CN106095667B - A kind of corresponding method for driving document location of quick positioning Android sensitive functions - Google Patents
A kind of corresponding method for driving document location of quick positioning Android sensitive functions Download PDFInfo
- Publication number
- CN106095667B CN106095667B CN201610389820.3A CN201610389820A CN106095667B CN 106095667 B CN106095667 B CN 106095667B CN 201610389820 A CN201610389820 A CN 201610389820A CN 106095667 B CN106095667 B CN 106095667B
- Authority
- CN
- China
- Prior art keywords
- android
- functions
- sensitive
- file
- strace
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/362—Software debugging
- G06F11/3636—Software debugging by tracing the execution of the program
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a kind of corresponding methods for driving document location of quick positioning Android sensitive functions, whether some sensitive operation can be explicitly indicated that according to some parameter name in writev functions, the position of driving file is determined using distinct methods, so that the method applicability of the present invention is strong, the position of fast and accurately Locating driver file is realized；The method of invention compares static analysis in the method for the detection Android driving file permission loopholes generated by customization, and the method is faster more convenient for driving the locating speed of file.
Description
Technical field
The invention belongs to inner nuclear layer security fields in Android frameworks, are related to a kind of quickly positioning Android sensitive functions
The method of corresponding driving document location.
Background technology
Nowadays, smart mobile phone industry rapidly develops, smart mobile phone using also having spread huge numbers of families, meanwhile, Android because
For the opening of own, become the maximum operation system of smart phone of user volume.Google officials issue Android new versions
Afterwards, manufacturer is in order to promote the market competitiveness, and is distinguished with the mobile phone of other opponents, will be by changing source code pair
Android versions are customized.
Wherein, manufacturer is the function of adapting to oneself exploitation, and entire Android bodies are likely to cause after Android is customized
System structure and file function mapping relations change, and difficulty is caused to analysis android system system and defects detection,
Driving file especially only corresponding to identification sensitive function could carry out safety monitoring further directed to driving file.Cause
This, the sensitive function of Locating driver file corresponding thereto is particularly important.
Modification due to manufacturer to Android, with the official versions of Google publications no matter from file hierarchy or
Filename, parameter, document location have it is largely different, so, how the driving file corresponding to location-sensitive function
Position just become carry out subsequent detection committed step.
For the positioning of the driving document location of LinuxKernel layers of Android corresponding to Android sensitive functions
Method, general detection method are mainly static immobilization, i.e., the Android source codes after customizing by comparing and Google publications
Android officials source code, to find the sensitive function (take pictures, obtain location information etc.) of Android application layers,
In the absolute path of AndroidLinuxKernel layers of corresponding driving file.But such method has the following disadvantages：
1, manufacturer, for driving the filename of file, parameter to be also modified, passes through source code when changing source code
Compare is difficult to find out the mapping relations of driving file and relevant sensitization function between the two；
2, manufacturer will not announce the Android source codes after customization, and obstruction is produced to detection work；
3, whole detection source code process is lengthy and jumbled, less efficient.
Invention content
Defect present in for the above-mentioned prior art and deficiency, the object of the present invention is to provide a kind of quickly positioning
The method of the corresponding driving document location of Android sensitive functions, this method carry out function when equipment is run to driving file
Positioning, without checking source code.
To achieve the goals above, the present invention adopts the following technical scheme that：
A kind of corresponding method for driving document location of quick positioning Android sensitive functions, includes the following steps：
Step 1：Test application is write for specific sensitive function, sensitive function includes multiple sensitive operations；
Step 2：The source code for downloading the debugging acid strace of Linux carries out cross compile to the source code of strace,
Generate the strace executable files for adapting to Android；Strace executable files are copied to the Android device of customization
On；
Step 3：Test application in the Android device for having copied strace executable files in installation steps 1；
Obtain all system service processes being currently running in Android device；
The strace executable files in Android device are executed, all system service processes are monitored；It opens and surveys
Examination application, calls the driving file of Kernel layers of Android Linux, generates monitoring journal file；
Step 4：Search monitoring journal file in related call function, related call function include open functions,
Openat functions and writev functions；If some parameter name in writev functions can explicitly indicate that some sensitivity behaviour
Make, thens follow the steps 5, it is no to then follow the steps 6；
Step 5：All sensitive operations for including according to sensitive function find out and indicate sensitive operation in writev functions
Parameter, and find out in open functions or openat functions the ginseng of the file node of expression driving file corresponding with sensitive operation
Number；The position that driving file is determined according to the file node of driving file obtains the corresponding all driving files of sensitive function
Position；
Step 6：It is repeated several times and executes step 3, obtain multiple monitoring journal files, search in multiple monitoring journal files
The parameter of writev functions, if a certain parameter of writev functions repeats in multiple monitoring journal files, the parameter
What is indicated is a certain sensitive operation, and expression driving file corresponding with sensitive operation is found out in open functions or openat functions
File node parameter, according to driving file file node determine driving file position；Search all repeat
The parameter of writev functions obtains the position of the corresponding all driving files of sensitive function.
Specifically, the source code of the debugging acid strace of the download Linux in the step 2, to the source generation of strace
Code carries out cross compile, generates the strace executable files for adapting to Android, specifically includes following steps：
Download the source code of strace；The source code of strace is handed over using arm schema compilers on a pc platform
Fork compiling, generates the strace executable files for adapting to Android.
Specifically, all system service processes being currently running in the acquisition Android device in the step 3, tool
Body includes the following steps：Start the adb in Android device, obtains what Android device was currently running using adb shell
All system service processes.
Compared with prior art, the present invention has the following technical effects：
1, method of the invention is dynamic testing method, without checking source code.
2, it can be completed using computer, data line and Android device, equipment is simple.
3, whether some sensitive operation can be explicitly indicated that according to some parameter name in writev functions, used
Distinct methods determine the position of driving file so that method applicability of the invention is strong, realizes fast and accurately Locating driver text
The position of part.
4, method of the invention is detecting Android by customization and in the method for the driving file permission loophole of generation,
Compared to static analysis, the method is faster more convenient for driving the locating speed of file.
Explanation and illustration in further detail is done to the solution of the present invention with reference to the accompanying drawings and detailed description.
Description of the drawings
Fig. 1 is detecting system Structure and Process；
Fig. 2 is the use help information of strace；
Fig. 3 is list where system service process；
Fig. 4 is the interception for generating journal file；
Fig. 5 is the result for monitoring file.
Specific implementation mode
The characteristics of present invention is based on Linux Kernel and interprocess communication according to android system, proposes a kind of needle
To the sensitive function of Android application layers, the dynamic approach of Kernel layers of driving files of positioning Android Linux uses tune
Trial work tool strace monitors the system service process of all kinds of drivings in test application running software, to obtain bottom layer driving text
The file node of part, is further accurately positioned driving file.
Referring to Fig. 1, the method for the corresponding driving document location of quick positioning Android sensitive functions of the invention, including
Following steps：
Step 1, test application is write for a certain specific sensitive function, sensitive function includes multiple sensitive operations.
Sensitive function refers to, in Android application layers, allowing application access user privacy information (such as：Photo, sound
Sound, position) function.
Sensitive operation refers in Kernel layers of Android Linux, the operation with the relevant inner nuclear layer of sensitive function.
Test application refers to the Android applications for having single sensitive function, in order to keep android system quick in completion
When feeling function, the driving file of Kernel layers of Android Linux is called.
By taking this sensitive function of taking a picture as an example, the test application write can realize opening camera, clap the present embodiment
It takes and stores the sensitive operations such as picture.
Step 2, the source code for downloading the debugging acid strace of Linux carries out cross compile to the source code of strace,
Generate the strace executable files for adapting to Android；Strace executable files are copied to the Android device of customization
On；Specifically include following steps：
Step 2.1：The source code (using strace 4.10 in the present invention) of strace is downloaded, Fig. 2 gives
Strace uses help information；Arm frameworks are used on PC platforms (using Linux-Ubuntu 14.04 in the present invention)
Compiler carries out cross compile to the source code of strace, generates the strace executable files for adapting to Android；Specific compiling
Order is as follows：
CC=arm-linux-gcc
LD=arm-linux-ld
RANLIB=arm-linux-ranlib
./configure--prefix=/home/lihaocun/strace
-- host=arm-linux--target=arm-linux
CC=arm-linux-androideabi-gcc
LD=arm-linux-androideabi-ld
RANLIB=arm-linux-androideabi-ranlib
./configure--prefix=/home/lihaocun/strace
-- host=arm-linux--target=arm-linux
Step 2.2：Strace can perform under adb shell environments using ADB (Android Debug Bridge)
(this process is likely to require root equipment and open system mesh under file copy to Android device/system/bin/ catalogues
Record access limit), used instruction is as follows：
adb shell->cat/sdcard/strace>/system/bin/strace
Step 2.3：The access rights of strace executable files are revised as complete open visit, used instruction is such as
Under：
chmod 777 strace
Step 3, the test application in the Android device for having copied strace executable files in installation steps 1；It obtains
Take all system service processes that current Android device is currently running；The strace executed in the Android device of customization can
File is executed, all system service processes are monitored；Test application is opened, calls Kernel layers of Android Linux's
File is driven, monitoring journal file is generated.
Step 3.1：Test application in the Android device of customization in installation steps 2, Android device is accessed
PC；Start the adb in current Android device, using adb shell obtain that current Android device is currently running it is all
System service process, used instruction are as follows：
adb shell->ps
Fig. 3 gives the system service process list of acquisition, records the process number of system service process, such as system service
The process number of process mediaserver is pid.
Step 3.2：Under adb shell environments execute strace executable files, to all system service processes into
Row monitoring, used instruction are as follows：
adb shell->Strace-v-y-tt-f-F-e trace=openat, writev, open
-s 200-p pid-o/sdcard/output
Wherein, pid is the process number of the system service process mediaserver of record, and end is the monitoring daily record of output
The position of file.
Step 3.3：Test application is opened, the driving file of Kernel layers of Android Linux is called, generates monitoring day
Will file, monitoring journal file interception content are shown in Fig. 4.
Step 4, the related call function in monitoring journal file, open functions, openat functions and writev letters are searched
Number；In monitoring journal file, open functions and writev functions occur in pairs, formation function pair, openat functions and
Writev functions occur in pairs, formation function pair；One function pair represents a sensitive operation, is wrapped in the parameter of writev functions
It is corresponding with the sensitive operation comprising expression in the parameter of open functions or openat functions containing the parameter for indicating a certain sensitive operation
Driving file file node parameter；If some parameter name in writev functions can explicitly indicate that some is quick
Sense operation, thens follow the steps 5, no to then follow the steps 6；
Step 5, all sensitive operations for including according to sensitive function find out and indicate sensitive operation in writev functions
Parameter, and find out in open functions or openat functions the ginseng of the file node of expression driving file corresponding with sensitive operation
Number determines the position of driving file according to the file node of driving file, obtains the corresponding all driving files of sensitive function
Position.
By taking Fig. 4 as an example, the latter protrudes character ExynosCamera::OpenSensor () is the ginseng in writev functions
Number indicates this sensitive operation of opening camera image sensor；First prominent character/dev/video40 is openat functions
In parameter, indicate the file node for opening the corresponding driving file video40 of camera image sensor this sensitive operation, root
It determines that the document location of driving file video40 is /dev/ according to the file node of driving file video40, is to obtain referring to Fig. 5
Driving file monitoring result.
Step 6, repeatedly (5 times or 6 times) repeat step 3, obtain multiple monitoring journal files, search multiple monitoring
The parameter of writev functions in journal file, if a certain parameter of writev functions repeats out in multiple monitoring journal files
Existing, then what the parameter indicated is a certain sensitive operation, and expression and sensitive operation pair are found out in open functions or openat functions
The parameter of the file node for the driving file answered；The position of driving file is determined according to the file node of driving file；Search institute
The parameter for having the writev functions repeated obtains the file of the corresponding driving file of all sensitive operations according to the method described above
Node determines the position of the corresponding driving file of all sensitive operations according to the file node of driving file, finally obtains sensitivity
The position of the corresponding all driving files of function.
Claims (3)
1. a kind of corresponding method for driving document location of quick positioning Android sensitive functions, which is characterized in that including following
Step：
Step 1：Test application is write for specific sensitive function, sensitive function includes multiple sensitive operations；Sensitive function refers to
Be to allow the function of application access user privacy information in Android application layers；Sensitive operation refers to
Kernel layers of Android Linux, the operation with the relevant inner nuclear layer of sensitive function；
Step 2：The source code for downloading the debugging acid strace of Linux carries out cross compile to the source code of strace, generates
Adapt to the strace executable files of Android；Strace executable files are copied in the Android device of customization；
Step 3：Test application in the Android device for having copied strace executable files in installation steps 1；
Obtain all system service processes being currently running in Android device；
The strace executable files in Android device are executed, all system service processes are monitored；Test is opened to answer
With the driving file of Kernel layers of Android Linux of calling generates monitoring journal file；
Step 4：The related call function in monitoring journal file is searched, related call function includes open functions, openat letters
Number and writev functions；If some parameter name in writev functions can explicitly indicate that some sensitive operation, hold
Row step 5, it is no to then follow the steps 6；
Step 5：All sensitive operations for including according to sensitive function find out the ginseng that sensitive operation is indicated in writev functions
Number, and find out in open functions or openat functions the ginseng of the expression file node for driving file corresponding with sensitive operation
Number；The position that driving file is determined according to the file node of driving file obtains the corresponding all driving files of sensitive function
Position；
Step 6：It is repeated several times and executes step 3, obtain multiple monitoring journal files, search in multiple monitoring journal files
The parameter of writev functions, if a certain parameter of writev functions repeats in multiple monitoring journal files, the parameter
What is indicated is a certain sensitive operation, and expression driving file corresponding with sensitive operation is found out in open functions or openat functions
File node parameter, according to driving file file node determine driving file position；Search all repeat
The parameter of writev functions obtains the position of the corresponding all driving files of sensitive function.
2. the method as described in claim 1 for quickly positioning the corresponding driving document location of Android sensitive functions, feature
It is, the source code of the debugging acid strace of the download Linux in the step 2 intersects the source code of strace
Compiling generates the strace executable files for adapting to Android, specifically includes following steps：
Download the source code of strace；Intersection volume is carried out to the source code of strace using arm schema compilers on a pc platform
It translates, generates the strace executable files for adapting to Android.
3. the method as described in claim 1 for quickly positioning the corresponding driving document location of Android sensitive functions, feature
It is, all system service processes being currently running in the acquisition Android device in the step 3 specifically include following
Step：Start the adb in Android device, obtaining all systems that Android device is currently running using adb shell takes
Business process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610389820.3A CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610389820.3A CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106095667A CN106095667A (en) | 2016-11-09 |
| CN106095667B true CN106095667B (en) | 2018-08-10 |
Family
ID=57448086
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610389820.3A Expired - Fee Related CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106095667B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106778266A (en) * | 2016-11-24 | 2017-05-31 | 天津大学 | A kind of Android Malware dynamic testing method based on machine learning |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105005058A (en) * | 2015-07-23 | 2015-10-28 | 柳州市百思得信息技术有限公司 | Android platform-based big dipper and GPS dual-mode on-line positioning method |
| CN105468970A (en) * | 2015-11-27 | 2016-04-06 | 西北大学 | Tamper-proof method and system of Android application on the basis of defense network |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140132767A1 (en) * | 2010-07-31 | 2014-05-15 | Eric Sonnabend | Parking Information Collection System and Method |
-
2016
- 2016-06-03 CN CN201610389820.3A patent/CN106095667B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105005058A (en) * | 2015-07-23 | 2015-10-28 | 柳州市百思得信息技术有限公司 | Android platform-based big dipper and GPS dual-mode on-line positioning method |
| CN105468970A (en) * | 2015-11-27 | 2016-04-06 | 西北大学 | Tamper-proof method and system of Android application on the basis of defense network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106095667A (en) | 2016-11-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10810115B2 (en) | Systems and methods using artificial intelligence to identify, test, and verify system modifications | |
| Yang et al. | Leakminer: Detect information leakage on android with static taint analysis | |
| US9355017B2 (en) | Automated error checking system for a software application and method therefor | |
| Lin et al. | Automated forensic analysis of mobile applications on Android devices | |
| US9280665B2 (en) | Fast and accurate identification of message-based API calls in application binaries | |
| US9753971B2 (en) | Hot deployment of embedded database procedures | |
| WO2020015191A1 (en) | Business rule releasing and managing method, electronic device and readable storage medium | |
| Pienaar et al. | JSWhiz: Static analysis for JavaScript memory leaks | |
| US9311077B2 (en) | Identification of code changes using language syntax and changeset data | |
| CN110263546B (en) | Method, device and equipment for carrying out security check on container mirror image | |
| US20130179867A1 (en) | Program Code Analysis System | |
| CN104732146A (en) | Android program bug detection method and system | |
| Goaër | Enforcing green code with Android lint | |
| WO2014035737A1 (en) | Obtaining metadata set by imperative statement | |
| Liu et al. | Identifying and characterizing silently-evolved methods in the android API | |
| Christophe et al. | Linvail: A general-purpose platform for shadow execution of JavaScript | |
| CN111966357A (en) | Operating system application compiling method and device and electronic equipment | |
| CN106095667B (en) | A kind of corresponding method for driving document location of quick positioning Android sensitive functions | |
| US20190205105A1 (en) | Automatically building software projects | |
| CN107526966B (en) | Composite stain propagation tracking method for Android platform | |
| Liu et al. | Exploring sensor usage behaviors of android applications based on data flow analysis | |
| KR20130020135A (en) | System and method of providing the developer list of developing code simultaneously in an integrated development environment | |
| EP2885712A1 (en) | Imperative attribution for elements in managed runtimes | |
| JP6717140B2 (en) | Analysis program, analysis method, and analysis device | |
| CN115509913A (en) | Software automation test method, device, machine readable medium and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20180810 Termination date: 20210603 |