Data access path reconstruction method and terminal

Abstract

The invention discloses a data access path reconstruction method and a terminal, and the method comprises the steps: obtaining an original first application programming interface table and data thereof in response to a data access request, the data of the first application programming interface table comprising a name and a memory address; establishing a second application programming interface table with the same size as the first application programming interface table, and filling the second application programming interface table with data of the first application programming interface table in an out-of-order manner; and performing out-of-order operation on the names in the second application programming interface table, replacing the out-of-order names into the second application programming interface table, and releasing the first application programming interface table at the same time. According to the method, the application programming interface is protected by reconstructing the application programming interface table, remapping the memory of the data of the application programming interface table and disrupting the name of the data in the table, so that the data security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a data access path reconstruction method and a terminal. Background Art

[0002] With the rapid development of information technology, API (Application Programming Interface) has become an indispensable part of software development. API allows an application to access the functions or data of another service. Simply put, API is like a waiter who can understand the developer's request and convert it into instructions that the computer can recognize. Then, it helps developers get the required information from other programs or services or perform specific operations. Developers only need to reference the corresponding API program interface to implement further program development steps, which greatly improves the efficiency and flexibility of software development. However, with the widespread application of API, security issues have become increasingly prominent, especially the application of HOOK technology, which has brought severe challenges and security risks to software security.

[0003] HOOK technology is a malicious attack method that inserts malicious code into the normal program execution process to obtain sensitive information or control program behavior. In order to prevent this attack, effective anti-HOOK technical measures need to be taken. At present, common anti-HOOK technologies mainly include: protecting functions by scanning API interfaces and comparing and protecting data by scanning API interface memory. However, both methods have certain limitations. The first method mainly stores the API in a table, and other developers can hijack the API by replacing the content of the table. The second method mainly stores the API in a table. The API corresponding to the table is a piece of memory data that has already implemented the function. Other developers can hijack the data by modifying the memory data. Both methods require the creation of threads or clocks to monitor the data in real time, which increases the resource consumption of the system. When the thread is suspended or the thread is modified, the two methods will fail. Therefore, there is an urgent need for a data access path reconstruction method and terminal that can solve the above problems. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a data access path reconstruction method and terminal, which can realize API interface protection, thereby improving data security.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A data access path reconstruction method comprises the steps of: S1. In response to a data access request, obtaining an original first application programming interface table and its data, wherein the first application programming interface table data includes a name and a memory address; S2, establishing a second API table of the same size as the first API table, and filling the data of the first API table into the second API table in a random order; S3. Perform a shuffle operation on the names in the second application programming interface table, and replace the shuffled names into the second application programming interface table, while releasing the first application programming interface table.

[0006] In order to solve the above technical problems, another technical solution adopted by the present invention is: A data access path reconstruction terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the above-mentioned data access path reconstruction method is implemented.

[0007] The beneficial effects of the present invention are as follows: a data access path reconstruction method and terminal provided by the present invention obtain the original first application programming interface table and its data by responding to a data access request, so as to facilitate subsequent data migration, and can quickly locate and retrieve the required application programming interface information, which helps to improve development efficiency and reduce search time; establish a second application programming interface table of the same size as the first application programming interface table, and fill the first application programming interface table data into the second application programming interface table in a disorderly manner to ensure data integrity and avoid data loss or omission, and fill in a disorderly manner to remap memory, increase the difficulty of attack, and improve data security; perform disorder operations on the names in the second application programming interface table, and replace the disordered names with the second application programming interface table, protect memory data through disordered names, and do not need to create threads or clocks to monitor data in real time, ensuring data security, while releasing the original first application programming interface table to avoid occupying memory and optimizing memory management. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A flowchart of a method for reconstructing a data access path according to an embodiment of the present invention; Figure 2 A schematic diagram of a data access path reconstruction terminal according to an embodiment of the present invention; Figure 3 Another flow chart of a method for reconstructing a data access path according to an embodiment of the present invention; Description of labels: 1. A data access path reconstruction terminal; 2. A memory; 3. A processor. DETAILED DESCRIPTION

[0009] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0010] Please refer to Figure 1 , an embodiment of the present invention provides a data access path reconstruction method, comprising the steps of: S1. In response to a data access request, obtaining an original first application programming interface table and its data, wherein the first application programming interface table data includes a name and a memory address; S2, establishing a second API table of the same size as the first API table, and filling the data of the first API table into the second API table in a random order; S3. Perform a shuffle operation on the names in the second application programming interface table, and replace the shuffled names into the second application programming interface table, while releasing the first application programming interface table.

[0011] From the above description, it can be seen that the beneficial effects of the present invention are: by responding to a data access request, the original first application programming interface table and its data are obtained to facilitate subsequent data migration, and the required application programming interface information can be quickly located and retrieved, which helps to improve development efficiency and reduce search time; a second application programming interface table of the same size as the first application programming interface table is established, and the data of the first application programming interface table is filled into the second application programming interface table in a disorderly manner to ensure data integrity and avoid data loss or omission, and the filling is performed in a disorderly manner, and the memory is remapped to increase the difficulty of attack and improve data security; the names in the second application programming interface table are shuffled, and the shuffled names are replaced with the second application programming interface table, and the memory data is protected by the shuffled names, and there is no need to create threads or clocks to monitor the data in real time, ensuring data security, while releasing the original first application programming interface table to avoid occupying memory and optimize memory management.

[0012] Furthermore, the step of filling the first application programming interface table data into the second application programming interface table out of order includes: Copying the first application programming interface table data, and filling the copied data into the second application programming interface table; A random sequence is obtained, and the memory addresses in the second application programming interface table data are arranged according to the random sequence.

[0013] From the above description, it can be seen that by copying the first application programming interface table and filling the copied data into the second application programming interface table, data omission is avoided and data integrity is ensured; by arranging the memory addresses in the second application programming interface table in a random sequence, the memory space layout is disrupted, the difficulty of attack is increased, and data security is ensured.

[0014] Furthermore, the step of filling the first application programming interface table data into the second application programming interface table in a disorderly manner includes: According to the memory address in the second application programming interface table data, the corresponding name is queried from the first application programming interface table, and the name corresponding to the memory address in the second application programming interface table data is replaced with the queried name.

[0015] As can be seen from the above description, the disordered memory addresses in the second application programming interface table are bound to their corresponding names to ensure that the corresponding memory addresses can be obtained according to the names, thereby reading the corresponding memory data and ensuring data consistency.

[0016] Furthermore, the random operation of the names in the second application programming interface table is specifically: The names in the second application programming interface table are arranged in random order according to preset rules, and the preset rules include at least one of a message digest algorithm, a hexadecimal conversion, and a hash algorithm.

[0017] From the above description, it can be seen that the name of the second application programming interface table is scrambled through preset rules to protect memory data, and multiple preset rules are set to select appropriate preset rules for shuffling according to needs, thereby improving data processing flexibility and enhancing anti-attack capabilities, thereby ensuring data security.

[0018] Furthermore, after step S3, the method further includes: The corresponding memory address is found in the second application programming interface table according to the disordered name, and the memory data is accessed according to the memory address.

[0019] From the above description, it can be seen that the corresponding memory address is found through the scrambled name, and the memory data is accessed according to the memory address to ensure the accuracy of data access. In addition, the scrambled name is used to hide the real name, protect the memory data from unauthorized access, and improve the security and confidentiality of the data.

[0020] Please refer to Figure 2Another embodiment of the present invention provides a data access path reconstruction terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements each step of the above-mentioned data access path reconstruction method when executing the computer program.

[0021] The data access path reconstruction method and terminal of the present invention are suitable for protection when calling an application programming interface, thereby improving data security, and are described below through specific implementation methods: Please refer to Figure 1 and Figure 3 , Embodiment 1 of the present invention is: a method for reconstructing a data access path, comprising the steps of: S1. In response to a data access request, obtain an original first application programming interface table and its data, wherein the first application programming interface table data includes a name and a memory address.

[0022] In this embodiment, by responding to a data access request, the original first application programming interface table and its data are obtained to facilitate subsequent data migration, and the required application programming interface information can be quickly located and retrieved, which helps to improve development efficiency and reduce search time.

[0023] S2. Create a second application programming interface table of the same size as the first application programming interface table, and fill the data in the first application programming interface table into the second application programming interface table in a random order.

[0024] In this embodiment, a second application programming interface table of the same size as the first application programming interface table is established, and the data of the first application programming interface table is randomly filled into the second application programming interface table to ensure data integrity and avoid data loss or omission. The data is filled in a random manner and the memory is remapped to increase the difficulty of attack and improve data security.

[0025] Further, in this embodiment, the random filling of the first application programming interface table data into the second application programming interface table includes: copying the first application programming interface table data, filling the copied data into the second application programming interface table to avoid data omission and ensure data integrity; obtaining a random sequence, and arranging the memory addresses in the second application programming interface table data according to the random sequence, for example, the memory address of function name 1: 0x1500, the memory address of function name 2: 0x1800, the memory addresses of these two function names are not far apart, and function name 2 can be indirectly located through function name 1. When the memory address is randomized, the relationship is broken. The random sequence is based on mid-term traversal of the application programming interface table and is allocated from top to bottom. The memory addresses in the second application programming interface table are arranged in columns to disrupt the memory space layout, increase the difficulty of attack, and ensure data security; the corresponding name is queried from the first application programming interface table according to the memory address in the second application programming interface table data, and the name corresponding to the memory address in the second application programming interface table data is replaced with the queried name to ensure that the corresponding memory address can be obtained according to the name, so as to read the corresponding memory data and ensure data consistency. For example, the first application programming interface table data is: function 1: 0x500, function 2: 0xA00, function 3: 0x100, and it is randomly filled into the second application programming interface table, then the second application programming interface table data is: function 3: 0x100, function 1: 0x500, function 2: 0xA00.

[0026] S3. Perform a shuffle operation on the names in the second application programming interface table, and replace the shuffled names into the second application programming interface table, while releasing the first application programming interface table.

[0027] In this embodiment, memory data is protected by shuffled names, and there is no need to create threads or clocks to monitor data in real time, thereby ensuring data security. At the same time, the original first application programming interface table is released to avoid memory occupation and optimize memory management. For example, the data in the first application programming interface table is: A: address 1, B: address 2, C: address 3, and they are filled into the second application programming interface table in shuffled order. Then the data in the second application programming interface table is: B: address 2, C: address 3, A: address 1. The names in the second application programming interface table data are shuffled and replaced with the shuffled names into the second application programming interface table. At this time, the data in the second application programming interface table is: B0: address 2, C0: address 3, A0: address 1.

[0028] Further, in this embodiment, the shuffling operation on the names in the second application programming interface table is specifically: shuffling the names in the second application programming interface table according to a preset rule, the preset rule includes at least one of a message digest algorithm, a hexadecimal conversion, and a hash algorithm, and the specific shuffling operation is: 1. Message digest algorithm: randomize the name by MD5, that is, convert the name into 128-bit MD5 output, and represent it as a 32-bit string in hexadecimal, and use the MD5 value to match the original API name; 2. Hexadecimal conversion: convert the name to hexadecimal data, obtain the hexadecimal value of the name in the memory and the name size, and randomize it according to the rand() random function and the hexadecimal value. The randomization method is rand% hexadecimal value. For example, the hexadecimal value corresponding to character 1 in the memory is 31, then rand%31 means taking a random value in 0-31 HEX; 3. Hash algorithm: The name is encrypted by the hash algorithm to output the hash value, and the hash value is used to match the original application programming interface name. The hash algorithm includes HASH128 and HASH256. The name of the second application programming interface table is shuffled through preset rules to protect memory data, and multiple preset rules are set. The appropriate preset rules are selected for shuffling according to needs, which improves data processing flexibility and enhances anti-attack capabilities, thereby ensuring data security.

[0029] Furthermore, in this embodiment, after step S3, it also includes: searching for the corresponding memory address in the second application programming interface table according to the scrambled name, accessing the memory data according to the memory address to ensure the accuracy of data access, and using scrambled names to hide the real names, protecting the memory data from unauthorized access, and improving the security and confidentiality of the data.

[0030] Please refer to Figure 2 The second embodiment of the present invention is: a data access path reconstruction terminal 1, including a memory 2, a processor 3 and a computer program stored in the memory 2 and executable on the processor 3, and the processor 3 implements each step of a data access path reconstruction method of the first embodiment when executing the computer program.

[0031] In summary, the present invention provides a data path access reconstruction method and terminal, which obtains the original first application programming interface table and its data in response to a data access request to facilitate subsequent data migration, establishes a second application programming interface table of the same size as the first application programming interface table, and fills the first application programming interface table data into the second application programming interface table in a disorderly order, including: copying the first application programming interface table data, filling the copied data into the second application programming interface table to avoid data omission and ensure data integrity; obtaining a random sequence, arranging the memory addresses in the second application programming interface table data according to the random sequence, disrupting the memory space layout, increasing the difficulty of attack, and ensuring data security; querying the corresponding name from the first application programming interface table according to the memory address in the second application programming interface table data, and using the queried name Replace the name corresponding to the memory address in the second application programming interface table data to ensure that the corresponding memory address can be obtained according to the name, so as to read the corresponding memory data and ensure data consistency, that is, by establishing virtual simulation data and performing risk control on the data, and matching the data with the corresponding risk client to improve data security and specificity; shuffle the names in the second application programming interface table according to preset rules, and replace the shuffled names with the second application programming interface table, wherein the preset rules include at least one of a message digest algorithm, a hexadecimal conversion, and a hash algorithm, protect memory data by shuffling the names, select appropriate preset rules for shuffling according to needs, improve data processing flexibility, enhance anti-attack capabilities, and do not need to create threads or clocks to monitor data in real time to ensure data security. At the same time, release the original first application programming interface table to avoid occupying memory and optimize memory management.

[0032] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data access path reconstruction method, characterized in that: Includes steps: S1. In response to a data access request, obtaining an original first application programming interface table and its data, wherein the first application programming interface table data includes a name and a memory address; S2, establishing a second API table of the same size as the first API table, and filling the data of the first API table into the second API table in a random order; S3. Perform a shuffle operation on the names in the second application programming interface table, and replace the shuffled names into the second application programming interface table, while releasing the first application programming interface table.

2. A data access path reconstruction method according to claim 1, characterized in that: The step of filling the first application programming interface table data into the second application programming interface table in a disorderly manner comprises: Copying the first application programming interface table data, and filling the copied data into the second application programming interface table; A random sequence is obtained, and the memory addresses in the second application programming interface table data are arranged according to the random sequence.

3. A data access path reconstruction method according to claim 2, characterized in that: The step of filling the first application programming interface table data into the second application programming interface table in a disorderly manner comprises: According to the memory address in the second application programming interface table data, the corresponding name is queried from the first application programming interface table, and the name corresponding to the memory address in the second application programming interface table data is replaced with the queried name.

4. A data access path reconstruction method according to claim 1, characterized in that: The random operation of the names in the second application programming interface table is specifically: The names in the second application programming interface table are arranged in random order according to preset rules, and the preset rules include at least one of a message digest algorithm, a hexadecimal conversion, and a hash algorithm.

5. A method for reconstructing a data access path according to claim 1, characterized in that: After step S3, the method further includes: The corresponding memory address is found in the second application programming interface table according to the disordered name, and the memory data is accessed according to the memory address.

6. A data access path reconstruction terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: S1. In response to a data access request, obtaining an original first application programming interface table and its data, wherein the first application programming interface table data includes a name and a memory address; S2, establishing a second API table of the same size as the first API table, and filling the data of the first API table into the second API table in a random order; S3. Perform a shuffle operation on the names in the second application programming interface table, and replace the shuffled names into the second application programming interface table, while releasing the first application programming interface table.

7. A data access path reconstruction terminal according to claim 6, characterized in that: The step of filling the first application programming interface table data into the second application programming interface table in a disorderly manner comprises: Copying the first application programming interface table data, and filling the copied data into the second application programming interface table; A random sequence is obtained, and the memory addresses in the second application programming interface table data are arranged according to the random sequence.

8. The data access path reconstruction terminal according to claim 7, characterized in that: The step of filling the first application programming interface table data into the second application programming interface table in a disorderly manner comprises: According to the memory address in the second application programming interface table data, the corresponding name is queried from the first application programming interface table, and the name corresponding to the memory address in the second application programming interface table data is replaced with the queried name.

9. The data access path reconstruction terminal according to claim 6, characterized in that: The random operation of the names in the second application programming interface table is specifically: The names in the second application programming interface table are arranged in random order according to preset rules, and the preset rules include at least one of a message digest algorithm, a hexadecimal conversion, and a hash algorithm.

10. The data access path reconstruction terminal according to claim 6, characterized in that: After step S3, the method further includes: The corresponding memory address is found in the second application programming interface table according to the disordered name, and the memory data is accessed according to the memory address.

Images