CN111666586A - Shared library file simulation method and device, computer equipment and storage medium - Google Patents

Abstract

The invention discloses a shared library file simulation method, device, computer equipment and storage medium. The method includes: mapping the shared library file to be simulated into the virtual memory of the simulation execution framework; isolating the virtual memory from the system memory; mapping the access to the virtual file to the system file; modifying the function address of the function to be intercepted; The preset function variable name and the preset function name are registered, so that the Hook function in the simulation execution framework can return the interception function according to the preset function variable name and the preset function name; the simulated shared library file is treated by the Hook function The function to be intercepted in is returned, and the value returned by the function to be intercepted is output through the simulation execution framework, so as to realize the analysis of the shared library file to be simulated. The technical scheme of the present invention can dynamically simulate and analyze the shared library file, thereby reducing the difficulty of analyzing the shared library file.

Description

Shared library file simulation method, device, computer equipment and storage medium

technical field

The present invention relates to the field of computer technology, and in particular, to a shared library file simulation method, device, computer equipment and storage medium.

Background technique

With the development of mobile platforms, the vast majority of commercial Android APPs currently use reinforcement technology to varying degrees before they are released to the application market.

Because the Java layer program can easily be completely restored to the source code, most manufacturers choose to write the key algorithm into the shared library file through C/C++. Mobile security manufacturers such as Bang Bang, Ai Encryption, Tencent Legu, 360, etc. The shared library file is packed, and OLLVM obfuscation technology is used to further strengthen it.

However, a large number of fake blocks are added to the obfuscated application, not only the program logic becomes extremely complex, but also the disassembled code and flow chart are extremely difficult to understand. However, it is easy to be hardened by malicious applications, which hinders the analysis of applications.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a shared library file simulation method, device, computer equipment, and storage medium, so as to solve the problem of difficulty in analyzing shared library files.

A shared library file simulation method, including:

By simulating the execution framework, the shared library file to be simulated is mapped into the virtual memory of the simulated execution framework;

Through the virtual memory mechanism of the simulation execution framework, the virtual memory is isolated from the system memory;

By simulating the virtual file system in the execution framework, the access to the virtual file is mapped to the system file;

Modify the function address of the function to be intercepted according to the preset function address, wherein the function to be intercepted is a function in a shared library format file;

Register the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can perform the function to be intercepted according to the preset function variable name and the preset function name. return;

Obtain the dependencies of the to-be-simulated shared library file through the Objdump command, return the to-be-intercepted function in the to-be-simulated shared library file through the Hook function, and use the simulation execution framework to process the to-be-intercepted function The returned value is output to analyze the shared library file to be simulated.

A shared library file simulation device, comprising:

a file mapping module, used to map the shared library file to be simulated into the virtual memory of the simulated execution framework by simulating the execution framework;

a memory isolation module, configured to isolate the virtual memory from the system memory through the virtual memory mechanism of the simulated execution framework;

The access mapping module is used to map the access to the virtual file to the system file by simulating the virtual file system in the execution framework;

The address modification module is used to modify the function address of the function to be intercepted according to the preset function address, wherein the function to be intercepted is a function in a shared library format file;

The function registration module is used to register the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can be paired according to the preset function variable name and the preset function name. the function to be intercepted returns;

The data output module is used to obtain the dependencies of the shared library file to be simulated through the Objdump command, and returns the function to be intercepted in the shared library file to be simulated through the Hook function, and executes the framework through the simulation The value returned by the function to be intercepted is output to analyze the shared library file to be simulated.

A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the above shared library file simulation method when the processor executes the computer program.

A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, implements the steps of the above-mentioned method for simulating a shared library file.

In the above-mentioned shared library file simulation method, device, computer equipment and storage medium, the shared library file to be simulated is mapped to the virtual memory of the simulated execution framework by simulating the execution framework; System memory isolation; by simulating the virtual file system in the execution framework, the access to the virtual file is mapped to the system file; according to the preset function address, the function address of the function to be intercepted is modified; the preset function variable name and preset The Hook function in the simulation execution framework can return the intercepted function according to the preset function variable name and the preset function name; obtain the dependencies of the shared library file to be simulated through the preset command, and The Hook function is used to return the function to be intercepted in the simulated shared library file, and the value returned by the to-be-intercepted function is output through the simulation execution framework, so as to analyze the shared library file to be simulated. In order to make it possible to simulate and analyze the shared library file dynamically, the difficulty of analyzing the shared library file is reduced.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the drawings that are used in the description of the embodiments of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention. , for those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative labor.

1 is a schematic diagram of an application environment of a method for simulating a shared library file in an embodiment of the present invention;

2 is a flowchart of a method for simulating a shared library file in an embodiment of the present invention;

3 is a flowchart of a method for simulating a shared library file in an embodiment of the present invention;

4 is a flowchart of step S10 of the shared library file simulation method in an embodiment of the present invention;

5 is a flowchart of step S30 of the shared library file simulation method in an embodiment of the present invention;

6 is a flowchart of step S40 of the shared library file simulation method in an embodiment of the present invention;

7 is a schematic diagram of a shared library file simulation device according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a computer device in an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The shared library file simulation method provided by the present application can be applied in the application environment shown in FIG. 1 , the application environment includes a server and a client, wherein the server and the client are connected through a network, and the network can It is a wired network or a wireless network. The client includes but is not limited to various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices. The server can be implemented by an independent server or a server cluster composed of multiple servers. . The server maps the shared library files to be simulated into the virtual memory of the simulated execution framework by simulating the execution framework; isolates the virtual memory from the system memory by simulating the virtual memory mechanism of the execution framework; and simulates the virtual file system in the execution framework, Map the access to the virtual file to the system file; modify the function address of the function to be intercepted according to the preset function address; register the preset function variable name and preset function name, so that the Hook in the simulation execution framework The function can return the function to be intercepted according to the preset function variable name and the preset function name; obtain the dependencies of the shared library file to be simulated through the preset command, and use the Hook function to treat the function to be intercepted in the simulated shared library file. Return, and output the value returned by the function to be intercepted through the simulation execution framework to analyze the shared library file to be simulated. In order to make it possible to simulate and analyze the shared library file dynamically, the difficulty of analyzing the shared library file is reduced.

In one embodiment, as shown in FIG. 2 , a method for simulating a shared library file is provided, and the method is applied to the server in FIG. 1 as an example for description, which specifically includes steps S10 to S60, which are described in detail as follows:

S10: Map the shared library file to be simulated into the virtual memory of the simulated execution framework by simulating the execution framework.

Among them, the shared library file refers to the elf file. The simulation execution framework refers to the cross-platform simulation execution framework Unicorn that can execute native programs of Arm, Arm64, M68K, Mips, Sparc, X86 and other instruction sets across platforms. The elf file to be simulated refers to the object to be simulated and executed by the simulation execution framework. elf files are used for binary files, executable files, object code, shared libraries and core dump format files.

By simulating the execution framework, the to-be-simulated elf file is mapped to the virtual memory of the simulated execution framework. Specifically, the mapping of the to-be-simulated elf file includes parsing, relocation, symbol analysis, and the like of the to-be-simulated elf file. The parsing of the elf file to be simulated refers to converting the elf file to be simulated into a so file in a binary format shared library format through the Pyelftools library. The Pyelftools library refers to a python library for parsing and analyzing elf files to be simulated. Relocating the to-be-simulated elf file means that before the simulation execution framework executes the to-be-simulated elf file, the link address is consistent with the running address. Wherein, the link address refers to the specified address when the code in the elf file to be simulated is linked to the corresponding function, and the running address refers to the load address when the elf file to be simulated is loaded into the memory. The symbol analysis of the to-be-simulated elf file refers to the analysis of the initialization functions and variables in the to-be-simulated elf file. Specifically, when the to-be-simulated elf file is mapped, the to-be-simulated elf file is automatically parsed and relocated through the Pyelftools library.

It should be noted that when the symbol analysis of the simulated elf file is performed, the simulated elf file is parsed through the Pyelftools library, and the base address and structure pointer address of the initialized array in the to-be-simulated elf file are obtained. According to the base address and structure pointer address , which determines the address of the initialized array. It should be noted that when simulating the elf file to be simulated, the function in the initialization array needs to be called, and when it is detected that the content in the initialization array is 0, the address of the initialization array is relocated.

S20: The virtual memory is isolated from the system memory by simulating the virtual memory mechanism of the execution framework.

The virtual memory mechanism refers to a mechanism for mapping the memory of the system through the API in the simulation execution framework. The APIs in the simulation execution framework include uc_mem_map, uc_mem_read, and uc_mem_write. Isolate virtual memory from system memory by emulating the virtual memory mechanism of the execution framework. Specifically, the system memory is mapped to the virtual memory of the simulated execution framework through the API in the simulated execution framework. It should be noted that, before the system memory is mapped by uc_mem_map, the base address of the system memory is obtained, and the base address of the virtual memory is changed to be consistent with the base address of the system memory according to the base address of the system memory. The size of the memory block in is changed to an integer multiple of the system memory base address. By simulating the address alignment function in the execution framework, the base address of the virtual memory is aligned with the base address of the system memory, and the size of the memory block in the virtual memory is calculated to obtain the virtual alignment address and virtual memory size, and the virtual alignment The address and virtual memory size are returned to the emulated execution frame.

S30: By simulating the virtual file system in the execution framework, the access to the virtual file is mapped to the system file.

The virtual file system refers to a system that simulates system files. System files refer to file systems created by users. Mapping the access to the virtual file to the system file means that the system file can be accessed by accessing the virtual file in the simulation execution framework. Access to virtual files is mapped to system files by simulating a virtual file system in the execution framework. Specifically, the system file is mapped through the virtual system file interface in the virtual file system, and further, the preset interface calling function is intercepted or controlled through the Hook function in the simulation execution framework. When the preset interface of the virtual file in the system calls the function, the preset interface calling function is intercepted by the Hook function in the simulation execution framework, so that the preset interface calling function calls the file from the system file. The Hook function in the simulation execution framework refers to a preset function that can call back or intercept the function. Preferably, the Hook function in the simulation execution framework may be the syscall_handler.set_handler function. The preset interface calling function refers to the function set according to the user-defined setting, and can access the system file through the interface. The preset interface calling functions include but are not limited to read, open, close, writev, fstat64, openat, and fstatat64 functions.

It should be noted that when accessing a virtual file, first, system file information is obtained, wherein the system file information includes directory level information of files in the system memory and data information corresponding to the file directory level information. According to the directory level information, data information corresponding to the directory level information is stored in a preset virtual file directory. The preset virtual file directory refers to a file directory created according to user definition and used for storing system file information. Further, the preset interface calling function is parsed by the Hook function in the simulation execution framework, and the calling path of the preset interface function is changed to be called from the preset virtual file directory, so as to obtain the preset interface function in the virtual file directory. System file information is mapped to system memory to enable access to virtual files.

S40: Modify the address of the function to be intercepted according to the preset function address, where the function to be intercepted is a function in a shared library format file.

The preset function address refers to the function address set according to the user-defined definition. The function to be intercepted refers to the object executed by the Hook function in the simulation execution framework. It should be noted that the function to be intercepted may be a preset interface calling function, and the initialization function when mapping the elf file to be simulated. Modify the address of the function to be intercepted according to the preset function address. Specifically, the address of the function to be intercepted is obtained, and the address of the function to be intercepted is changed according to the preset function address.

S50: Register the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can return the function to be intercepted according to the preset function variable name and the preset function name.

The preset function variable name refers to the variable name in the user-defined function statement. The preset function name refers to the function name defined by the user. Preset function variable names and preset function names are set via metaclasses in Python. Specifically, the preset function variable name and the preset function name are stored in the database, and when the variable name or function name detected by the Hook function in the simulation execution framework is the preset function variable name or preset function variable name in the database function name, the value of the function corresponding to the detected variable name or function name is returned.

Exemplarily, the preset function variables defined by JavaClassDef are named jvm_name, jvm_method and jvm_fields; the preset function names are find_method, find_method_by_id, and find_field functions. When the variable name detected by the Hook function in the simulation execution framework is jvm_method and the function name is ind_method, the method in ind_method is returned through the Hook function in the simulation execution framework.

S60: Obtain the dependencies of the shared library file to be simulated through the Objdump command, return the function to be intercepted in the simulated shared library file through the Hook function, and output the value returned by the function to be intercepted through the simulation execution framework to realize the simulation Shared library files are analyzed.

Among them, Objdump refers to the target analysis tool in Linux, which is used to analyze binary files in elf format. The dependency of the elf file to be simulated refers to the binary shared library format file that the binary file in elf format depends on when running in Linux. For example, the dependency of the so format of the elf file to be simulated is libc.so. Specifically, first, through the arm-linux-gnueabi-Objdump command in Objdump, the elf file to be simulated is parsed, and further, through the -X command, get All headers in the elf file to be simulated are filtered through the grep command to obtain the dependencies in the so format of the elf file to be simulated. Finally, load the dependencies to obtain the so format file of the elf file to be simulated. Further, the Hook function is used to return the function to be intercepted in the simulated elf file to obtain the data obtained by the function to be intercepted, and output the data obtained by the function to be intercepted. Among them, the data output to be obtained by the interception function can be a Logger formatted output. Among them, the Logger formatted output refers to outputting the data obtained by the interception function through the Hook function in the simulation execution framework in the form of a log, so as to realize the analysis of the shared library format file of the elf file to be simulated.

In this embodiment, the elf file to be simulated is mapped to the virtual memory of the simulated execution framework by simulating the execution framework; the virtual memory is isolated from the system memory by the virtual memory mechanism of the simulated execution framework; the virtual file in the simulated execution framework is isolated system, map the access to the virtual file to the system file; modify the function address of the function to be intercepted according to the preset function address; register the preset function variable name and the preset function name; obtain the to-be-simulated through the Objdump command The dependencies of the elf file are returned by the hook function to the function to be intercepted in the simulated elf file, and the logger formatted output is performed through the simulated execution framework to realize the analysis of the simulated elf file. The efficiency and accuracy of analyzing elf files can be improved, and the analysis of confusing elf files can be simplified.

In one embodiment, as shown in FIG. 3 , before step S60, the dependencies of the shared library file to be simulated are obtained through a preset command, and the function to be intercepted in the simulated shared library file is returned by the Hook function. ,include:

S601: Access a register of the simulation execution framework, and detect whether there is an unconditional execution instruction, wherein the register includes the number of the function to be intercepted.

Among them, the unconditional execution instruction refers to the instruction in the ARM instruction set. The number of the function to be intercepted refers to a user-defined constant in the register of the simulation execution framework, which is used to record the function to be intercepted. Specifically, access the registers in the simulation execution framework. When the Hook function intercepts the function to be intercepted that accesses the register, the byte data in the register is detected. When the detected number of bytes is \xE8\xBf , there is an unconditional execution instruction. Among them, the unconditional execution instruction is the IT AL instruction.

Further, when the number of bytes in the register is detected and the number of bytes is not detected as \xE8\xBf, there is no unconditional execution instruction, then it is determined that the Hook function fails to intercept the interception function, and the interception is treated again. function to intercept.

S602: If there is an unconditional execution instruction, read the value in the register.

Among them, when it is detected that there is an unconditional execution instruction, the data in the register is read. If the read value is empty, it is determined that the Hook function fails to intercept the interception function, and the interception function is intercepted again; if read The value of is not empty, it is determined that the interception of the interception function by the Hook function is successful. The number of the function to be intercepted is determined according to the value in the register, and the corresponding function to be intercepted is determined according to the number of the function to be intercepted.

S603: Extract the corresponding target function number to be intercepted from the function number to be intercepted according to the value in the register.

The number of the function to be intercepted refers to a constant corresponding to the value in the register. The target function number to be intercepted refers to the constant corresponding to the function to be intercepted. Specifically, when it is detected that there is an unconditional execution instruction, the data in the register is read, and when the read value is not empty, the function number to be intercepted is determined according to the value read from the register, and further, the function number to be intercepted is determined from the value read from the register. The interception function number extracts the corresponding target function number to be intercepted.

S604: Determine the function to be intercepted according to the number of the target function to be intercepted.

Specifically, when the data read from the register is not empty, after the function number to be intercepted is determined according to the read value, the corresponding target function number to be intercepted is extracted from the function number to be intercepted, and further, the corresponding target function number to be intercepted is determined according to the target function number to be intercepted. The function to be intercepted.

In this embodiment, the register of the simulation execution framework is accessed, and whether there is an unconditional execution instruction is detected, wherein, there is a function number to be intercepted in the register; when there is an unconditional execution instruction, the value in the register is read; according to the register The value in is to extract the corresponding target function number to be intercepted from the function number to be intercepted; the function to be intercepted is determined according to the number of the target function to be intercepted. By judging the interception result of the Hook function to be intercepted, the efficiency of analyzing the simulated elf file can be further improved.

In one embodiment, as shown in FIG. 4 , in step S10, by simulating the execution framework, the shared library file to be simulated is mapped to the virtual memory of the simulation execution framework, including:

S11: Through the Pyelftools library, analyze the shared library file to be simulated, and obtain the base address and structure pointer address of the initialized array in the shared library file to be simulated.

Wherein, the initialization array is an array in the simulation execution framework when the elf file to be simulated is loaded, and the initialization array includes an initialization function. In the simulation execution framework, the initialization array is init_array. Through the Pyelftools library, the elf file to be simulated is parsed, and the base address and structure pointer address of the initialized array in the elf file to be simulated are obtained. Specifically, the so format of the simulated elf file is parsed through the Pyelftools library to obtain the so file, and the so file is further parsed to obtain the segment part of the so file, and the function iter_segments is used to traverse the segment part of the so file, and from the DT_INIT_ARRAYSZ and DT_INIT_ARRAY tags Get the size and offset of the initialized array, and determine the base address of the initialized array. Further, by calculating the offset of the initialization array, the virtual address of the header of the segment in the so file, and the offset of the virtual address of the header of the segment in the so file, the structure pointer address is obtained.

S12: Determine the initialized array address according to the base address and the structure pointer address.

The base address of the initialized array and the address of the structure pointer are calculated to obtain the address of the initialized array. Among them, the calculation of the base address and the structure pointer address is an addition calculation.

S13: Map the initialization function in the initialization array to the virtual memory of the simulation execution framework according to the address of the initialization array.

Wherein, the initialization function refers to a necessary function loaded when the shared library file to be simulated is running. Specifically, after determining the address of the initialization array according to the addition calculation of the base address and the address of the structure pointer, further, according to the address pointer of the initialization array, find the location of the initialization array, and obtain the initialization function from the initialization array, and further, set the The initialization function is mapped into the virtual memory of the simulation execution framework, so as to realize the mapping of the shared library file to be simulated into the virtual memory of the simulation execution framework.

In this embodiment, the elf file to be simulated is parsed through the Pyelftools library to obtain the base address and structure pointer address of the initialized array in the elf file to be simulated; the address of the initialization array is determined according to the base address and the structure pointer address; according to the initialization The address of the array, which maps the initialization function in the initialization array to the virtual memory of the simulation execution framework. The initialization array init_array in the so format of the elf file to be simulated can be obtained to obtain the initialization function in the init_array. Further, when simulating the elf file to be simulated, the simulation of the elf file to be simulated can be completed through the initialization function.

In one embodiment, as shown in FIG. 5 , in step S30, by simulating the virtual file system in the execution framework, the access to the virtual file is mapped to the system file, including:

S31: Allocate the interface calling function according to the preset allocation method to obtain the preset interface calling function.

The preset allocation method refers to the allocation of interface calling functions of different functions. For example, according to the function of the interface calling function, the interface calling functions are allocated as read, open, close, writev, fstat64, openat, and fstatat64 functions.

S32: According to the preset virtual file directory, use the hook function to replace the calling path of the preset interface calling function with the preset virtual file directory path.

Specifically, when accessing the virtual file, first, system file information is obtained, wherein the system file information includes directory level information of the file in the system memory and data information corresponding to the directory level information of the file. According to the directory level information, data information corresponding to the directory level information is stored in a preset virtual file directory. The preset virtual file directory refers to a file directory created according to user definition and used for storing system file information. Further, the preset interface calling function is parsed by the Hook function in the simulation execution framework, and the calling path of the preset interface function is changed to be called from the preset virtual file directory.

It should be noted that by changing the calling path of the preset interface function to call from the preset virtual file directory, when it is detected that the preset interface function accesses the virtual file, according to the change of the calling path, directly The access to the virtual file is mapped to the access to the preset virtual file directory, so as to realize the mapping of the access to the virtual file to the system file.

In this embodiment, the interface calling function is allocated through a preset allocation method, and the preset interface calling function is obtained; according to the preset virtual file directory, the calling path of the preset interface calling function is replaced by the Hook function. The default virtual file directory path. It can obtain real data information from the system, prevent jumping out of the simulation of the elf file to be simulated due to data errors, and improve the reliability of the elf simulation to be simulated.

In one embodiment, as shown in FIG. 6 , in step S40, according to the preset function address, modifying the function address of the function to be intercepted includes:

S41: Obtain the address of the function to be intercepted from the preset function address table.

Wherein, the preset function address table refers to an address table custom-created by a user address table creation function. Exemplarily, the Jni Function Table address table is created through the write_function_table function. Further, the function address to be intercepted is obtained from the preset function address table. The function to be intercepted may be a preset interface calling function, and the address of the function to be intercepted may be an address of a preset interface calling function.

S42: Modify the address of the function to be intercepted according to the preset function address.

Specifically, according to the preset function address, the address of the function to be intercepted is modified, so that the function to be intercepted executes the corresponding module according to the preset function address.

It should be noted that, after the address of the function to be intercepted is modified, when the function to be intercepted is intercepted or controlled by the Hook function in the simulation execution framework, the function to be intercepted is executed according to the preset function address. module.

Exemplarily, the Jni Function Table address table is created through the write_function_table function. Function A is included in the JniFunction Table address table. Function A corresponds to module C, and the preset function address is D. Change function A to module C to obtain function A corresponding to module D. After function A is controlled by the Hook function in the simulation execution framework, function A executes module D first.

In this embodiment, the address of the function to be intercepted is obtained from a preset function address table, and the address of the function to be intercepted is modified according to the preset function address. When simulating the elf file, it can find the corresponding module data according to the user-defined function address according to the user's needs, and improve the practicability of the shared library file simulation method.

It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

In one embodiment, an apparatus for simulating a shared library file is provided, and the apparatus for simulating a shared library file is in one-to-one correspondence with the method for simulating a shared library file in the above-mentioned embodiment. As shown in FIG. 7 , the shared library file simulation apparatus includes: a file mapping module 10 , a memory isolation module 20 , an access mapping module 30 , an address modification module 40 , a function registration module 50 , and a data output module 60 . The detailed description of each functional module is as follows:

The file mapping module 10 is used to map the shared library file to be simulated into the virtual memory of the simulated execution framework by simulating the execution framework;

The memory isolation module 20 is used to isolate the virtual memory from the system memory by simulating the virtual memory mechanism of the execution framework;

The access mapping module 30 is used to map the access to the virtual file to the system file by simulating the virtual file system in the execution framework;

The address modification module 40 is configured to modify the function address of the function to be intercepted according to the preset function address, wherein the function to be intercepted is a function in a shared library format file;

The function registration module 50 is used for registering the preset function variable name and the preset function name, so that the Hook function in the simulation execution framework can return the intercepted function according to the preset function variable name and the preset function name;

The data output module 60 is used to obtain the dependencies of the shared library file to be simulated through the Objdump command, return the function to be intercepted in the simulated shared library file through the Hook function, and output the value returned by the function to be intercepted through the simulation execution framework , to analyze the shared library files to be simulated.

Further, the shared library file simulation device also includes:

The instruction detection module 601 is used to access the registers of the simulation execution framework, and detect whether there is an unconditional execution instruction, wherein the register includes the function number to be intercepted;

The value reading module 602 is used to read the value in the register when there is an unconditional execution instruction;

The function numbering module 603 is used to extract the corresponding target function number to be intercepted from the function number to be intercepted according to the value in the register;

The function determination module 604 is configured to determine the function to be intercepted according to the number of the target function to be intercepted.

Further, the file mapping module 10 includes:

The file parsing submodule 11 is used for parsing the shared library file to be simulated through the Pyelftools library to obtain the base address and structure pointer address of the initialized array in the shared library file to be simulated;

The address determination submodule 12 is used for determining the address of the initialization array according to the base address and the address of the structure pointer;

The function mapping submodule 13 is used to map the initialization function in the initialization array to the virtual memory of the simulation execution framework according to the address of the initialization array.

Further, the access mapping module 30 includes:

The function allocation sub-module 31 is used for allocating the interface calling function according to the preset allocation method, so as to obtain the preset interface calling function;

The path replacement submodule 32 is configured to replace the calling path of the preset interface calling function with the preset virtual file directory path through the hook function according to the preset virtual file directory.

Further, the address modification module 40 includes:

The address obtaining submodule 41 is used to obtain the address of the function to be intercepted from the preset function address table;

The address modification sub-module 42 is configured to modify the address of the function to be intercepted according to the preset function address.

For the specific limitation of the shared library file simulation apparatus, please refer to the above limitation on the shared library file simulation method, which will not be repeated here. Each module in the above-mentioned shared library file simulation apparatus may be implemented in whole or in part by software, hardware and combinations thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

In one embodiment, a computer device is provided, the computer device may be a server, and the internal structure diagram thereof may be as shown in FIG. 8 . The computer device includes a processor, memory, a network interface, and a database connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The nonvolatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the execution of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. The computer program implements a shared library file simulation method when executed by the processor.

In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the shared library file simulation method in the above embodiment is implemented. steps, such as step S10 to step S60. Alternatively, when the processor executes the computer program, the functions of the modules/units of the shared library file simulation apparatus in the above-mentioned embodiments, such as the functions of the modules 10 to 60 , are implemented. To avoid repetition, details are not repeated here.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by the processor, the shared library file simulation method in the above method embodiment is implemented, or the computer program is executed by the processor. When executed, the functions of each module/unit in the shared library file simulation device in the above device embodiments are implemented. To avoid repetition, details are not repeated here.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage In the medium, when the computer program is executed, it may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other medium used in the various embodiments provided in this application may include non-volatile and/or volatile memory. Nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Road (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. Module completion, that is, dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it is still possible to implement the foregoing implementations. The technical solutions described in the examples are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the within the protection scope of the present invention.

Claims (10)

1. A shared library file simulation method is characterized by comprising the following steps:

mapping a shared library file to be simulated to a virtual memory of a simulation execution frame through the simulation execution frame;

isolating the virtual memory from a system memory through a virtual memory mechanism of the simulation execution framework;

mapping access to the virtual file to a system file by simulating a virtual file system in the execution framework;

modifying the function address of a function to be intercepted according to a preset function address, wherein the function to be intercepted is a function in a shared library format file;

registering a preset function variable name and a preset function name so that a Hook function in the simulation execution frame can return the function to be intercepted according to the preset function variable name and the preset function name;

acquiring a dependent item of the shared library file to be simulated through an Objdump command, returning the function to be intercepted in the shared library file to be simulated through the Hook function, and outputting a value returned by the function to be intercepted through a simulation execution frame so as to realize analysis of the shared library file to be simulated.

2. The method for simulating a shared library file according to claim 1, wherein before the obtaining the dependent item of the shared library file to be simulated through the preset command and returning the function to be intercepted in the shared library file to be simulated through the Hook function, the method comprises:

accessing a register of the simulation execution frame, and detecting whether an unconditional execution instruction exists or not, wherein the register comprises a function number to be intercepted;

if the unconditional execution instruction exists, reading a numerical value in the register;

extracting a corresponding target function number to be intercepted from the function number to be intercepted according to the numerical value in the register;

and determining the function to be intercepted according to the serial number of the target function to be intercepted.

3. The method for simulating a shared library file according to claim 1, wherein the mapping the shared library file to be simulated to the virtual memory of the simulation execution framework by the simulation execution framework comprises:

analyzing the shared library file to be simulated through a Pyelfools library to obtain a base address and a structure pointer address of an initialized array in the shared library file to be simulated;

determining the initialized array address according to the base address and the structure pointer address;

and mapping the initialization function in the initialization array to the virtual memory of the simulation execution frame according to the initialization array address.

4. The shared library file emulation method of claim 1, wherein mapping access to the virtual file to the system file by emulating a virtual file system in the execution framework comprises:

distributing the interface calling function according to a preset distribution mode to obtain a preset interface calling function;

and replacing the call path of the preset interface call function with the preset virtual file directory path through the Hook function according to the preset virtual file directory.

5. The method for simulating a shared library file according to claim 1, wherein the modifying the function address of the function to be intercepted according to the preset function address comprises:

acquiring the function address to be intercepted from a preset function address table;

and modifying the function address to be intercepted according to a preset function address.

6. A shared library file simulation apparatus, comprising:

the file mapping module is used for mapping the shared library file to be simulated into a virtual memory of the simulation execution frame through the simulation execution frame;

the memory isolation module is used for isolating the virtual memory from the system memory through a virtual memory mechanism of the simulation execution frame;

the access mapping module is used for mapping the access to the virtual file to the system file by simulating the virtual file system in the execution frame;

the address modification module is used for modifying the function address of the function to be intercepted according to a preset function address, wherein the function to be intercepted is a function in the shared library format file;

the function registration module is used for registering a preset function variable name and a preset function name so that the Hook function in the simulation execution frame can return the function to be intercepted according to the preset function variable name and the preset function name;

and the data output module is used for acquiring the dependent items of the shared library file to be simulated through an Objdump command, returning the function to be intercepted in the shared library file to be simulated through the Hook function, and outputting the value returned by the function to be intercepted through a simulation execution frame so as to realize the analysis of the shared library file to be simulated.

7. The shared library file simulation apparatus of claim 6, further comprising:

the instruction detection module is used for accessing a register of the simulation execution framework and detecting whether an unconditional execution instruction exists or not, wherein the register comprises a function number to be intercepted;

the numerical value reading module is used for reading the numerical value in the register when the unconditional execution instruction exists;

the function numbering module is used for extracting a corresponding target function number to be intercepted from the function number to be intercepted according to the numerical value in the register;

and the function determining module is used for determining the function to be intercepted according to the target function to be intercepted number.

8. The shared library file emulation apparatus of claim 6, wherein the file mapping module comprises:

the file analysis submodule is used for analyzing the shared library file to be simulated through a Pyelftools library to obtain a base address and a structure pointer address of an initialized array in the shared library file to be simulated;

the address determination submodule is used for determining the initialized array address according to the base address and the structure pointer address;

and the function mapping submodule is used for mapping the initialization function in the initialization array to the virtual memory of the simulation execution frame according to the initialization array address.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the shared library file simulation method of any of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the shared library file simulation method of any of claims 1 to 5.

Images