross-language scenarios, which is convenient for accurate identification of risks and optimization of security policies.

[0219] The stain analysis method provided in the embodiment of the present application can be executed by a stain analysis device. In the embodiment of the present application, the stain analysis device provided in the embodiment of the present application is described by taking the stain analysis method executed by the stain analysis device as an example.

[0220] Figure 4 400 is a block diagram of a stain analysis device provided in an embodiment of the present application, the device 400 includes:

[0221] The receiving module 410 is used to receive a compile instruction for the program content of the application program, wherein the program content includes application source code and local source code;

[0222] an acquisition module 420, configured to call the local source code compiler according to the compilation instruction to obtain the intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file;

[0223] A compiling module 430, configured to call an application source code compiler to compile the application source code according to the compiling instruction to obtain an intermediate representation file of the application source code;

[0224] The analysis module 440 is used to perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content.

[0225] In a possible embodiment, the device 400 may further include:

[0226] A search module, used to search for the storage path of the software development kit SDK of the application;

[0227] The search module is also used to search for the storage path of the local development kit NDK through the storage path of the SDK;

[0228] The parameter adding module is used to add the intermediate representation compilation parameters to the compilation parameters of the NDK version compiler through the storage path of the NDK to obtain the interception program, and the intermediate representation compilation parameters are used to generate an intermediate representation file according to the local source code.

[0229] In a possible embodiment, the analysis module 440 includes:

[0230] A detection module, used to detect the entry of high-risk programs of the application program;

[0231] The analysis module 440 is specifically used to: take the entry of the high-risk program of the application as the starting point, perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code, and obtain the taint analysis result of the program content.

[0232] In a possible embodiment, the detection module is specifically used to:

[0233] Obtaining application information of the application, where the application information is used to describe the behavior, permissions, and communication methods of the application;

[0234] According to the application information, an entry of a high-risk program of the application program is detected.

[0235] In a possible embodiment, the analysis module 440 is specifically configured to:

[0236] Performing taint analysis on the intermediate representation file of the application source code to obtain the taint analysis result of the application source code; the taint analysis result of the application source code includes: a global call graph of the application source code, a reachable local API and taint reachability information of the application source code; and,

[0237] Analyze the intermediate representation file of the local source code to obtain a taint analysis result of the local source code, wherein the taint analysis result of the local source code includes: a call graph and taint call information of the local source code;

[0238] The taint analysis result of the program content is obtained according to the taint analysis result of the application source code and the taint analysis result of the local source code.

[0239] In a possible embodiment, the analysis module 440 is specifically configured to:

[0240] The intermediate representation file of the local source code, the reachable local API and the taint reachability information of the application source code are analyzed by a taint analysis algorithm to obtain a taint analysis result of the local source code.

[0241] In a possible embodiment, the analysis module 440 is specifically configured to:

[0242] Generate a global call graph according to the global call graph of the application source code and the call graph of the local source code;

[0243] Obtaining a global taint call result according to the reachable local API, the taint reachability information of the application source code, and the taint call information of the local source code;

[0244] The global call graph and the global taint call result are integrated to obtain a taint analysis result of the program content.

[0245] In an embodiment of the present application, a compilation instruction for a program content of an application is received, wherein the program content includes an application source code and a local source code; according to the compilation instruction, a local source code compiler is called to obtain an intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, so the local source code compiler can call the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program can compile the local source code into an intermediate representation file, which is convenient for subsequent analysis of the intermediate representation file of the local source code. Since the intermediate representation file of the local source code is generated from the local source code, the correspondence between the intermediate representation file of the local source code and the local source code is clear. According to the compilation instructions, the application source code compiler is called to compile the application source code to obtain the intermediate representation file of the application source code. Similarly, the correspondence between the intermediate representation file of the application source code and the application source code is also clear; taint analysis is performed on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis results of the program content. The taint analysis results of the program content can be traced back to the source code of the application, which is convenient for problem location and repair. It can efficiently perform taint analysis in cross-language scenarios, which is convenient for accurate identification of risks and optimization of security policies.

[0246] The stain analysis device in the embodiment of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtualreality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personalcomputer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0247] The stain analysis device of the embodiment of the present application may be a device having an action system. The action system may be an Android action system, an iOS action system, or other possible action systems, which are not specifically limited in the embodiment of the present application.

[0248] The stain analysis device provided in the embodiment of the present application can implement each process implemented in the above method embodiment, and will not be described again here to avoid repetition.

[0249] Alternatively, if Figure 5 As shown, an embodiment of the present application also provides an electronic device 510, including a processor 511, a memory 512, and a program or instruction stored in the memory 512 and executable on the processor 511. When the program or instruction is executed by the processor 511, each step of any of the above-mentioned stain analysis method embodiments is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0250] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0251] Figure 6 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0252] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, and a processor 610.

[0253] Those skilled in the art will appreciate that the electronic device 600 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 610 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0254] The processor 610 is used to receive a compile instruction for a program content of an application program, wherein the program content includes an application source code and a local source code;

[0255] The processor 610 is further configured to call the local source code compiler according to the compilation instruction to obtain the intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file;

[0256] The processor 610 is further configured to call an application source code compiler to compile the application source code according to the compilation instruction to obtain an intermediate representation file of the application source code;

[0257] The processor 610 is further configured to perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain a taint analysis result of the program content.

[0258] Optionally, the processor 610 is further configured to search for a storage path of a software development kit SDK of the application program;

[0259] The processor 610 is further configured to search for a storage path of a local development toolkit NDK through the storage path of the SDK;

[0260] The processor 610 is further configured to add intermediate representation compilation parameters to the compilation parameters of the NDK version of the compiler through the storage path of the NDK to obtain the interception program, wherein the intermediate representation compilation parameters are used to generate an intermediate representation file according to the local source code.

[0261] Optionally, the processor 610 is further configured to detect an entry of a high-risk program of the application program;

[0262] The processor 610 is further configured to perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code, starting from the entry of the high-risk program of the application, to obtain the taint analysis result of the program content.

[0263] Optionally, the processor 610 is further configured to obtain application information of the application, where the application information is used to describe the behavior, permissions, and communication method of the application;

[0264] The processor 610 is further configured to detect an entry of a high-risk program of the application program according to the application information.

[0265] Optionally, the processor 610 is further configured to perform a taint analysis on the intermediate representation file of the application source code to obtain a taint analysis result of the application source code; the taint analysis result of the application source code includes: a global call graph of the application source code, a reachable local API, and taint reachability information of the application source code; and,

[0266] The processor 610 is further configured to analyze the intermediate representation file of the local source code to obtain a taint analysis result of the local source code, wherein the taint analysis result of the local source code includes: a call graph and taint call information of the local source code;

[0267] The processor 610 is further configured to obtain a taint analysis result of the program content according to a taint analysis result of the application source code and a taint analysis result of the local source code.

[0268] Optionally, the processor 610 is further configured to analyze the intermediate representation file of the local source code, the reachable local API and the taint reachability information of the application source code through a taint analysis algorithm to obtain a taint analysis result of the local source code.

[0269] Optionally, the processor 610 is further configured to generate a global call graph according to the global call graph of the application source code and the call graph of the local source code;

[0270] The processor 610 is further configured to obtain a global taint call result according to the reachable local API, the taint reachability information of the application source code, and the taint call information of the local source code;

[0271] The processor 610 is further configured to integrate the global call graph and the global taint call result to obtain a taint analysis result of the program content.

[0272] In an embodiment of the present application, a compilation instruction for a program content of an application is received, wherein the program content includes an application source code and a local source code; according to the compilation instruction, a local source code compiler is called to obtain an intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, so the local source code compiler can call the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program can compile the local source code into an intermediate representation file, which is convenient for subsequent analysis of the intermediate representation file of the local source code. Since the intermediate representation file of the local source code is generated from the local source code, the correspondence between the intermediate representation file of the local source code and the local source code is clear. According to the compilation instructions, the application source code compiler is called to compile the application source code to obtain the intermediate representation file of the application source code. Similarly, the correspondence between the intermediate representation file of the application source code and the application source code is also clear; taint analysis is performed on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis results of the program content. The taint analysis results of the program content can be traced back to the source code of the application, which is convenient for problem location and repair. It can efficiently perform taint analysis in cross-language scenarios, which is convenient for accurate identification of risks and optimization of security policies.

[0273] It should be understood that in the embodiment of the present application, the input unit 604 may include a graphics processor (Graphics Processing Unit, GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of the static picture or video image obtained by the image capture device (such as a camera) in the video image capture mode or the image capture mode. The display unit 606 may include a display panel 6061, and the display panel 6061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 607 includes at least one of a touch panel 6071 and other input devices 6072. The touch panel 6071 is also called a touch screen. The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include, but are not limited to, a physical keyboard, a function key (such as a volume control button, a switch button, etc.), a trackball, a mouse, and an action rod, which will not be repeated here. The memory 609 can be used to store software programs and various data, including but not limited to applications and action systems. The processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the action system, user pages and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 610.

[0274] The memory 609 can be used to store software programs and various data. The memory 609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 609 may include a volatile memory or a non-volatile memory, or the memory x09 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0275] The processor 610 may include one or more processing units; optionally, the processor 610 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 610.

[0276] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned stain analysis method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0277] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0278] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned stain analysis method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0279] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0280] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned stain analysis method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0281] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0282] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0283] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A stain analysis method, characterized in that: The method comprises: receiving a compile instruction for program content of an application program, wherein the program content includes application source code and local source code; According to the compilation instruction, calling the local source code compiler to obtain the intermediate representation file of the local source code through the interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into the intermediate representation file; According to the compilation instruction, calling the application source code compiler to compile the application source code to obtain an intermediate representation file of the application source code; Performing taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain a taint analysis result of the program content.

2. The method according to claim 1, characterized in that Before calling the local source code compiler to obtain the intermediate representation file of the local source code through an interception program according to the compilation instruction, the method further includes: Find the storage path of the software development kit SDK of the application; Find the storage path of the local development kit NDK through the storage path of the SDK; By using the storage path of the NDK, an intermediate representation compilation parameter is added to the compilation parameter of the NDK version compiler to obtain the interception program, wherein the intermediate representation compilation parameter is used to generate an intermediate representation file according to the local source code.

3. The method according to claim 1, characterized in that The performing taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content includes: Detecting the entry of high-risk programs of the application; Taking the entry of the high-risk program of the application as the starting point, taint analysis is performed on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content.

4. The method according to claim 3, characterized in that The detecting the entry of the high-risk program of the application comprises: Obtaining application information of the application, where the application information is used to describe the behavior, permissions, and communication methods of the application; According to the application information, an entry of a high-risk program of the application program is detected.

5. The method according to claim 1 or 3, characterized in that: The performing taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content includes: Performing taint analysis on the intermediate representation file of the application source code to obtain the taint analysis result of the application source code; the taint analysis result of the application source code includes: a global call graph of the application source code, a reachable local API and taint reachability information of the application source code; and, Analyze the intermediate representation file of the local source code to obtain a taint analysis result of the local source code, wherein the taint analysis result of the local source code includes: a call graph and taint call information of the local source code; The taint analysis result of the program content is obtained according to the taint analysis result of the application source code and the taint analysis result of the local source code.

6. The method according to claim 5, characterized in that The step of analyzing the intermediate representation file of the local source code to obtain the taint analysis result of the local source code includes: The intermediate representation file of the local source code, the reachable local API and the taint reachability information of the application source code are analyzed by a taint analysis algorithm to obtain a taint analysis result of the local source code.

7. The method according to claim 5, characterized in that The step of obtaining the taint analysis result of the program content according to the taint analysis result of the application source code and the taint analysis result of the local source code includes: Generate a global call graph according to the global call graph of the application source code and the call graph of the local source code; Obtaining a global taint call result according to the reachable local API, the taint reachability information of the application source code, and the taint call information of the local source code; The global call graph and the global taint call result are integrated to obtain a taint analysis result of the program content.

8. A stain analysis device, characterized in that: The device comprises: A receiving module, configured to receive a compile instruction for a program content of an application program, wherein the program content includes an application source code and a local source code; an acquisition module, configured to call a local source code compiler according to the compilation instruction to obtain an intermediate representation file of the local source code through an interception program, wherein the interception program and the local source code compiler have a preset link relationship, the local source code compiler calls the interception program through the preset link relationship to obtain the intermediate representation file of the local source code, and the interception program is used to compile the local source code into an intermediate representation file; A compiling module, configured to call an application source code compiler to compile the application source code according to the compiling instruction, and obtain an intermediate representation file of the application source code; The analysis module is used to perform taint analysis on the intermediate representation file of the application source code and the intermediate representation file of the local source code to obtain the taint analysis result of the program content.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images