CN106095667A - A kind of method of quick positioning Android sensitive function corresponding driving document location - Google Patents
A kind of method of quick positioning Android sensitive function corresponding driving document location Download PDFInfo
- Publication number
- CN106095667A CN106095667A CN201610389820.3A CN201610389820A CN106095667A CN 106095667 A CN106095667 A CN 106095667A CN 201610389820 A CN201610389820 A CN 201610389820A CN 106095667 A CN106095667 A CN 106095667A
- Authority
- CN
- China
- Prior art keywords
- function
- file
- android
- strace
- sensitive
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/362—Software debugging
- G06F11/3636—Software debugging by tracing the execution of the program
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses the method for a kind of quick positioning Android sensitive function corresponding driving document location, whether can explicitly indicate that some sensitive operation according to some parameter name in writev function, distinct methods is used to determine the position driving file, the method applicability making the present invention is strong, it is achieved the position of Locating driver file fast and accurately；The method of invention compares static analysis at detection Android in the method for the driving file permission leak that customization produces, and the method is faster more convenient for the locating speed driving file.
Description
Technical field
The invention belongs to inner nuclear layer security fields in Android framework, relate to a kind of quick positioning Android sensitive function
The method of corresponding driving document location.
Background technology
Nowadays, smart mobile phone industry develops rapidly, smart mobile phone use also throughout huge numbers of families, meanwhile, Android because of
For the opening of its own, become the maximum operation system of smart phone of customer volume.Google official issues Android redaction
After, manufacturer is in order to promote the market competitiveness, and makes a distinction with the mobile phone of other opponents, will be by modification source code pair
Android version is customized.
Wherein, manufacturer is for adapting to the function of oneself exploitation, is likely to cause whole Android body after customizing Android
System structure and file function mapping relations change, and cause difficulty to analysis android system system and defects detection,
Especially only identify the driving file corresponding to sensitive function, just can be further directed to drive file to carry out safety monitoring.Cause
This, Locating driver file sensitive function corresponding thereto is particularly important.
Due to the modification to Android for the manufacturer, the official version issued with Google no matter from file hierarchy or
Filename, parameter, document location have different largely, so, the how driving file corresponding to location-sensitive function
Position just become the committed step carrying out subsequent detection.
Positioning for the driving document location of the Android LinuxKernel layer corresponding to Android sensitive function
Method, general detection method is mainly static immobilization, is i.e. issued by comparing the Android source code after customization and Google
Android official source code, thus find the sensitive function (take pictures, obtain positional information etc.) of Android application layer,
Absolute path at AndroidLinuxKernel layer corresponding driving file.But, this type of method has the disadvantage that
1st, manufacturer is when changing source code, for driving the filename of file, parameter to be also carried out modification, passes through source code
It is relatively difficult to find out driving file and relevant sensitization function mapping relations between the two；
2nd, the Android source code after manufacturer will not announce customization, creates obstruction to detection work；
3rd, whole detection source code process is lengthy and jumbled, inefficient.
Content of the invention
For defect and deficiency present in above-mentioned prior art, it is an object of the invention to, a kind of quick positioning is provided
The method of Android sensitive function corresponding driving document location, the method carries out function when equipment runs to driving file
Positioning, it is not necessary to check source code.
To achieve these goals, the present invention adopts the following technical scheme that
The method of a kind of quick positioning Android sensitive function corresponding driving document location, comprises the following steps:
Step 1: writing test application for concrete sensitive function, sensitive function includes multiple sensitive operation；
Step 2: download the source code of the debugging acid strace of Linux, cross compile is carried out to the source code of strace,
Generate the strace executable file adapting to Android；Strace executable file is copied to the Android device of customization
On；
Step 3: the test application in installation steps 1 in the Android device having copied strace executable file；
Obtain all system service processes being currently running in Android device；
Perform the strace executable file in Android device, all system service processes are monitored；Open and survey
Examination application, calls the driving file of Android Linux Kernel layer, generates and monitors journal file；
Step 4: search monitor in journal file related and call function, related call function include open function,
Openat function and writev function；If some parameter name in writev function can explicitly indicate that some sensitive behaviour
Make, then step 5, otherwise step 6；
Step 5: all sensitive operation including according to sensitive function, finds out and represents sensitive operation in writev function
Parameter, and in open function or openat function, find out the ginseng of the file node representing driving file corresponding with sensitive operation
Number；Determine the position driving file according to the file node driving file, obtain the corresponding all driving files of sensitive function
Position；
Step 6: step 3 is repeated several times, obtains multiple supervision journal file, searches in multiple supervision journal file
The parameter of writev function, if a certain parameter of writev function repeats in multiple supervision journal files, then this parameter
Represent is a certain sensitive operation, finds out expression driving corresponding with sensitive operation file in open function or openat function
The parameter of file node, determine the position driving file according to the file node driving file；Search all repeating
The parameter of writev function, obtains the position of the corresponding all driving files of sensitive function.
Specifically, the source code of the debugging acid strace of the download Linux in described step 2, the source generation to strace
Code carries out cross compile, generates the strace executable file adapting to Android, and it specifically includes following steps:
Download the source code of strace；The source code to strace for the arm schema compiler is used to hand on a pc platform
Fork compiling, generates the strace executable file adapting to Android.
Specifically, all system service processes acquisition Android device in described step 3 being currently running, its tool
Body comprises the following steps: start the adb in Android device, utilizes adb shell to obtain what Android device was currently running
All system service processes.
Compared with prior art, the present invention has following technical effect that
1st, the method for the present invention is dynamic testing method, it is not necessary to check source code.
2nd, using computer, data wire and Android device to complete, equipment is simple.
3rd, whether can explicitly indicate that some sensitive operation according to some parameter name in writev function, use
Distinct methods determines the position driving file so that the method applicability of the present invention is strong, it is achieved Locating driver literary composition fast and accurately
The position of part.
4th, the method for the present invention is in the method for the driving file permission leak that detection Android produces through customizing,
Comparing static analysis, the method is faster more convenient for the locating speed driving file.
With detailed description of the invention the solution of the present invention done below in conjunction with the accompanying drawings and explain in further detail and explanation.
Brief description
Fig. 1 is detecting system Structure and Process；
Fig. 2 is the use help information of strace；
Fig. 3 is the place list of system service process；
Fig. 4 is for generating the intercepting of journal file；
Fig. 5 is the result of monitoring file.
Detailed description of the invention
The present invention proposes a kind of pin according to android system based on the feature of Linux Kernel and interprocess communication
Sensitive function to Android application layer, positioning Android Linux Kernel layer drives the dynamic approach of file, uses and adjust
Trial work tool strace monitors the system service process of all kinds of driving testing when application software is run, thus obtains bottom layer driving literary composition
The file node of part, is accurately positioned driving file further.
See Fig. 1, the method for the quick positioning Android sensitive function corresponding driving document location of the present invention, including
Following steps:
Step 1, writes test application for a certain concrete sensitive function, and sensitive function includes multiple sensitive operation.
Sensitive function refers at Android application layer, it is allowed to application accesses user privacy information (such as: photo, sound
Sound, position) function.
Sensitive operation refers in Android Linux Kernel layer, the operation of the inner nuclear layer related to sensitive function.
Test application refers to possess the Android application of single sensitive function, in order to make android system complete quick
During sense function, call the driving file of Android Linux Kernel layer.
The present embodiment is as a example by this sensitive function of taking a picture, and the test application write is capable of opening camera, bat
Take and store the sensitive operation such as picture.
Step 2, downloads the source code of the debugging acid strace of Linux, carries out cross compile to the source code of strace,
Generate the strace executable file adapting to Android；Strace executable file is copied to the Android device of customization
On；Specifically include following steps:
Step 2.1: downloading the source code (using strace 4.10 in the present invention) of strace, Fig. 2 gives
Strace uses help information；At PC platform (using Linux-Ubuntu 14.04 in the present invention) upper use arm framework
The source code to strace for the compiler carries out cross compile, generates the strace executable file adapting to Android；Concrete compiling
Order as follows:
CC=arm-linux-gcc
LD=arm-linux-ld
RANLIB=arm-linux-ranlib
./configure--prefix=/home/lihaocun/strace
--host=arm-linux--target=arm-linux
CC=arm-linux-androideabi-gcc
LD=arm-linux-androideabi-ld
RANLIB=arm-linux-androideabi-ranlib
./configure--prefix=/home/lihaocun/strace
--host=arm-linux--target=arm-linux
Step 2.2: utilize ADB (Android Debug Bridge) strace can be performed under adb shell environment
File copy is to (this process is likely to require root equipment open system mesh under Android device/system/bin/ catalogue
Record access limit), the instruction being used is as follows:
adb shell->cat/sdcard/strace>/system/bin/strace
Step 2.3: the access rights of strace executable file are revised as complete open visit, the instruction being used is such as
Under:
chmod 777 strace
Step 3, the test application in installation steps 1 in the Android device having copied strace executable file；Obtain
Take all system service processes that current Android device is currently running；Performing the strace in the Android device of customization can
Perform file, all system service processes are monitored；Open test application, call Android Linux Kernel layer
Drive file, generate and monitor journal file.
Android device is accessed by step 3.1: the test application in installation steps 2 in the Android device of customization
PC；Starting the adb in current Android device, utilizing adb shell to obtain, that current Android device is currently running is all
System service process, the instruction being used is as follows:
adb shell->ps
Fig. 3 gives the system service process list of acquisition, the process number of record system service process, such as system service
The process number of process mediaserver is pid.
Step 3.2: perform strace executable file under adb shell environment, all of system service process is entered
Row monitoring, the instruction being used is as follows:
Adb shell-> strace-v-y-tt-f F-e trace=openat, writev, open
-s 200-p pid-o/sdcard/output
Wherein, the process number of system service process mediaserver for record for the pid, end is the supervision daily record of output
The position of file.
Step 3.3: open test application, call the driving file of Android Linux Kernel layer, generate and monitor day
Will file, monitors that journal file intercepts content and sees Fig. 4.
Step 4, searches the related function that calls monitoring in journal file, open function, openat function and writev letter
Number；Monitoring in journal file, open function and writev function occur in pairs, formation function pair, openat function and
Writev function occurs in pairs, formation function pair；One function, to representing a sensitive operation, wraps in the parameter of writev function
Containing the parameter representing a certain sensitive operation, the parameter of open function or openat function comprises represent corresponding with this sensitive operation
The parameter of file node of driving file；If some parameter name in writev function can explicitly indicate that some is quick
Sense operation, then step 5, otherwise step 6；
Step 5, all sensitive operation including according to sensitive function, find out and writev function represents sensitive operation
Parameter, and in open function or openat function, find out the ginseng of the file node representing driving file corresponding with sensitive operation
Number, determines the position driving file according to the file node driving file, obtains the corresponding all driving files of sensitive function
Position.
As a example by Fig. 4, rear prominent character ExynosCamera::openSensor () is the ginseng in writev function
Number, represents and opens this sensitive operation of camera image sensor；First prominent character/dev/video40 is openat function
In parameter, represent and open the file node of this sensitive operation of camera image sensor corresponding driving file video40, root
Determine that the document location driving file video40, for/dev/, sees Fig. 5 for obtaining according to the file node driving file video40
Driving file monitoring result.
Step 6, repeatedly (5 times or 6 times) repeated execution of steps 3, obtain multiple supervision journal file, search multiple supervision
The parameter of the writev function in journal file, if a certain parameter of writev function repeats in multiple supervision journal files
Existing, then what this parameter represented is a certain sensitive operation, finds out expression and sensitive operation pair in open function or openat function
The parameter of the file node of the driving file answered；Determine the position driving file according to the file node driving file；Search institute
There is the parameter of the writev function repeating, obtain the file of all sensitive operation corresponding driving file according to the method described above
Node, determines the position of all sensitive operation corresponding driving file, finally gives sensitivity according to the file node driving file
The position of the corresponding all driving files of function.
Claims (3)
1. the method for a quick positioning Android sensitive function corresponding driving document location, it is characterised in that include following
Step:
Step 1: writing test application for concrete sensitive function, sensitive function includes multiple sensitive operation；
Step 2: download the source code of the debugging acid strace of Linux, carry out cross compile to the source code of strace, generates
Adapt to the strace executable file of Android；Copy strace executable file in the Android device of customization to；
Step 3: the test application in installation steps 1 in the Android device having copied strace executable file；
Obtain all system service processes being currently running in Android device；
Perform the strace executable file in Android device, all system service processes are monitored；Opening test should
With, call the driving file of Android Linux Kernel layer, generation monitors journal file；
Step 4: search monitor in journal file related and call function, related call function and includes open function, openat letter
Number and writev function；If some parameter name in writev function can explicitly indicate that some sensitive operation, then hold
Row step 5, otherwise step 6；
Step 5: all sensitive operation including according to sensitive function, finds out the ginseng representing sensitive operation in writev function
Number, and in open function or openat function, find out the ginseng of the file node representing driving file corresponding with sensitive operation
Number；Determine the position driving file according to the file node driving file, obtain the corresponding all driving files of sensitive function
Position；
Step 6: step 3 is repeated several times, obtains multiple supervision journal file, searches in multiple supervision journal file
The parameter of writev function, if a certain parameter of writev function repeats in multiple supervision journal files, then this parameter
Represent is a certain sensitive operation, finds out expression driving corresponding with sensitive operation file in open function or openat function
The parameter of file node, determine the position driving file according to the file node driving file；Search all repeating
The parameter of writev function, obtains the position of the corresponding all driving files of sensitive function.
2. the method for quick positioning Android sensitive function as claimed in claim 1 corresponding driving document location, its feature
It is that the source code of strace is intersected by the source code of the debugging acid strace of the download Linux in described step 2
Compiling, generates the strace executable file adapting to Android, and it specifically includes following steps:
Download the source code of strace；Use the source code to strace for the arm schema compiler to carry out intersection on a pc platform to compile
Translate, generate the strace executable file adapting to Android.
3. the method for quick positioning Android sensitive function as claimed in claim 1 corresponding driving document location, its feature
Being, all system service processes that the acquisition Android device in described step 3 is currently running, it specifically includes following
Step: start the adb in Android device, utilizes adb shell to obtain all systems clothes that Android device is currently running
Business process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610389820.3A CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610389820.3A CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106095667A true CN106095667A (en) | 2016-11-09 |
| CN106095667B CN106095667B (en) | 2018-08-10 |
Family
ID=57448086
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610389820.3A Expired - Fee Related CN106095667B (en) | 2016-06-03 | 2016-06-03 | A kind of corresponding method for driving document location of quick positioning Android sensitive functions |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106095667B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106778266A (en) * | 2016-11-24 | 2017-05-31 | 天津大学 | A kind of Android Malware dynamic testing method based on machine learning |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140132767A1 (en) * | 2010-07-31 | 2014-05-15 | Eric Sonnabend | Parking Information Collection System and Method |
| CN105005058A (en) * | 2015-07-23 | 2015-10-28 | 柳州市百思得信息技术有限公司 | Android platform-based big dipper and GPS dual-mode on-line positioning method |
| CN105468970A (en) * | 2015-11-27 | 2016-04-06 | 西北大学 | Tamper-proof method and system of Android application on the basis of defense network |
-
2016
- 2016-06-03 CN CN201610389820.3A patent/CN106095667B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140132767A1 (en) * | 2010-07-31 | 2014-05-15 | Eric Sonnabend | Parking Information Collection System and Method |
| CN105005058A (en) * | 2015-07-23 | 2015-10-28 | 柳州市百思得信息技术有限公司 | Android platform-based big dipper and GPS dual-mode on-line positioning method |
| CN105468970A (en) * | 2015-11-27 | 2016-04-06 | 西北大学 | Tamper-proof method and system of Android application on the basis of defense network |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106778266A (en) * | 2016-11-24 | 2017-05-31 | 天津大学 | A kind of Android Malware dynamic testing method based on machine learning |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106095667B (en) | 2018-08-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Biørn-Hansen et al. | An empirical investigation of performance overhead in cross-platform mobile development frameworks | |
| Wei et al. | Taming android fragmentation: Characterizing and detecting compatibility issues for android apps | |
| CN102402427B (en) | A kind of update method of java application and device | |
| CN110554965B (en) | Automated fuzz testing method, related equipment and computer readable storage medium | |
| US10169199B2 (en) | Automatic model-specific debugger extensions | |
| US8732674B1 (en) | Revertable managed execution image instrumentation | |
| US9727436B2 (en) | Adding a profiling agent to a virtual machine to permit performance and memory consumption analysis within unit tests | |
| US20220012844A1 (en) | Methods and apparatus to emulate graphics processing unit instructions | |
| US8887141B2 (en) | Automatically modifying a native code module accessed from virtual machine bytecode to determine execution information | |
| CN103970659B (en) | Android application software automation testing method based on pile pitching technology | |
| US9715440B2 (en) | Test scope determination based on code change(s) | |
| GB2516986A (en) | Automated application test system | |
| US20120198416A1 (en) | Support for heterogeneous database artifacts in a single project | |
| WO2019005228A1 (en) | Automated source code adaption to inject features between platform versions | |
| US9311077B2 (en) | Identification of code changes using language syntax and changeset data | |
| US20130179867A1 (en) | Program Code Analysis System | |
| US20150269061A1 (en) | Method and system for code analysis using symbolic types | |
| US20080127119A1 (en) | Method and system for dynamic debugging of software | |
| CN107526966B (en) | Composite stain propagation tracking method for Android platform | |
| CN106095667B (en) | A kind of corresponding method for driving document location of quick positioning Android sensitive functions | |
| US9489179B2 (en) | Application programming interface tracing mechanism | |
| Ruprecht et al. | Automatic feature selection in large-scale system-software product lines | |
| Zheng et al. | Comprehensive multiplatform dynamic program analysis for java and android | |
| KR20130020135A (en) | System and method of providing the developer list of developing code simultaneously in an integrated development environment | |
| US10838716B1 (en) | Automated dependency detection and response |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20180810 Termination date: 20210603 |