Risk calling detection method and device, equipment and medium
By dynamically detecting the location of the target method call code segment in the three-party library list and executable files of the mobile application, identifying and avoiding risk method calls, it solves the possibility of risks and hacking in mobile applications, and improves the application's Security and user experience.
Patent Information
- Application Number
- CN202311048756.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-18
- Publication Date
- 2025-02-21
AI Technical Summary
There are modifications in mobile applications and hackers who exploit vulnerabilities to commit illegal behavior, resulting in unexpected risks or hackers when using applications, which leads to user data leakage and loss.
By dynamically obtaining the application's three-party library list and executable file, finding the target method calls corresponding to the three-party library list, and determining the code segment location of the target method calls in the executable file. If the code segment position exceeds the preset code segment position, it is determined to be a risk method call.
Effectively detect and avoid risk method calls in applications, improve application security and robustness, reduce the risk of user data leakage and loss, and improve user experience.
Smart Images
Figure CN119494099A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of computer security, and in particular to a risk call detection method, device, equipment and medium. Background Art
[0002] Among the related technologies, the security of mobile terminals has received much attention. Since a large number of mobile applications (Application, App) are released on the Internet, and the developers of the apps are uneven, the security quality of the apps they develop varies. At the same time, there are modified apps on the Internet, and some apps will exploit loopholes for some illegal gains or malicious damage, causing users to encounter unexpected risks or be hacked when using the apps, which may lead to user data leakage or even losses, affecting user security and experience. Summary of the invention
[0003] The present disclosure provides a risk call detection method, device, equipment and medium to solve the technical problem that there are unexpected risks or the possibility of hacker intrusion in related technologies, which may lead to user data leakage or even loss, affecting user security and experience. The technical solution of the present disclosure is as follows:
[0004] In a first aspect, an embodiment of the present disclosure provides a method for detecting risk calls, including:
[0005] Dynamically obtain a list of third-party libraries and executable files of an application, where the list of third-party libraries is used to represent at least one third-party library implanted in the application, and the executable file is a code compilation file, which contains the location of the code segment;
[0006] Find at least one target method call corresponding to the tripartite library list;
[0007] The code segment position corresponding to the target method call is determined in the executable file, and the target method call whose code segment position exceeds the preset code segment position is determined as a risky method call.
[0008] In a possible implementation, in the method provided by the embodiment of the present invention, before searching for the target method call corresponding to the third-party library list, the method further includes:
[0009] Get the initial list of third-party libraries corresponding to the application when it is released;
[0010] Compare the initial third-party library list with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there are no risky method calls in the application.
[0011] In a possible implementation, in the method provided by the embodiment of the present invention, comparing the code segment position of the target method call in the executable file, and determining that the target method call whose code segment position exceeds the code segment position in the executable file is a risky method call, includes:
[0012] Traverse all target method calls and determine the code segment location corresponding to each target method call;
[0013] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0014] In a possible implementation, in the method provided by the embodiment of the present invention, comparing the code segment position of the target method call in the executable file, and determining that the target method call whose code segment position exceeds the code segment position in the executable file is a risky method call, includes:
[0015] Forward the code segment of the target method call to the assembly function, and determine the code segment location corresponding to each target method call based on the assembly function;
[0016] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0017] In a second aspect, the embodiment of the present disclosure further provides a risk call detection device, including:
[0018] An acquisition unit, used to dynamically acquire a list of third-party libraries and an executable file of an application, wherein the list of third-party libraries is used to represent at least one third-party library implanted in the application, and the executable file is a code compilation file, and the executable file contains a code segment location;
[0019] A search unit, used to search for at least one target method call corresponding to the tripartite library list;
[0020] The determination unit is used to determine the code segment position corresponding to the target method call in the executable file, and determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0021] In a possible implementation manner, in the device provided by the embodiment of the present invention, the searching unit is further used for:
[0022] Get the initial list of third-party libraries corresponding to the application when it is released;
[0023] Compare the initial third-party library list with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there are no risky method calls in the application.
[0024] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit is specifically configured to:
[0025] Traverse all target method calls and determine the code segment location corresponding to each target method call;
[0026] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0027] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit is specifically configured to:
[0028] Forward the code segment of the target method call to the assembly function, and determine the code segment location corresponding to each target method call based on the assembly function;
[0029] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0030] In a third aspect, an embodiment of the present disclosure further provides an electronic device, including:
[0031] processor;
[0032] a memory for storing instructions executable by the processor;
[0033] The processor is configured to execute the instructions to implement the method described in the first aspect.
[0034] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described in the first aspect when executed by a processor.
[0035] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, comprising a computer program / instructions, wherein the computer program / instructions implement the method described in the first aspect when executed by a processor.
[0036] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:
[0037] In the embodiment of the present disclosure, firstly, the third-party library list and executable file of the application are dynamically obtained, then at least one target method call corresponding to the third-party library list is searched, and finally the code segment position corresponding to the target method call is determined in the executable file, and the target method call whose code segment position exceeds the preset code segment position is determined as a risky method call. A risky call detection scheme is provided, which dynamically detects the code segment position of the application in the executable file to determine whether there is a risky method call, thereby avoiding the illegal behavior of hackers or black industries, improving the robustness and security of the application, reducing the state of user data leakage or even loss, and improving the user experience.
[0038] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.
[0040] Figure 1 A flowchart of a risk call detection method provided by an embodiment of the present disclosure;
[0041] Figure 2 A schematic diagram of a specific process of a risk call detection method provided by an embodiment of the present disclosure;
[0042] Figure 3 A schematic diagram of a specific process of another risk call detection method provided by an embodiment of the present disclosure;
[0043] Figure 4 A schematic diagram of a specific process of another risk call detection method provided by an embodiment of the present disclosure;
[0044] Figure 5 A schematic diagram of the structure of a risk call detection device provided by an embodiment of the present disclosure;
[0045] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION
[0046] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.
[0047] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.
[0048] Before describing in detail the risk call detection method provided by the present disclosure, the key terms involved are introduced first, among which:
[0049] app: refers to application (Application, app) generally refers to mobile phone software, mainly refers to software installed on smartphones, which is used to improve the deficiencies of the original system and personalize it.
[0050] Mach-O: The abbreviation of Mach Object file format, which is a file format for executable files, object code, dynamic libraries, and core dumps. As an alternative to the a.out format, Mach-O provides greater scalability and improves the access speed of information in the symbol table.
[0051] Objective-C: Usually written as ObjC or OC and less commonly Objective C or Obj-C, it is an object-oriented programming language that extends C. It is mainly used in Mac OS X and GNUstep, two systems that use the OpenStep standard, and it is the basic language in NeXTSTEP and OpenStep.
[0052] API: API (Application Program Interface) is defined as a set of standards that applications can use to exchange information and commands with a computer operating system.
[0053] Runtime: The Runtime class encapsulates the runtime environment.
[0054] IPA: The abbreviation of Apple application file iPhone Application.
[0055] Hook: assembly function. The hook function is a function that will be executed under certain conditions. It mounts the function implemented by itself to the mount point.
[0056] Among the related technologies, the security of mobile terminals has attracted much attention. Since a large number of mobile applications (Application, App) are released on the Internet, and the developers of apps are uneven, the security quality of the apps they develop varies. At the same time, there are modified apps on the Internet, and a large number of black industries and hackers will exploit loopholes to make some illegal profits or malicious damage, causing users to encounter unexpected risks or be hacked when using apps, which in turn leads to user data leakage or even losses, affecting user security and experience.
[0057] The technical solutions provided by various embodiments of the present disclosure are described in detail below in conjunction with the accompanying drawings.
[0058] Figure 1 A flow chart of a risk call detection method provided in the first embodiment of the present disclosure, such as Figure 1As shown, the risk call detection method may include the following steps:
[0059] S101, dynamically obtain a list of third-party libraries and executable files of the application.
[0060] In specific implementation, the third-party library list and executable file of the current application or the application to be applied are dynamically obtained. The third-party library list is used to represent at least one third-party library implanted in the application. The third-party library is a third-party library called by the application. The executable file is a code compilation file that contains the location of the code segment.
[0061] S102, searching for at least one target method call corresponding to the third-party library list.
[0062] In specific implementation, all method calls corresponding to the third-party library list obtained in step S101 are found and determined as target method calls. In this step, the initial third-party library list corresponding to the record when the application is released can also be obtained, and then the initial third-party library list is compared with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there is no risk method call in the application, and subsequent steps can be skipped.
[0063] S103, determining the code segment position corresponding to the target method call in the executable file, and determining the target method call whose code segment position exceeds the preset code segment position as a risky method call.
[0064] In specific implementation, the code segment position corresponding to the target method call is determined from the executable file, and then the code segment is compared with the preset code segment position. If it exceeds the preset code segment position, it means that there is a risk in the target method call, otherwise it means that the target method call is normal.
[0065] This solution is mainly used in the iOS system. Of course, the same solution can also be used in the Android and Windows systems. Figure 2 , Figure 3 and Figure 4 , taking the application on iOS as an example, the risk call detection method provided by the present invention is described in detail.
[0066] Figure 2 A specific flow chart of a risk call detection method provided by an embodiment of the present disclosure, specifically including the following steps: Figure 2 The following steps are shown:
[0067] S201, dynamically obtain a list of third-party libraries and executable files of the application.
[0068] In specific implementation, the list of third-party libraries and executable files of the application are dynamically obtained. The storage layout format of the ipa file or dynamic library file generated by the iOS system after the application is packaged is the mach-o format. The file stores code and data. When the program is running, it will create a process and then load the contents of the program file into the virtual memory space. The loading method will adopt the memory mapping method. The image of the process is a copy of the program disk file after loading. However, the process loaded into the memory may have some inconsistencies, but the number of libraries in the process should be consistent with that in the program file.
[0069] When obtaining the third-party library list and executable files of an application, due to the randomness of attacks or implants, the devices of some users should be tested every time the App is opened; at the same time, because the detection itself is time-consuming and computing-intensive, it is best to test a part of the users, or to test during certain running time periods of a certain App.
[0070] S202, obtaining an initial third-party library list corresponding to the records when the application is released.
[0071] In specific implementation, an initial third-party library list corresponding to the record when the application is released is obtained. The initial third-party library list can be provided by the development source of the application or obtained from other security platforms, which is not limited in the embodiment of the present invention.
[0072] S203, comparing the initial third-party library list with the third-party library list.
[0073] During specific implementation, the initial third-party library list is compared with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there is no risky method call in the application. If the initial third-party library list is inconsistent with the third-party library list, it is determined that there may be risky method calls in the application. Subsequently, the inconsistent third-party library list is uploaded to the background for comparison, and finally it is determined whether the application is a risky method call.
[0074] In one example, iOS provides a set of APIs for image operations that can obtain images loaded in the application process. After the app is packaged and released, each loaded image is obtained through the API and recorded as the initial third-party library list. When the user opens the app after it goes online, it is collected again and reported, and compared with the initial third-party library list collected before release. If there is a difference, it is characterized as a general risk, and if there is no difference, it is characterized as no risk.
[0075] Figure 3 A specific flow chart of another risk call detection method provided by an embodiment of the present disclosure, specifically including the following steps: Figure 3 The following steps are shown:
[0076] S301, dynamically obtain a list of third-party libraries and executable files of the application.
[0077] S302, searching for at least one target method call corresponding to the third-party library list.
[0078] In specific implementation, all method calls corresponding to the third-party library list obtained in step S301 are searched out and determined as target method calls.
[0079] S303, traverse all target method calls to determine the code segment location corresponding to each target method call.
[0080] In the specific implementation, the method call address range of each target method call, that is, the code segment location, is detected. One way is to asynchronously start a thread at a certain time to traverse all classes (objc_copyClassList), and then traverse all methods of the class through the runtime method (class_copyMethodList), and then obtain the code segment location of the method call based on the class information and method information.
[0081] S304: Determine that a target method call whose code segment position exceeds a preset code segment position is a risky method call.
[0082] In specific implementation, the code segment position corresponding to the target method call determined in step S303 is compared with the preset code segment position to determine whether the function call is risky. In the iOS system, the program code generates a mach-o file, that is, an executable file, after compilation and packaging. The TEXT segment in the file stores all the code of the program. After the TEXT segment is loaded into the memory of the process, the starting address of all its code is fixed. If the code segment position of a certain call exceeds the preset code segment position, that is, the starting address range of the entire TEXT segment, then it is the code that is not originally packaged and brought into the executable program, that is, it is determined to be a risky method call.
[0083] Figure 4 A specific flow chart of another risk call detection method provided by the embodiment of the present disclosure, specifically including the following steps: Figure 4 The following steps are shown:
[0084] S401, dynamically obtain a list of third-party libraries and executable files of the application.
[0085] S402, obtaining an initial third-party library list corresponding to the records when the application is released.
[0086] S403, comparing the initial third-party library list with the third-party library list.
[0087] The above steps are consistent with S201-S203 and S302 and will not be repeated here.
[0088] It is not enough to detect the presence of different third-party libraries in the app. If a legitimate third-party library is implanted, it can be identified based on the third-party library list reported in step S401. If the implanted library is of unknown origin, the function API in it may pose a risk to the app itself when it is called. It is necessary to accurately detect the specific method calls that pose risks. Therefore, it is necessary to perform further risk detection on the method calls of the third-party library.
[0089] S404, searching for at least one target method call corresponding to the third-party library list.
[0090] In specific implementation, all method calls corresponding to the third-party library list obtained in step S401 are searched out and determined as target method calls.
[0091] S405, forwarding the code segment called by the target method to the assembly function, and determining the position of the code segment corresponding to each target method call based on the assembly function.
[0092] In the specific implementation, the assembly function hook objc_msgsend is used for detection. When a method call occurs, after the hook message forwarding method is called, the thread is asynchronously started to detect whether this method call has risks. Considering that the hook message forwarding method call will cause performance loss, it should be controlled by a switch at an appropriate time to control whether it is enabled, such as timed enablement or enablement when the user's device load is not large.
[0093] It should be noted that the detection in this step may also be the detection method of step S303, which will not be described in detail here.
[0094] S406: Determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0095] In specific implementation, the code segment position corresponding to the target method call determined in step S405 is compared with the preset code segment position to determine whether the function call is risky. In the iOS system, the program code generates a mach-o file, that is, an executable file, after compilation and packaging. The TEXT segment in the file stores all the code of the program. After the TEXT segment is loaded into the memory of the process, the starting address of all its code is fixed. If the code segment position of a certain amplified call exceeds the preset code segment position, that is, the starting address range of the entire TEXT segment, then it is the code that is not originally packaged and brought into the executable program, that is, it is determined to be a risky method call. Of course, other functions can also be used to detect the code segment position, and the embodiment of the present invention does not limit this.
[0096] Based on the same inventive concept, the embodiment of the present disclosure also provides a risk call detection device. Figure 5 As shown, the risk call detection device 500 includes:
[0097] The acquisition unit 501 is used to dynamically acquire a list of third-party libraries and an executable file of the application. The list of third-party libraries is used to represent at least one third-party library implanted in the application. The executable file is a code compilation file, and the executable file contains the location of the code segment.
[0098] A search unit 502 is used to search for at least one target method call corresponding to the third-party library list;
[0099] The determination unit 503 is used to determine the code segment position corresponding to the target method call in the executable file, and determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0100] In a possible implementation manner, in the device provided by the embodiment of the present invention, the searching unit 502 is further configured to:
[0101] Get the initial list of third-party libraries corresponding to the application when it is released;
[0102] Compare the initial third-party library list with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there are no risky method calls in the application.
[0103] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit 503 is specifically configured to:
[0104] Traverse all target method calls and determine the code segment location corresponding to each target method call;
[0105] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0106] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit 503 is specifically configured to:
[0107] Forward the code segment of the target method call to the assembly function, and determine the code segment location corresponding to each target method call based on the assembly function;
[0108] It is determined that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
[0109] The specific implementation method and technical effect of the device provided in the embodiment of the present disclosure are similar to those of the above-mentioned method embodiment, and will not be repeated here.
[0110] In addition, combined Figure 1-Figure 5The risk call detection method and device described in the embodiments of the present application can be implemented by an electronic device. Figure 6 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.
[0111] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603 to implement the risk call detection method of the embodiment described in the present disclosure. In RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.
[0112] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.
[0113] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the voice control method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the read-only memory 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.
[0114] The disclosed embodiment also provides a vehicle, comprising the risk call detection device and electronic device described in the above embodiment.
[0115] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.
[0116] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.
[0117] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.
[0118] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:
[0119] Dynamically obtain a list of third-party libraries and executable files of an application, where the list of third-party libraries is used to represent at least one third-party library implanted in the application, and the executable file is a code compilation file, which contains the location of the code segment;
[0120] Find at least one target method call corresponding to the tripartite library list;
[0121] The code segment position corresponding to the target method call is determined in the executable file, and the target method call whose code segment position exceeds the preset code segment position is determined as a risky method call.
[0122] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.
[0123] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).
[0124] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0125] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, constitute a limitation on the unit itself.
[0126] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.
[0127] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0128] The risk call detection method mentioned in the embodiment of the present invention includes:
[0129] In the embodiment of the present disclosure, firstly, the third-party library list and executable file of the application are dynamically obtained, then at least one target method call corresponding to the third-party library list is searched, and finally the code segment position corresponding to the target method call is determined in the executable file, and the target method call whose code segment position exceeds the preset code segment position is determined as a risky method call. A risky call detection scheme is provided, which dynamically detects the code segment position of the application in the executable file to determine whether there is a risky method call, thereby avoiding the illegal behavior of hackers or black industries, improving the robustness and security of the application, reducing the state of user data leakage or even loss, and improving the user experience.
[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0134] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.
[0135] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.
Claims
1. A method for detecting risk calls, characterized in that: include: Dynamically obtain a list of third-party libraries and an executable file of an application, wherein the list of third-party libraries is used to represent at least one third-party library implanted in the application, and the executable file is a code compilation file, and the executable file contains a code segment location; Find at least one target method call corresponding to the third-party library list; The code segment position corresponding to the target method call is determined in the executable file, and the target method call whose code segment position exceeds the preset code segment position is determined as a risky method call.
2. The method according to claim 1, characterized in that Before calling the target method corresponding to the third-party library list, the method further includes: Obtaining an initial list of third-party libraries corresponding to the records of the application when it is released; The initial third-party library list is compared with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there is no risk method call in the application.
3. The method according to claim 1, characterized in that The comparing the code segment position of the target method call in the executable file and determining that the target method call whose code segment position exceeds the code segment position in the executable file is a risky method call includes: Traverse all target method calls and determine the code segment location corresponding to each target method call; Determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
4. The method according to claim 1, characterized in that: The comparing the code segment position of the target method call in the executable file and determining that the target method call whose code segment position exceeds the code segment position in the executable file is a risky method call includes: Forwarding the code segment of the target method call to an assembly function, and determining the code segment position corresponding to each target method call based on the assembly function; Determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
5. A risk call detection device, characterized in that: include: An acquisition unit, used for dynamically acquiring a list of third-party libraries and an executable file of an application, wherein the list of third-party libraries is used to represent at least one third-party library implanted in the application, and the executable file is a code compilation file, and the executable file contains a code segment location; A search unit, used to search for at least one target method call corresponding to the third-party library list; The determination unit is used to determine the code segment position corresponding to the target method call in the executable file, and determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
6. The device according to claim 5, characterized in that The search unit is also used for: Obtaining an initial list of third-party libraries corresponding to the records of the application when it is released; The initial third-party library list is compared with the third-party library list. If the initial third-party library list is consistent with the third-party library list, it is determined that there is no risk method call in the application.
7. The device according to claim 5, characterized in that The determining unit is specifically used for: Traverse all target method calls and determine the code segment location corresponding to each target method call; Determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
8. The device according to claim 5, characterized in that The determining unit is specifically used for: Forwarding the code segment of the target method call to an assembly function, and determining the code segment position corresponding to each target method call based on the assembly function; Determine that the target method call whose code segment position exceeds the preset code segment position is a risky method call.
9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the risk call detection method as described in any one of claims 1-4.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the risk call detection method described in any one of claims 1 to 4 is implemented.
11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the risk call detection method described in any one of claims 1-4 is implemented.