Data access method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a data access method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of computers. The method comprises the steps of obtaining an access request, wherein the access request is used for indicating to access a database file corresponding to a target program; database files are encrypted and stored by adopting a WCDB framework; based on the access request, running a preset extraction script to find out at least one group of data pairs from a memory space of the target program, the data pairs comprising target paths and target keys which are in one-to-one correspondence; and finally, decrypting the database file under the respective corresponding target path based on each target key, and then performing data access. According to the method, the target path and the target key can be rapidly extracted by running the preset extraction script, manual operation is not needed, and the extraction efficiency is high.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a data access method, apparatus, electronic device, storage medium, and program product. Background Technology

[0002] In fields such as forensics, reverse engineering, and security analysis, it is often necessary to access the database files of chat software to obtain chat logs. Since these database files are mostly stored using the WCDB framework for encryption, it is necessary to obtain the database path and database key before access to the database files can be achieved.

[0003] Current technology typically involves finding the target dynamic link library file responsible for the database operations of chat software, and then manually analyzing the target dynamic link library file using a combination of reverse engineering and dynamic debugging to extract the database path and database key. However, this method heavily relies on debuggers and manual operation, resulting in low extraction efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide a data access method, apparatus, electronic device, storage medium, and program product to improve the problems existing in the prior art.

[0005] The embodiments of the present invention can be implemented as follows: In a first aspect, the present invention provides a data access method, comprising: Obtain an access request, which indicates access to the database file corresponding to the target program; the database file is stored encrypted using the WCDB framework. Based on the access request, a preset extraction script is run to find at least one set of data pairs from the memory space of the target program. The data pairs include a one-to-one corresponding target path and target key. Data access is performed after decrypting the database files under their respective target paths based on the target keys.

[0006] In an optional implementation, the step of running a preset extraction script based on the access request to find at least one set of data pairs from the memory space of the target program includes: Locate at least one reference memory address in the memory space of the target program where the preset reference constant parameter is located; Based on the at least one reference memory address and the preset offset data, a set of data pairs corresponding to each reference memory address is extracted from the memory space of the target program.

[0007] In an optional implementation, the step of extracting a set of data pairs corresponding to each reference memory address from the memory space of the target program based on the at least one reference memory address and preset offset data includes: For each reference memory address, a first target address and a second target address corresponding to the reference memory address are calculated based on the reference memory address and the preset offset data; In the memory space, the target path in the first target address and the target key in the second target address are extracted to obtain a set of data pairs.

[0008] In an optional implementation, the preset offset data includes a first offset value and a second offset value; the step of calculating the first target address and the second target address corresponding to the reference memory address based on the reference memory address and the preset offset data includes: The reference memory address is superimposed with the first offset value to obtain the first target address; The reference memory address is superimposed with the second offset value to obtain the second target address.

[0009] Secondly, the present invention provides a data access method applied to an evidence collection system, the evidence collection system including evidence collection equipment and a user terminal connected in communication, the method comprising: In response to the evidence collection operation, the evidence collection device sends a preset extraction script and an access request to the user terminal; the access request is used to indicate access to specified data in the database file corresponding to the target program; the database file is stored encrypted using the WCDB framework. After receiving the access request, the user terminal runs the preset extraction script to obtain specified data from the database file corresponding to the target program through the data access method described in any of the foregoing embodiments. The user terminal will return the acquired specified data to the evidence collection device.

[0010] Thirdly, the present invention provides a data access method applied to a compliance detection system, the compliance detection system including a compliance server and multiple computing devices; each computing device is communicatively connected to the compliance server and stores a preset extraction script; the method includes: The compliance server periodically sends access requests to each of the computing devices. The access requests are used to indicate access to specific data in the database file corresponding to the target program. The database file is stored using the WCDB framework for encryption. Upon receiving the access request, each of the computing devices runs the preset extraction script to obtain specified data from the database file corresponding to the target program using the data access method described in any of the foregoing embodiments. Each computing device will upload the acquired specified data to the compliance server; The compliance server performs compliance analysis on each of the computing devices based on the received specified data.

[0011] Fourthly, the present invention provides a data access device, comprising: The acquisition module is used to acquire access requests, which indicate access to the database file corresponding to the target program; the database file is stored encrypted using the WCDB framework. An extraction module is used to run a preset extraction script based on the access request to find at least one set of data pairs from the memory space of the target program, wherein the data pairs include a one-to-one corresponding target path and target key; The access module is used to decrypt the database files under their respective target paths based on the target keys and then access the data.

[0012] Fifthly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory stores a software program, and when the electronic device is running, the processor executes the software program to implement the data access method as described in the first aspect above.

[0013] In a sixth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data access method described in any of the foregoing embodiments.

[0014] In a seventh aspect, the present invention provides a program product that, when executed by a processor, implements the data access method described in the first aspect.

[0015] Compared with existing technologies, embodiments of the present invention provide a data access method, apparatus, electronic device, storage medium, and program product. The method involves: obtaining an access request, which instructs access to a database file corresponding to a target program; the database file is stored encrypted using the WCDB framework; based on the access request, running a preset extraction script to find at least one set of data pairs from the target program's memory space, each data pair including a one-to-one corresponding target path and target key; and finally, decrypting the database file under its corresponding target path based on each target key and then accessing the data. This invention achieves rapid extraction of target paths and target keys simply by running a preset extraction script, eliminating the need for manual operation and resulting in high extraction efficiency. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the structure of an InnerDatabase class provided in an embodiment of the present invention.

[0018] Figure 2 This is a flowchart illustrating a data access method provided in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of a data access device provided in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0023] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0024] Furthermore, the terms "first" and "second" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0025] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0026] Here, we will first introduce the keywords or key terms involved in this invention.

[0027] 1. SQLite: A lightweight, open-source, embedded relational database engine. It does not require a separate server process, storing the database directly in a single disk file, making it suitable for embedded devices or local applications.

[0028] 2. WCDB (WeChat Database): A mobile database framework developed by the WeChat team based on SQLite. It optimizes SQLite's shortcomings and provides a more efficient and user-friendly interface.

[0029] 3. DLL (Dynamic Link Library) file: This file is an executable code module in the Windows operating system, containing functions, classes, resources, etc., that can be called by multiple programs simultaneously. It does not run directly, but is dynamically loaded and invoked by other programs (such as executable files .exe) at runtime.

[0030] In existing technologies, taking the Windows operating system as an example, the process of extracting the database path and database key using a combination of reverse engineering and dynamic debugging is as follows: (1) Locate the target DLL file responsible for the database operations of the chat software; (2) After decompiling the target DLL file using a decompilation tool, the technician locates the key function (which is the key setting function) by searching for keywords, key function names, or analyzing the call stack; (3) The technician attaches to the target process using a debugger (such as x64dbg or Cheat Engine) and sets a breakpoint at the entry point of the key function; (4) Run the chat software, perform database operations, trigger the breakpoint to pause the program, and then the technician can view the parameters in the registers or stack at the breakpoint to extract the database path and database key.

[0031] However, existing technologies have the following problems: (1) It relies on debuggers and manual operation, resulting in low extraction efficiency; (2) Path and key cannot be accurately matched: When the target program uses n WCDB database files (e.g. multiple chat databases, multiple user account databases), it will eventually obtain the database files and n database keys corresponding to the n database paths. However, since the pairing relationship between the obtained database files and database keys is unknown, it is necessary to try the correspondence between the key and the file one by one, and n~n×n attempts are needed to confirm the correct pairing relationship. (3) Each key update requires re-extraction, and the extraction process is complicated: If the WCDB database supports the dynamic key update mechanism, the key that was previously extracted by breakpoint will become invalid after the database key changes. It is necessary to extract the key again by combining reverse engineering and dynamic debugging, which greatly increases the manpower and time costs. (4) Strong version dependency and poor adaptability: Existing technology relies on the memory address of key functions to set breakpoints and extract parameters. However, after the program version is updated, the change in the memory address of key functions will cause the original breakpoint settings to fail, and it is necessary to re-extract them by combining reverse engineering and dynamic debugging, which greatly increases the manpower and time costs.

[0032] Based on the discovery of the aforementioned technical problems, the inventors, through creative labor, proposed the following technical solutions to solve or improve these problems. It should be noted that the deficiencies in the solutions of the prior art are all results derived by the inventors after practical experience and careful research. Therefore, the discovery process of the aforementioned problems and the solutions proposed in the embodiments of this application below should be considered contributions made by the inventors to this application during the inventive process, and should not be construed as technical content known to those skilled in the art.

[0033] After in-depth analysis of the standard WCDB framework source code, the inventors clarified the following: The function for setting the database key is the `Database::setCipherKey` method, which calls the `Database::setConfig` method. Tracing the `Database::setConfig` method reveals that it calls the `InnerDatabase::setConfig` method. The data structure of the `InnerDatabase` class is as follows: Figure 1 As shown ( Figure 1 Only the structures related to keys and paths are shown; the rest are omitted.

[0034] The inventor discovered that the constructor of the InnerDatabase class takes a database path as its parameter. Initializing the HandlePool using the constructor and assigning it a value to HandlePool(path), the class structure of HandlePool reveals a database path variable `path`. Since the InnerDatabase class inherits from the HandlePool class, it also inherits its member variable `path`. Therefore, as... Figure 1 The StringView path reflects the database path.

[0035] like Figure 1The `InnerDatabase` class adds the passed-in parameters to the `m_configs` configuration array. `m_configs` is of type `Config`, which inherits from the `UniqueList` class. The `UniqueList` class ultimately uses a primitive array structure that stores multiple fixed, unchanging constant strings, such as `com.Tencent.WCDB.Config.Cipher`. Therefore, `m_configs` consists of three parts: constant strings, a `CipherConfig` structure, and `Configs::Priority::Highest`. The `m_key` in the `CipherConfig` structure is the database key. `m_key` is a `Data` type structure that ultimately points to a `char*`, which is the primitive string type in C / C++.

[0036] The inventors discovered that in the standard WCDB framework, for any constant string in m_configs, the memory offset between the memory address of the constant string and the memory address of m_key is a fixed value (let's call it the first offset value), and the memory offset between the memory address of the constant string and the memory address of StringView path is also a fixed value (let's call it the second offset value).

[0037] In view of this, embodiments of the present invention provide a data access method that can use any constant string in the configuration array m_configs as a reference constant parameter, first find the memory address of the reference constant parameter, and then determine the memory address of the database path and the database key by combining the first offset and the second offset corresponding to the reference constant parameter. The following detailed description is provided through embodiments and in conjunction with the accompanying drawings.

[0038] Please refer to Figure 2 , Figure 2 This is a flowchart illustrating a data access method provided in an embodiment of the present invention. The execution subject of this method can be a computing device such as a smartphone, personal laptop, personal computer, or server. Figure 2 The method includes the following steps: S101. Obtain access request.

[0039] In this embodiment, the access request is used to instruct access to the database file corresponding to the target program, which is stored encrypted using the WCDB framework. Optionally, after establishing a connection between the external device that needs to access the database file corresponding to the target program and the computing device, the access request can be sent to the computing device.

[0040] S102. Based on the access request, run a preset extraction script to find at least one data pair from the memory space of the target program.

[0041] In this embodiment, the data pairs include a one-to-one correspondence between the target path and the target key. A preset extraction script is used to instruct the determination of the target path and the target key based on a preset reference constant function and its corresponding two offsets.

[0042] If a data pair is found, it indicates that the target program running on the computing device uses only one WCDB framework database file; if more than one data pair is found, it indicates that the target program running on the computing device uses multiple WCDB framework database files. If no data pair is found, it indicates that the target program running on the computing device does not use a WCDB framework database file.

[0043] S103. Based on each target key, decrypt the database file under its corresponding target path and then access the data.

[0044] In this embodiment, based on each target key, the database files under their respective target paths can be decrypted and accessed, such as searching for specific content in the file, performing data recovery, and transmitting the file content back to an external device.

[0045] The data access method provided in this invention first obtains an access request, which indicates access to the database file corresponding to the target program. The database file is stored encrypted using the WCDB framework. Based on the access request, a preset extraction script is run to find at least one set of data pairs from the memory space of the target program. Each data pair includes a one-to-one corresponding target path and target key. Finally, based on each target key, the database file under its corresponding target path is decrypted and accessed. This invention achieves rapid extraction of target paths and target keys by running a preset extraction script, eliminating the need for manual operation and resulting in high extraction efficiency.

[0046] In the optional implementation methods, the above step S102 can be implemented in ways including S1021~S1022: S1021. Locate at least one reference memory address in the memory space of the target program where the preset reference constant parameter is located; In this embodiment, the preset reference constant parameter is any constant string parameter in the "m_configs" configuration array of the "InnerDatabase" class, which is the key function responsible for setting the database key in the code responsible for database operations in the standard WCDB framework. For example, one of "com.Tencent.WCDB.Config.Cipher", "com.Tencent.WCDB.Config.Lock", or "com.Tencent.WCDB.Config.Pragma".

[0047] It is understandable that when a target program runs on a computing device, the target process corresponding to that target program enjoys a portion of memory space. This memory space loads dynamic link library files (such as libwcdb.dll) responsible for database operations. Because the standard WCDB framework organizes and stores database configuration-related structural information in a specific way within the target process's memory space at runtime, the constant strings in m_configs (such as...) Figure 1 The configuration identifier (com.Tencent.WCDB.Config.Cipher) is frequently referenced during program execution. Its value is determined during the program compilation stage and exists in memory space in read-only form during runtime.

[0048] Therefore, memory scanning technology can be used to directly locate each memory address containing the preset reference constant parameter in the target process's memory space, thus obtaining at least one reference memory address. Specifically, this process relies on comparing the contents of contiguous memory regions in the target process's address space, performing byte-by-byte matching between the string content stored in memory and the preset reference constant parameter. When a memory region is found to be completely identical to the preset constant parameter, the starting address of that memory region can be confirmed as a valid reference memory address.

[0049] For example, if the default reference constant parameter is "com.Tencent.WCDB.Config.Cipher", then during the execution of the target program, this string will appear in memory in ASCII or Unicode encoding form and can be located using memory scanning tools or scripts. This example is merely illustrative and is not intended to be limiting.

[0050] S1022. Based on at least one reference memory address and preset offset data, extract a set of data pairs corresponding to each reference memory address from the memory space of the target program.

[0051] In this embodiment, the process of finding a corresponding set of data pairs for each reference memory address includes S10221~S10222.

[0052] S10221. Based on the reference memory address and preset offset data, calculate the first target address and the second target address corresponding to the reference memory address.

[0053] It can be understood that the preset offset data includes a first offset value and a second offset value corresponding to preset reference constant parameters. Therefore, by superimposing the reference memory address with the first offset value, the first target address can be obtained; by superimposing the reference memory address with the second offset value, the second target address can be obtained.

[0054] For example, assuming a reference memory address is found to be ptr0, and the first offset value and the second offset value are ∆1 and ∆2 respectively, then the first target address where the target path is located is ptr1=ptr0+∆1, and the second target address where the target key is located is ptr2=ptr0+∆2.

[0055] S10222. Extract the target path from the first target address and the target key from the second target address in the memory space to obtain a set of data pairs.

[0056] In this embodiment, the computing device can directly access the address space of the target process by calling the memory read interface (such as the `ReadProcessMemory` function under the Windows platform), read the starting address of the path string from the first target address, and determine the string length according to the string end identifier (such as `\0`), thereby completely reading the target path; similarly, by reading the starting address of the key string from the second target address and extracting the complete target key, a set of data pairs can be obtained.

[0057] The preset extraction script in this invention can be applied to fields such as forensics, reverse engineering, and security analysis to achieve rapid extraction of database paths and database keys.

[0058] This invention also provides a data access method applied to an evidence collection system, which includes evidence collection equipment and a user terminal connected by communication. The method includes the following steps: S201. In response to the evidence collection operation, the evidence collection device sends a preset extraction script and an access request to the user terminal; the access request is used to indicate the access to specified data in the database file corresponding to the target program; the database file is stored using the WCDB framework for encryption. S202. After receiving the access request, the user terminal runs a preset extraction script to obtain the specified data from the database file corresponding to the target program by executing the above steps S101~S103. S203. The user terminal returns the acquired specified data to the evidence collection device.

[0059] In this embodiment, the evidence collection device can be a device specifically used by relevant law enforcement agencies for evidence collection, such as a portable evidence collection machine or an electronic data forensics analyzer. For example, in cases involving cybercrime, privacy violations, or illegal fundraising, law enforcement personnel can use the evidence collection device to send an access request, instructing a user terminal to extract chat log fragments or message attachments from a specific user account. After the user terminal runs a preset extraction script, it can directly extract the database key and path from memory, decrypt the database, and return the required data to the evidence collection device. This example is merely illustrative and is not intended to limit the scope of the case.

[0060] This invention also provides a data access method applied to a compliance testing system, which includes a compliance server and multiple computing devices; each computing device is communicatively connected to the compliance server and stores a preset extraction script. The method includes the following steps: S301. The compliance server periodically sends access requests to each computing device. The access requests are used to indicate the access to specified data in the database file corresponding to the target program. The database file is stored using the WCDB framework for encryption. S302. After receiving an access request, each computing device runs a preset extraction script to obtain specified data from the database file corresponding to the target program by executing the above steps S101~S103. S303. Each computing device will upload the specified data it has acquired to a compliant server; S304. The compliance server performs compliance analysis on each computing device based on the specified data received.

[0061] In this embodiment, the compliance server can perform compliance analysis based on the specified data returned by each computing device.

[0062] For example, compliance analysis can be used to determine whether there are any violations of the company's data usage policies, such as employees storing internal files on external servers without authorization or using unauthorized software to process sensitive data, in order to ensure the company's data security; or compliance analysis can be used to determine whether users have engaged in abnormal operations or pose compliance risks, in order to ensure the user's data security or property security. It should be noted that this example is merely illustrative and is not intended to be limiting.

[0063] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: This invention achieves accurate extraction of database paths and keys by combining reference memory addresses with preset offset data. Even if the key is updated or the target program version is iterated, fast extraction can still be achieved by simply running the preset extraction script. This invention only needs to find a reference memory address to determine a set of data pairs by combining preset offset data. The target key in the data pair can directly decrypt the data file under the target path, without having to try the correspondence between the key and the file one by one as in the prior art, which wastes time. In this invention, the two offset values ​​corresponding to the preset reference constant parameters are not randomly generated, but are stable parameters obtained through in-depth analysis of the source code and runtime behavior of the standard WCDB framework. Since the standard WCDB framework typically does not make significant adjustments to class structure and memory layout between different versions, the preset extraction script has good adaptability to different versions of the target program.

[0064] In order to perform the corresponding steps in the above method embodiments and various possible implementations, an implementation of a data access device is given below.

[0065] Please see Figure 3 , Figure 3 A schematic diagram of the structure of a data access device provided in an embodiment of the present invention is shown. The data access device 200 includes: an acquisition module 210, an extraction module 220, and an access module 230.

[0066] The acquisition module 210 is used to acquire access requests, which indicate the database file corresponding to the target program to be accessed; the database file is stored using the WCDB framework for encryption. Extraction module 220 is used to run a preset extraction script based on the access request to find at least one set of data pairs from the memory space of the target program. The data pairs include a one-to-one corresponding target path and target key. Access module 230 is used to decrypt the database files under their respective target paths based on each target key and then access the data.

[0067] Optionally, the extraction module 220 can specifically: locate at least one reference memory address where the preset reference constant parameter is located in the memory space of the target program; and extract a set of data pairs corresponding to each reference memory address from the memory space of the target program based on at least one reference memory address and preset offset data.

[0068] Optionally, the extraction module 220 may specifically: for each reference memory address, calculate the first target address and the second target address corresponding to the reference memory address based on the reference memory address and preset offset data; and extract the target path in the first target address and the target key in the second target address from the memory space to obtain a set of data pairs.

[0069] Optionally, the preset offset data includes a first offset value and a second offset value; the extraction module 220 can specifically: superimpose the reference memory address with the first offset value to obtain a first target address; and superimpose the reference memory address with the second offset value to obtain a second target address.

[0070] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the data access device 200 described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0071] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. The electronic device 300 includes a processor 310, a memory 320, and a bus 330, with the processor 310 connected to the memory 320 via the bus 330.

[0072] The memory 320 can be used to store software programs or firmware, for example, the software program or firmware corresponding to the data access device 200 described above. The processor 310 executes various functional applications and data processing by running the software program stored in the memory 320 to implement the data access method provided in the embodiments of the present invention.

[0073] The memory 320 may be, but is not limited to, RAM (Random Access Memory), ROM (Read Only Memory), FLASH (Flash Memory), PROM (Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electric Erasable Programmable Read-Only Memory), etc.

[0074] The processor 310 can be an integrated circuit chip with signal processing capabilities, capable of executing software programs, such as the software program corresponding to the data access device 200 described above. The processor 310 can be a general-purpose processor, including: CPU (Central Processing Unit), NP (Network Processor), SoC (System on Chip), etc.; it can also be: DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0075] Understandable. Figure 4 The structure shown is for illustrative purposes only; the electronic device 300 may also include components that are more advanced than those shown. Figure 4 The more or fewer components shown, or having the same Figure 4 The different configurations shown. Figure 4 The components shown can be implemented using hardware, software, or a combination thereof.

[0076] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data access method disclosed in the above embodiments. The computer-readable storage medium can be, but is not limited to, various media capable of storing program code, such as a USB flash drive, portable hard drive, ROM, RAM, PROM, EPROM, EEPROM, FLASH disk, or optical disk.

[0077] This invention also provides a program product that, when executed by a processor, implements the data access method disclosed in the above embodiments.

[0078] In summary, embodiments of the present invention provide a data access method, apparatus, electronic device, storage medium, and program product. The method comprises: obtaining an access request, which indicates access to a database file corresponding to a target program; the database file is stored encrypted using the WCDB framework; based on the access request, running a preset extraction script to find at least one set of data pairs from the memory space of the target program, each data pair including a one-to-one corresponding target path and target key; and finally, decrypting the database file under its corresponding target path based on each target key and then accessing the data. The present invention achieves rapid extraction of target paths and target keys simply by running a preset extraction script, eliminating the need for manual operation and resulting in high extraction efficiency.

[0079] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data access method, characterized in that, include: Obtain an access request, the access request being used to instruct access to the database file corresponding to the target program; The database file is stored using the WCDB framework for encryption. Based on the access request, a preset extraction script is run to find at least one set of data pairs from the memory space of the target program. The data pairs include a one-to-one corresponding target path and target key. Data access is performed after decrypting the database files under their respective target paths based on the target keys.

2. The data access method according to claim 1, characterized in that, The step of running a preset extraction script based on the access request to find at least one set of data pairs from the memory space of the target program includes: Locate at least one reference memory address in the memory space of the target program where the preset reference constant parameter is located; Based on the at least one reference memory address and the preset offset data, a set of data pairs corresponding to each reference memory address is extracted from the memory space of the target program.

3. The data access method according to claim 2, characterized in that, The step of extracting a set of data pairs corresponding to each reference memory address from the memory space of the target program based on the at least one reference memory address and preset offset data includes: For each reference memory address, a first target address and a second target address corresponding to the reference memory address are calculated based on the reference memory address and the preset offset data; In the memory space, the target path in the first target address and the target key in the second target address are extracted to obtain a set of data pairs.

4. The data access method according to claim 3, characterized in that, The preset offset data includes a first offset value and a second offset value; the step of calculating the first target address and the second target address corresponding to the reference memory address based on the reference memory address and the preset offset data includes: The reference memory address is superimposed with the first offset value to obtain the first target address; The reference memory address is superimposed with the second offset value to obtain the second target address.

5. A data access method, characterized in that, Applied to an evidence collection system, the evidence collection system including evidence collection equipment and a user terminal connected by communication, the method includes: In response to the evidence collection operation, the evidence collection device sends a preset extraction script and an access request to the user terminal; the access request is used to indicate access to specified data in the database file corresponding to the target program; the database file is stored encrypted using the WCDB framework. Upon receiving the access request, the user terminal runs the preset extraction script to obtain specified data from the database file corresponding to the target program using the data access method described in any one of claims 1-4. The user terminal will return the acquired specified data to the evidence collection device.

6. A data access method, characterized in that, This is applied to a compliance testing system, which includes a compliance server and multiple computing devices; each computing device is communicatively connected to the compliance server and stores a preset extraction script. The method includes: The compliance server periodically sends access requests to each of the computing devices. The access requests are used to indicate access to specific data in the database file corresponding to the target program. The database file is stored using the WCDB framework for encryption. Upon receiving the access request, each of the computing devices runs the preset extraction script to obtain specified data from the database file corresponding to the target program using the data access method according to any one of claims 1-4. Each computing device will upload the acquired specified data to the compliance server; The compliance server performs compliance analysis on each of the computing devices based on the received specified data.

7. A data access device, characterized in that, include: The acquisition module is used to acquire access requests, which indicate access to the database file corresponding to the target program. The database file is stored using the WCDB framework for encryption. An extraction module is used to run a preset extraction script based on the access request to find at least one set of data pairs from the memory space of the target program, wherein the data pairs include a one-to-one corresponding target path and target key; The access module is used to decrypt the database files under their respective target paths based on the target keys and then access the data.

8. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a software program, and the processor executes the software program when the electronic device is running to implement the data access method as described in any one of claims 1-4.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the data access method according to any one of claims 1-4.

10. A program product, characterized in that, When the program product is executed by the processor, it implements the data access method according to any one of claims 1-4.

Images