Method and device for acquiring application behavior data in Android non-root permission environment
By obtaining and modifying hook functions in Android applications, the problem of not being able to obtain application behavior data in Android non-root permission environment is solved, and the monitoring and tracking of application behavior is realized.
Patent Information
- Application Number
- CN202311349067.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-10-18
- Publication Date
- 2025-04-18
AI Technical Summary
In Android non-root permission environment, it is impossible to easily obtain the behavioral data of mobile applications, resulting in the inability to monitor whether the application collects user privacy information or sensitive information.
By obtaining the offset address of the target hook function in an Android non-root permission environment, obtaining its target content, and modifying it through injecting code to generate the target update hook function, thereby obtaining the behavior data of the target application.
It realizes the acquisition of the target application's behavior data in an Android non-root permission environment, can monitor the application's behavior and prevent the collection of private information and sensitive information.
Smart Images
Figure CN119847852A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of computers, and specifically relates to a method, device, electronic device, and storage medium for obtaining application behavior data in an Android non-root permission environment. Background Art
[0002] In order to prevent mobile applications from collecting and using user information and other illegal operations, it is necessary to obtain the behavioral data of mobile applications in order to track and detect the behavior of mobile applications.
[0003] However, in an Android root environment, it is usually easy to obtain the behavioral data of mobile phone applications. Summary of the invention
[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for obtaining application behavior data in an Android non-root permission environment, which can solve the problem of how to obtain the behavior data of mobile phone applications in an Android non-root permission environment.
[0005] In a first aspect, an embodiment of the present application provides a method for obtaining application behavior data in an Android non-root permission environment, the method comprising:
[0006] In an Android non-root permission environment, obtaining an offset address of a target hook function, wherein the target hook function is used to obtain behavior data of a target application;
[0007] Based on the offset address of the target hook function, obtaining the target content of the target hook function;
[0008] Modifying the target content of the target hook function in the form of code injection to obtain a target update hook function;
[0009] The target update hook function is used to obtain the behavior data of the target application.
[0010] In a second aspect, an embodiment of the present application provides a device for obtaining application behavior data in an Android non-root permission environment, the device comprising:
[0011] An acquisition module, used to acquire an offset address of a target hook function in an Android non-root permission environment, wherein the target hook function is used to acquire behavior data of a target application; and based on the offset address of the target hook function, acquire a target content of the target hook function;
[0012] A modification module, used to modify the target content of the target hook function by injecting code to obtain a target update hook function;
[0013] The acquisition module is further used to acquire the behavior data of the target application by utilizing the target update hook function.
[0014] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.
[0015] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.
[0016] At least one of the above technical solutions provided in the embodiments of the present application can achieve the following technical effects:
[0017] In an embodiment of the present application, in an Android non-root permission environment, the offset address of the target hook function is obtained, and the target hook function is used to obtain the behavior data of the target application; based on the offset address of the target hook function, the target content of the target hook function is obtained; the target content of the target hook function is modified in the form of code injection to obtain a target update hook function; and the behavior data of the target application is obtained using the target hook function. In this way, after obtaining the offset address of the target hook function, based on the offset address of the target hook function, the target content in the target hook function used to obtain the behavior data of the target application is obtained, and the target content of the target hook function is modified in the form of code injection to obtain a target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 This is a flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application.
[0019] Figure 2 This is a flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application.
[0020] Figure 3 This is a flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application.
[0021] Figure 4 This is a flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application.
[0022] Figure 5 This is a structural block diagram of a device for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application.
[0023] Figure 6 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0024] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0025] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.
[0026] As discussed in the background technology section, in an Android root permission environment, it is usually easy to obtain the behavior data of mobile phone applications and monitor whether the mobile phone applications collect user privacy information or sensitive information. However, in an Android non-root permission environment, due to the access permission restrictions of the Android system, it is impossible to obtain the application behavior data. Therefore, this application provides a method for obtaining application behavior data in an Android non-root permission environment to monitor whether the mobile phone applications collect user privacy information or sensitive information.
[0027] Hook technology monitors application behavior by intercepting and modifying application function calls, records information such as the number of application function calls and execution time, and performs reverse engineering and debugging. In one embodiment of the present application, the hook technology can be implemented by calling the target hook function.
[0028] In one embodiment of the present application, the method for obtaining application behavior data in an Android non-root permission environment can modify the target hook function by injecting code into the target hook function, generate a target update hook function, and obtain the real-time behavior of the application on the Android system by calling the target update hook function, thereby achieving traceability of application behavior.
[0029] In one embodiment of the present application, the target update hook function can be implemented in the native layer, and the name of the target hook function is replaced with the name of the target update hook function. When the target application on the Android system is running, the target hook function is called. In the target update hook function, the behavior data of the target application is obtained to track and monitor the application behavior.
[0030] In one embodiment of the present application, the original address of the target hook function can be obtained in an Android non-root permission environment through a reflection mechanism, and the current Android system version information of the terminal can be obtained. Based on the current Android system version information of the terminal, the offset address of the target hook function can be obtained, and the actual address of the target hook function can be obtained by combining the original address and the offset address of the target hook function. Based on the actual address of the target hook function, the target content of the target hook function can be obtained, and the target content of the target hook function can be modified to obtain a target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0031] It should be understood that the method for obtaining application behavior data in the Android non-root permission environment provided in the embodiment of the present application can be executed by a first electronic device. The first electronic device can be a terminal deployed with an Android system, such as any device such as a mobile phone, a tablet or a laptop. After the first electronic device sends the behavior data of the target application to the second electronic device, the first electronic device receives the analysis result returned by the second electronic device after analyzing the behavior data of the target application. The second electronic device can be other devices deployed on the network side, which can be a terminal or a server. When the second electronic device is a server, it can be a single server or a server cluster, which is specifically used to receive the behavior data of the target application sent by the first electronic device and then analyze it, and return the analysis result to the first electronic device.
[0032] The attendance clocking method provided by the embodiment of the present application is described in detail below through specific embodiments and application scenarios in conjunction with the accompanying drawings.
[0033] See also Figure 1 , Figure 1 A flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:
[0034] Step 110: In an Android non-root permission environment, obtain the offset address of the target hook function, and the target hook function is used to obtain the behavior data of the target application. Specifically, the current Android system version information of the terminal can be obtained, and based on the current Android system version information of the terminal, the offset address of the target hook function is obtained. The behavior data of the target application includes behavior data for collecting user privacy information or behavior data for collecting sensitive information, wherein the behavior of collecting user privacy information may include the behavior of collecting user mobile phone numbers, user ID numbers, user address book list information, etc., and the collection of sensitive information may include the behavior of collecting user device numbers, device location information, etc.
[0035] Step 120: Based on the offset address of the target hook function, the target content of the target hook function is obtained. Specifically, the original address of the target hook function may be obtained first, and the actual address of the target hook function may be obtained according to the original address of the target hook function and the offset address of the target hook function, and the target content of the target hook function may be obtained based on the actual address of the target hook function.
[0036] Step 130: modifying the target content of the target hook function in the form of code injection to obtain a target update hook function;
[0037] Step 140: Utilize the target update hook function to obtain the behavior data of the target application.
[0038] In an embodiment of the present application, in an Android non-root permission environment, the offset address of the target hook function is obtained, and the target hook function is used to obtain the behavior data of the target application; based on the offset address of the target hook function, the target content of the target hook function is obtained; the target content of the target hook function is modified in the form of code injection to obtain a target update hook function; and the behavior data of the target application is obtained using the target hook function. In this way, after obtaining the offset address of the target hook function, based on the offset address of the target hook function, the target content of the target hook function used to obtain the behavior data of the target application is obtained, and the target content of the target hook function is modified in the form of code injection to obtain a target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0039] In one embodiment of the present application, the process of obtaining the offset address of the target hook function in step 110 may first obtain the current Android system version information of the terminal, and obtain the offset address of the target hook function based on the current Android system version information of the terminal. Specifically, the current Android system version information of the terminal may be obtained first, and the libart.so file may be obtained based on the current Android system version information of the terminal, and the libart.so file may be loaded through a third-party tool to obtain the offset address of the target hook function.
[0040] In an embodiment of the present application, the current Android system version information of the terminal is obtained, and based on the current Android system version information of the terminal, the offset address of the target hook function is obtained to determine the offset address of the target hook function for different versions of the Android system, so that the actual address of the target hook function can be determined according to the offset address and original address of the target hook function, and then the target content of the target hook function is obtained and modified to obtain the target update hook function, so that the target update hook function can be used to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0041] See also Figure 2 , Figure 2 A flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided in an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:
[0042] Step 210: Obtain the current Android system version information of the terminal;
[0043] Step 220: Based on the current Android system version information of the terminal, obtain the libart.so file. Step 230: Load the libart.so file through a third-party tool to obtain the offset address of the target hook function. Specifically, the libart.so file can be loaded through a third-party tool, and the libart.so file can be decompiled, and then the offset address of the target hook function can be extracted from the compiled code information generated by decompiling the libart.so file.
[0044] Step 240: based on the offset address of the target hook function, obtaining the target content of the target hook function;
[0045] Step 250: modifying the target content of the target hook function by injecting code to obtain a target update hook function;
[0046] Step 260: Utilize the target update hook function to obtain the behavior data of the target application.
[0047] In an embodiment of the present application, based on the current Android system version information of the terminal, the libart.so file is obtained, and the libart.so file is loaded through a third-party tool to obtain the offset address of the target hook function, so as to determine the actual address of the target hook function according to the offset address and the original address of the target hook function, and then obtain the target content of the target hook function and modify it to obtain the target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0048] See also Figure 3 , Figure 3 A flowchart of a method for obtaining application behavior data in an Android non-root permission environment provided in an embodiment of the present application, such as Figure 3 As shown, the method comprises the following steps:
[0049] Step 310: in an Android non-root permission environment, obtaining an offset address of a target hook function, wherein the target hook function is used to obtain behavior data of a target application;
[0050] Step 320: Obtain the original address of the target hook function. Specifically, the original address of the target hook function can be obtained in an Android non-root permission environment through a reflection mechanism.
[0051] Step 330: Obtaining the actual address of the target hook function according to the original address of the target hook function and the offset address of the target hook function;
[0052] Step 340: Based on the actual address of the target hook function, the target content of the target hook function is obtained. Specifically, the target content of the target hook function is located in the ArtMethod structure, and after the actual address of the target hook function is obtained according to the original address of the target hook function and the offset address of the target hook function, the target content of the target hook function is obtained in the ArtMethod structure according to the actual address of the target hook function.
[0053] Step 350: Modify the target content of the target hook function by injecting code to obtain a target update hook function. Specifically, a first target code may be inserted at the entry of the target hook function, and a second target code may be inserted at the exit of the target hook function to obtain a target update hook function; wherein the first target code is used to observe at least one of a parameter, a return value, and an execution flow; and the second target code is used to observe at least one of a parameter, a return value, and an execution flow.
[0054] Step 360: Utilize the target update hook function to obtain the behavior data of the target application.
[0055] In one embodiment of the present application, in step 350, the target content of the target hook function is modified by injecting code to obtain a target update hook function. The target update hook function can be obtained by inserting a first target code at the entrance of the target hook function and inserting a second target code at the exit of the target hook function; wherein the first target code is used to observe at least one of parameters, return values and execution flow; and the second target code is used to observe at least one of parameters, return values and execution flow.
[0056] In an embodiment of the present application, the first target code may be a code snippet that implements a log function, and the log function is used to record the behavior data of the target application, and the behavior data of the target application includes behavior data for collecting user privacy information, or behavior data for collecting sensitive information. The second target code may be a code snippet that sends the behavior data of the target application to a second electronic device, such as an Android Interface Definition Language (aidl) interface, or other methods, which are not specifically limited in the present application.
[0057] In an embodiment of the present application, in an Android non-root permission environment, the offset address and original address of the target hook function are obtained, the actual address of the target hook function is obtained based on the offset address and original address of the target hook function, the target content of the target hook function is obtained according to the actual address of the target hook function, and the target content is modified by injecting code to obtain a target update hook function. By injecting code, the behavior data of the target application, such as the number of function calls, execution time and other information, is recorded to monitor the application performance, which is helpful for analyzing application performance bottlenecks, finding application performance bottlenecks and optimizing them. Specifically, the target update hook function is obtained by inserting a first target code at the entrance of the target hook function and inserting a second target code at the exit of the target hook function. In this way, code is inserted at the entrance and exit of the target hook function to observe parameters, return values and execution processes, which is convenient for debugging applications, and helps to analyze problems, identify errors and optimize performance.
[0058] In one embodiment of the present application, the target content of the target hook function is located in the ArtMethod structure, and the behavior data of the target application includes behavior data for collecting user privacy information, or behavior data for collecting sensitive information.
[0059] In the embodiment of the present application, the ArtMethod structure stores information such as the name of the target hook function and the target content of the target hook function. In an Android non-root permission environment, the offset address of the target hook function and the original address of the target hook function are obtained, and the actual address of the target hook function is obtained according to the original address of the target hook function and the offset address of the target hook function. Based on the actual address of the target hook function, the target content of the target hook function is obtained in the ArtMethod structure, and the target content of the target hook function is modified in the form of injected code to obtain a target update hook function, and the name of the target hook function is replaced with the name of the target update hook function. When the target application on the Android system is running, the target update hook function generated after modifying the target content in the target hook function is called to obtain the behavior data of the target application to track and monitor the application behavior.
[0060] In one embodiment of the present application, the method is executed by a first electronic device; after obtaining the behavior data of the target application by using the target update hook function, the method also includes: the first electronic device sends the behavior data of the target application to a second electronic device; the first electronic device receives the analysis results returned by the second electronic device after analyzing the behavior data of the target application.
[0061] In an embodiment of the present application, after the target application behavior data is obtained by using the target update hook function, the first electronic device sends the target application behavior data to the second electronic device, and the second electronic device obtains and analyzes the target application behavior data, and returns the analysis result of the target application behavior data to the first electronic device. For example, the second electronic device analyzes the target application behavior data, and finds that the target application has behavior data that collects user privacy information or behavior data that collects sensitive information, and then returns the analysis result to the first electronic device to prompt the first electronic device to restrict the target device from running or uninstall the target electronic device.
[0062] See also Figure 4 , Figure 4 The flowchart provided for the embodiment of the present application is as follows: Figure 4 As shown, the method comprises the following steps:
[0063] Step 410: Obtain the current Android system version information of the terminal;
[0064] Step 413: Based on the current Android system version information of the terminal, obtain the libart.so file. Step 416: Load the libart.so file through a third-party tool to obtain the offset address of the target hook function. Specifically, the libart.so file can be loaded through a third-party tool, and the libart.so file can be decompiled, and then the offset address of the target hook function can be extracted from the compiled code information generated by decompiling the libart.so file.
[0065] Step 419: Obtain the original address of the target hook function. Specifically, the original address of the target hook function can be obtained in an Android non-root permission environment through a reflection mechanism.
[0066] Step 422: Obtaining the actual address of the target hook function according to the original address of the target hook function and the offset address of the target hook function;
[0067] Step 425: Based on the actual address of the target hook function, the target content of the target hook function is obtained. Specifically, the target content of the target hook function is located in the ArtMethod structure. After the actual address of the target hook function is obtained according to the original address of the target hook function and the offset address of the target hook function, the target content of the target hook function is obtained in the ArtMethod structure according to the actual address of the target hook function.
[0068] Step 428: modify the target content of the target hook function in the form of injected code to obtain a target update hook function.
[0069] In an embodiment of the present application, in step 428, the target content of the target hook function is modified by injecting code to obtain a target update hook function. The target update hook function can be obtained by inserting a first target code at the entrance of the target hook function and inserting a second target code at the exit of the target hook function; wherein the first target code is used to observe at least one of parameters, return values and execution flow; and the second target code is used to observe at least one of parameters, return values and execution flow.
[0070] In an embodiment of the present application, the first target code may be a code snippet that implements a log function, and the log function is used to record the behavior data of the target application, and the behavior data of the target application includes behavior data for collecting user privacy information, or behavior data for collecting sensitive information. The second target code may be a code snippet that sends the behavior data of the target application to a second electronic device, such as an Android Interface Definition Language (aidl) interface, or other methods, which are not specifically limited in the present application.
[0071] Step 431: Utilize the target update hook function to obtain the behavior data of the target application.
[0072] Step 434: the first electronic device sends the behavior data of the target application to the second electronic device;
[0073] Step 437: The first electronic device receives the analysis result returned by the second electronic device after analyzing the behavior data of the target application.
[0074] In an embodiment of the present application, after the target application behavior data is obtained by using the target update hook function, the first electronic device sends the target application behavior data to the second electronic device, and the second electronic device obtains and analyzes the target application behavior data, and returns the analysis result of the target application behavior data to the first electronic device. For example, the second electronic device analyzes the target application behavior data and finds that the target application has behavior data that collects user privacy information or behavior data that collects sensitive information, then returns the analysis result to the first electronic device to prompt the first electronic device to restrict the target device from running or uninstall the target electronic device.
[0075] In an embodiment of the present application, in an Android non-root permission environment, the offset address of the target hook function is obtained, and the target hook function is used to obtain the behavior data of the target application; based on the offset address of the target hook function, the target content of the target hook function is obtained; the target content of the target hook function is modified in the form of code injection to obtain a target update hook function; and the behavior data of the target application is obtained using the target hook function. In this way, after obtaining the offset address of the target hook function, based on the offset address of the target hook function, the target content of the target hook function used to obtain the behavior data of the target application is obtained, and the target content of the target hook function is modified in the form of code injection to obtain a target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0076] Figure 5 This is a structural block diagram of a device for obtaining application behavior data in an Android non-root permission environment provided by an embodiment of the present application. Figure 5 The device 500 for obtaining application behavior data in an Android non-root permission environment provided in an embodiment of the present application includes:
[0077] The acquisition module 510 is used to acquire the offset address of the target hook function in the Android non-root permission environment, wherein the target hook function is used to acquire the behavior data of the target application; based on the offset address of the target hook function, acquire the target content of the target hook function;
[0078] A modification module 520, configured to modify the target content of the target hook function by injecting code to obtain a target update hook function;
[0079] The acquisition module 510 is further used to acquire the behavior data of the target application by using the target update hook function.
[0080] In an embodiment of the present application, in an Android non-root permission environment, the offset address of the target hook function is obtained, and the target hook function is used to obtain the behavior data of the target application; based on the offset address of the target hook function, the target content of the target hook function is obtained; the target content of the target hook function is modified in the form of code injection to obtain a target update hook function; and the behavior data of the target application is obtained using the target update hook function. In this way, after obtaining the offset address of the target hook function, based on the offset address of the target hook function, the target content of the target hook function used to obtain the behavior data of the target application is obtained, and the target content of the target hook function is modified in the form of code injection to obtain a target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0081] In the embodiment of the present application, in the process of obtaining the offset address of the target hook function, the obtaining module 510 is specifically used to:
[0082] Get the current Android system version information of the terminal;
[0083] Based on the current Android system version information of the terminal, the offset address of the target hook function is obtained.
[0084] In the embodiment of the present application, in the process of acquiring the offset address of the target hook function based on the current Android system version information of the terminal, the acquisition module 510 is specifically used to:
[0085] Based on the current Android system version information of the terminal, obtain the libart.so file;
[0086] The libart.so file is loaded through a third-party tool to obtain the offset address of the target hook function.
[0087] In the embodiment of the present application, in the process of acquiring the target content of the target hook function based on the offset address of the target hook function, the acquisition module 510 is specifically used to:
[0088] Obtaining the original address of the target hook function;
[0089] Obtaining the actual address of the target hook function according to the original address of the target hook function and the offset address of the target hook function;
[0090] Based on the actual address of the target hook function, the target content of the target hook function is obtained.
[0091] In the embodiment of the present application, in the process of modifying the target content of the target hook function by injecting code to obtain the target update hook function, the modification module 520 is specifically used for:
[0092] Inserting a first target code at the entry of the target hook function, and inserting a second target code at the exit of the target hook function to obtain a target update hook function;
[0093] Among them, the first target code is used to observe at least one of parameters, return values and execution process; the second target code is used to observe at least one of parameters, return values and execution process.
[0094] In an embodiment of the present application, the target content of the target hook function is located in the ArtMethod structure, and the behavior data of the target application includes behavior data for collecting user privacy information, or behavior data for collecting sensitive information.
[0095] In the embodiment of the present application, after the target update hook function is used to obtain the behavior data of the target application, the device 500 for obtaining application behavior data in an Android non-root permission environment provided by the embodiment of the present application further includes:
[0096] A sending module, used for the first electronic device to send the behavior data of the target application to the second electronic device;
[0097] The receiving module is used for the first electronic device to receive the analysis result returned by the second electronic device after analyzing the behavior data of the target application.
[0098] like Figure 6 As shown, an embodiment of the present application also provides an electronic device 600, which can be various types of computers, etc. The electronic device 600 includes: a processor 610 and a memory 620, and the memory 620 stores programs or instructions, and the program or instructions implement the steps of any of the methods described above when executed by the processor 610. For example, when the program is executed by the processor 610, the following process is implemented: in an Android non-root permission environment, the offset address of the target hook function is obtained, and the target hook function is used to obtain the behavior data of the target application; based on the offset address of the target hook function, the target content of the target hook function is obtained; by injecting code, the target content of the target hook function is modified to obtain a target update hook function; and the behavior data of the target application is obtained using the target hook function. In this way, after obtaining the offset address of the target hook function, based on the offset address of the target hook function, the target content in the target hook function used to obtain the behavior data of the target application is obtained, and the target content of the target hook function is modified in the form of injected code to obtain the target update hook function, so as to use the target update hook function to achieve the purpose of obtaining the behavior data of the target application in an Android non-root permission environment.
[0099] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the attendance punching method provided in any of the above embodiments are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
[0100] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0101] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0102] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0103] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.
[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.
[0105] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.
Claims
1. A method for obtaining application behavior data in an Android non-root permission environment, characterized in that: include: In an Android non-root permission environment, obtaining an offset address of a target hook function, wherein the target hook function is used to obtain behavior data of a target application; Based on the offset address of the target hook function, obtaining the target content of the target hook function; Modifying the target content of the target hook function in the form of code injection to obtain a target update hook function; The target update hook function is used to obtain the behavior data of the target application.
2. The method according to claim 1, characterized in that The obtaining of the offset address of the target hook function includes: Get the current Android system version information of the terminal; Based on the current Android system version information of the terminal, the offset address of the target hook function is obtained.
3. The method according to claim 2, characterized in that The step of obtaining the offset address of the target hook function based on the current Android system version information of the terminal includes: Based on the current Android system version information of the terminal, obtain the libart.so file; The libart.so file is loaded through a third-party tool to obtain the offset address of the target hook function.
4. The method according to any one of claims 1 to 3, characterized in that: The acquiring the target content of the target hook function based on the offset address of the target hook function includes: Obtaining the original address of the target hook function; Obtaining the actual address of the target hook function according to the original address of the target hook function and the offset address of the target hook function; Based on the actual address of the target hook function, the target content of the target hook function is obtained.
5. The method according to any one of claims 1 to 3, characterized in that: The target content of the target hook function is modified in the form of code injection to obtain a target update hook function, including: Inserting a first target code at the entry of the target hook function, and inserting a second target code at the exit of the target hook function to obtain a target update hook function; Among them, the first target code is used to observe at least one of parameters, return values and execution process; the second target code is used to observe at least one of parameters, return values and execution process.
6. The method according to any one of claims 1 to 3, characterized in that: The target content of the target hook function is located in the ArtMethod structure, and the behavior data of the target application includes behavior data for collecting user privacy information, or behavior data for collecting sensitive information.
7. The method according to any one of claims 1 to 3, characterized in that: The method is executed by a first electronic device; after acquiring the behavior data of the target application by using the target update hook function, the method further includes: The first electronic device sends the behavior data of the target application to the second electronic device; The first electronic device receives an analysis result returned by the second electronic device after analyzing the behavior data of the target application.
8. A device for obtaining application behavior data in an Android non-root permission environment, characterized in that: include: An acquisition module, used to acquire an offset address of a target hook function in an Android non-root permission environment, wherein the target hook function is used to acquire behavior data of a target application; Based on the offset address of the target hook function, obtaining the target content of the target hook function; A modification module, used to modify the target content of the target hook function by injecting code to obtain a target update hook function; The acquisition module is further used to acquire the behavior data of the target application by utilizing the target update hook function.
9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a program, and when the program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, and when the program is executed, the method according to any one of claims 1 to 7 is implemented.