CN107451474A

CN107451474A - Software vulnerability restorative procedure and device for terminal

Info

Publication number: CN107451474A
Application number: CN201610377750.XA
Authority: CN
Inventors: 杨书范; 王桂明; 包沉浮; 张煜龙; 韦韬
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Baidu Online Network Technology Beijing Co Ltd; Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2016-05-31
Filing date: 2016-05-31
Publication date: 2017-12-08
Anticipated expiration: 2036-05-31
Also published as: CN107451474B

Abstract

This application discloses the software vulnerability restorative procedure and device for terminal.One embodiment of methods described includes：The reparation file for the software vulnerability that the reception server is sent, wherein, the reparation file includes repairing code, location information and compatible information, it is necessary to be added to the information in the precalculated position of the reparation code when compatible information is used to indicate to carry out compatible processing to the reparation code；Determine position to be repaired corresponding to the software vulnerability of the location information instruction；The information of the compatible information instruction and/or the information of the corresponding relation lookup compatible information instruction using the system information of the terminal obtained in advance and the system information pre-set and the information of compatible information instruction are searched in the context of the position to be repaired；The precalculated position that the information found is added to the reparation code obtains compatibility code；The software vulnerability is repaired by the compatibility code.The hot repair that the embodiment realizes the software vulnerability of compatible distinct device is answered, and protects the safety of terminal device.

Description

Software vulnerability restorative procedure and device for terminal

Technical field

The application is related to field of computer technology, and in particular to the software of security technology area, more particularly, to terminal Leak restorative procedure and device.

Background technology

Leak be in defect present on hardware, software, the specific implementation of agreement or System Security Policy, so as to so that Attacker can access or destroy system in the case of unauthorized.Software is often as dredging when developer develops software Suddenly, or caused by the limitation of programming language.

By taking Android (Android) system as an example, in primary Android leaks, kernel (kernel) layer leak accounts for 1/ 4, nation method layer (Native) layer, application framework layer and native applications account for remaining 3/4.Existing leak restorative procedure master If distinct device manufacturer issues leak according to Google and repairs source code, patch is repaired for distinct device secondary development leak. The multiple main advantage of hot repair is the service disconnection that will not be currently running equipment, i.e., can in the case of not restarting equipment To be repaired to the defects of equipment current software version

However, due to the fragmentation of android system, Android device species, system version are more and more, existing Leak restorative procedure can not compatible each Android device, cause development cost more and more higher, seriously hinder and leak is repaiied Return to work work, user is faced with potential security threat, and this restorative procedure is only absorbed in and repairs kernel layer leaks, nothing Method dynamic restoring Native layers, application framework layer and application layer leak, repair process need restarting equipment to fail to realize that hot repair is answered.

The content of the invention

The purpose of the application is to propose a kind of improved software vulnerability restorative procedure and device for terminal, to solve The technical problem that background section above is mentioned.

In a first aspect, this application provides a kind of software vulnerability restorative procedure for terminal, methods described includes：Receive The reparation file for the software vulnerability that server is sent, wherein, the reparation file includes repairing code, location information and compatibility Information, it is necessary to be added to the reparation code when compatible information is used to indicate to the reparation code progress compatible processing Precalculated position information；Determine position to be repaired corresponding to the software vulnerability of the location information instruction；Treated described Repair the information that the compatible information instruction is searched in the context of position and/or the system using the terminal obtained in advance The corresponding relation of information and the system information and the information of compatible information instruction that pre-set searches the compatible information The information of instruction；The precalculated position that the information found is added to the reparation code obtains compatibility code；By described simultaneous Hold code and repair the software vulnerability.

In certain embodiments, when the software vulnerability is Java layer leaks, the reparation code is included by Java languages What speech was write is used to repair the bytecode run in Java Virtual Machine that the program of the software vulnerability compiles out, or by described The machine instruction that bytecode compiles out；When the software vulnerability is nation method Native layer leaks, the reparation code bag Include the machine instruction for being used to repair the program of the software vulnerability and compiling out write by C/C++ language.

In certain embodiments, the routing information of file where the location information includes the software vulnerability, when described When software vulnerability is Java layer leaks, the location information also includes：The predetermined class associated with the software vulnerability The title of title and method, and the predetermined method parameter number and parameter type title associated with the software vulnerability； And position to be repaired corresponding to the software vulnerability for determining the location information instruction, including：According to the software The routing information of file, the title of the class, the title of methods described, methods described number of parameters and the parameter where leak Typonym, by calling Java Virtual Machine interface to obtain method description scheme of the methods described inside the Java Virtual Machine Body.

In certain embodiments, the routing information of file where the location information includes the software vulnerability, when described When reparation code is machine instruction, the location information also includes at least one in following binary features：It is predetermined The title of the component associated with the software vulnerability, the title of the predetermined function associated with the software vulnerability, in advance The number of parameters associated with the software vulnerability and parameter type, the predetermined letter associated with the software vulnerability determined The binary features for the command sequence that number or combination of function compiling form, the predetermined sentence associated with the software vulnerability Or statement block compiles the binary features of the command sequence formed；And the software for determining the location information instruction Position to be repaired corresponding to leak, including：The routing information of file determines the software vulnerability according to where the software vulnerability Place file is loaded into the address realm in the internal memory of the terminal；The binary system that will be found in the address realm Position where feature is defined as position to be repaired corresponding to the software vulnerability of the location information instruction, wherein, it is described Position where binary features includes at least one of following：The position of code block where the binary features, described two Where the position of component where the position of function where system feature, the binary features, the binary features The position of the predetermined portions of component.

In certain embodiments, the routing information of file where the location information includes the software vulnerability, when described When reparation code is machine instruction, the location information is also included by least one in following compilation sequence signature：In advance really It is fixed combine with the Fixed constant of software vulnerability association or Fixed constant compilation sequence that compiling forms, it is predetermined and The function or combination of function of the software vulnerability association compile the compilation sequence formed, the predetermined and software vulnerability closes The sentence or statement block of connection compile the compilation sequence formed, the predetermined sentence or statement block associated with the software vulnerability Compile the sequence of instructions that jump list, the predetermined function associated with the software vulnerability or the combination of function compiling of generation form Compilation sequence signature, the predetermined sentence associated with the software vulnerability or the statement block compiling that row dis-assembling obtains form The obtained compilation sequence signature of command sequence dis-assembling；And the software vulnerability for determining the location information instruction Corresponding position to be repaired, including：The routing information of file according to where the software vulnerability is determined where the software vulnerability File is loaded into the address realm in the internal memory of the terminal；Machine instruction in the address realm is converted into compilation sequence Row；The compilation sequence signature is searched in the compilation sequence changed, to determine position corresponding to the compilation sequence signature, Wherein, position corresponding to the compilation sequence signature includes at least one of following：Code block corresponding to the compilation sequence signature Position, the position of function corresponding to the compilation sequence signature, the position, described of component corresponding to the compilation sequence signature The position of the predetermined portions of component corresponding to compilation sequence signature.

In certain embodiments, it is described that the software vulnerability is repaired by the compatibility code, including：Will be described to be repaired The code revision of position is the compatibility code；Or the compatibility code is stored in the free memory space of the terminal In, and the position stored is arranged to the jump location of position to be repaired；Or replace institute by the way that the compatibility code is static State the predetermined portions of the component where software vulnerability or the component where the software vulnerability；Or repaiied by the compatibility code Change the method description scheme body information of the method where the software vulnerability to replace the method where the software vulnerability.

In certain embodiments, it is described that the software vulnerability is repaired by the compatibility code, including：In response to predetermined journey The operation of sequence, the software vulnerability is repaired by the compatibility code, wherein, the preset program includes at least one of following： Program where kernel program, the program for creating program process, loading/linker program, software vulnerability.

In certain embodiments, it is described in response to pre-programmed operation, the software is repaired by the compatibility code Leak, including：When the preset program is kernel program, the content of the software vulnerability will be repaired by the compatibility code Insert kernel module；When the preset program is non-core program, preset program described in modifications or substitutions, with described predetermined The content that the software vulnerability is repaired by the compatibility code is added in program；Or to the pre-programmed dependence item, During so that the preset program starting, the software vulnerability is repaired by the compatibility code；Or the compatible generation will be passed through In the process that the content Dynamic injection that code repairs the software vulnerability creates when being performed to the preset program.

In certain embodiments, the reparation file for the software vulnerability that the reception server is sent, including：Examine the end End whether there is predetermined software vulnerability；If it is, obtaining for the reparation file of the software vulnerability is sent to the server Request is taken, wherein, the system information for asking also to include the terminal；The reception server send with the system information phase The reparation file of the software vulnerability of matching.

Second aspect, this application provides a kind of software vulnerability prosthetic device for terminal, described device includes：Receive Unit, the reparation file of the software vulnerability of the reception server transmission is configured to, wherein, the reparation file includes repairing generation When code, location information and compatible information, the compatible information are used to indicate to carry out the reparation code compatible processing, it is necessary to It is added to the information in the precalculated position of the reparation code；Determining unit, it is configured to determine the institute of the location information instruction State position to be repaired corresponding to software vulnerability；Searching unit, it is configured to search institute in the context of the position to be repaired State the information of compatible information instruction and/or utilize the system information of the terminal obtained in advance and the system pre-set letter Breath and the corresponding relation of the information of compatible information instruction search the information of the compatible information instruction；Adding device, configuration Precalculated position for the information found to be added to the reparation code obtains compatibility code；Unit is repaired, is configured to The software vulnerability is repaired by the compatibility code.

In certain embodiments, the routing information of file where the location information includes the software vulnerability, when described When software vulnerability is Java layer leaks, the location information also includes：The predetermined class associated with the software vulnerability The title of title and method, and the predetermined method parameter number and parameter type title associated with the software vulnerability； And the determining unit is further configured to：The routing information of file, the name of the class according to where the software vulnerability Title, the title of methods described, methods described number of parameters and the parameter type title, by calling Java Virtual Machine interface to obtain Take method description scheme body of the methods described inside the Java Virtual Machine.

In certain embodiments, it is characterised in that the path of file where the location information includes the software vulnerability Information, when the reparation code is machine instruction, the location information also includes at least one in following binary features： The title of the predetermined component associated with the software vulnerability, the predetermined function associated with the software vulnerability Title, the predetermined number of parameters associated with the software vulnerability and parameter type, the predetermined and software leak The binary features for the command sequence that the function of hole association or combination of function compiling form, the predetermined and software vulnerability The binary features for the command sequence that sentence or the statement block compiling of association form；And the determining unit further configures use In：The routing information of file according to where the software vulnerability determines that file where the software vulnerability is loaded into the terminal Internal memory in address realm；Position where the binary features that will be found in the address realm is defined as described Position to be repaired corresponding to the software vulnerability of location information instruction, wherein, the position where the binary features includes At least one of below：The position of function where the position of code block where the binary features, the binary features, The position of the predetermined portions of component where the position of component where the binary features, the binary features.

In certain embodiments, the routing information of file where the location information includes the software vulnerability, when described When reparation code is machine instruction, the location information is also included by least one in following compilation sequence signature：In advance really It is fixed combine with the Fixed constant of software vulnerability association or Fixed constant compilation sequence that compiling forms, it is predetermined and The function or combination of function of the software vulnerability association compile the compilation sequence formed, the predetermined and software vulnerability closes The sentence or statement block of connection compile the compilation sequence formed, the predetermined sentence or statement block associated with the software vulnerability Compile the sequence of instructions that jump list, the predetermined function associated with the software vulnerability or the combination of function compiling of generation form Compilation sequence signature, the predetermined sentence associated with the software vulnerability or the statement block compiling that row dis-assembling obtains form The obtained compilation sequence signature of command sequence dis-assembling；And the determining unit is further configured to：According to described soft The routing information of file where part leak determines that file where the software vulnerability is loaded into the ground in the internal memory of the terminal Location scope；Machine instruction in the address realm is converted into compilation sequence；Described in being searched in the compilation sequence changed Collect sequence signature, to determine position corresponding to the compilation sequence signature, wherein, position corresponding to the compilation sequence signature Including at least one of following：The position of code block, the letter corresponding to sequence signature that collects corresponding to the compilation sequence signature The position of component corresponding to several position, the compilation sequence signature, the reservations of component corresponding to the compilation sequence signature The position divided.

In certain embodiments, unit is repaired further to be configured to：Code revision by the position to be repaired is institute State compatibility code；Or the compatibility code is stored in the free memory space of the terminal, and the position that will be stored It is arranged to the jump location of position to be repaired；Or pass through the component where the static replacement software vulnerability of the compatibility code Or the predetermined portions of the component where the software vulnerability；Or by where the compatibility code modification software vulnerability The method description scheme body information of method is to replace the method where the software vulnerability.

In certain embodiments, the reparation unit is further configured to：In response to pre-programmed operation, pass through institute State compatibility code and repair the software vulnerability, wherein, the preset program includes at least one of following：Kernel program, for creating Build program, loading/linker program, the software vulnerability place program of program process.

In certain embodiments, the reparation unit is further configured to：When the preset program is kernel program, The content that the software vulnerability is repaired by the compatibility code is inserted into kernel module；When the preset program is non-core journey During sequence, preset program described in modifications or substitutions is described soft by compatibility code reparation to be added in the preset program The content of part leak；Or to the pre-programmed dependence item so that when the preset program starts, pass through the compatible generation Code repairs the software vulnerability；Or the content Dynamic injection of the software vulnerability will be repaired by the compatibility code described in In the process that preset program creates when performing.

In certain embodiments, the receiving unit is further configured to：The terminal is examined with the presence or absence of predetermined Software vulnerability；If it is, the acquisition that the reparation file of the software vulnerability is sent to the server is asked, wherein, it is described Request also includes the system information of the terminal；The software to match with the system information that the reception server is sent leaks The reparation file in hole.

The software vulnerability restorative procedure and device for terminal that the application provides, sent by the server received The reparation file of software vulnerability, determine position to be repaired corresponding to leak and search the information of compatible information instruction, will then look into The precalculated position that the information found is added to reparation code obtains compatibility code, finally by compatibility code patching bugs, realizes The hot repair of the software vulnerability of compatible distinct device is answered, and protects the safety of terminal device.

Brief description of the drawings

By reading the detailed description made to non-limiting example made with reference to the following drawings, the application's is other Feature, objects and advantages will become more apparent upon：

Fig. 1 is that the application can apply to exemplary system architecture figure therein；

Fig. 2 is the flow chart according to one embodiment of the software vulnerability restorative procedure for terminal of the application；

Fig. 3 is the schematic diagram according to an application scenarios of the software vulnerability restorative procedure for terminal of the application；

Fig. 4 is the flow chart according to another embodiment of the software vulnerability restorative procedure for terminal of the application；

Fig. 5 is the structural representation according to one embodiment of the software vulnerability prosthetic device for terminal of the application；

Fig. 6 is adapted for the structural representation for realizing the terminal device of the embodiment of the present application or the computer system of server Figure.

Embodiment

The application is described in further detail with reference to the accompanying drawings and examples.It is understood that this place is retouched The specific embodiment stated is used only for explaining related invention, rather than the restriction to the invention.It also should be noted that in order to Be easy to describe, illustrate only in accompanying drawing to about the related part of invention.

It should be noted that in the case where not conflicting, the feature in embodiment and embodiment in the application can phase Mutually combination.Describe the application in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

Fig. 1 shows the example system frame of the embodiment of the software vulnerability restorative procedure that can apply the application or device Structure 100.

As shown in figure 1, system architecture 100 can include terminal device 101,102,103, network 104 and server 105. Network 104 between terminal device 101,102,103 and server 105 provide transmission link medium.Network 104 can be with Including various connection types, such as wired, wireless transmission link or fiber optic cables etc..

User can be interacted with using terminal equipment 101,102,103 by network 104 with server 105, to receive or send out Send message etc..Various applications can be installed on terminal device 101,102,103, for example, the application of system tool class, instant messaging Class application, the application of browser class, searching class application, the application of word processing class etc..

Terminal device 101,102,103 can be the various electronic equipments that there may be software vulnerability, include but is not limited to Smart mobile phone, tablet personal computer, E-book reader, MP3 player (Moving Picture Experts Group Audio Layer III, dynamic image expert's compression standard audio aspect 3), MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image expert's compression standard audio aspect 4) player, pocket computer on knee and desk-top meter Calculation machine etc..

Server 105 can store multiple different disposal frameworks, different editions system software vulnerability reparation file, The reparation file that terminal device 101,102,103 can be given to send software vulnerability so that terminal device 101,102,103 is by repairing Multiple file carries out repair process to leak.

It should be understood that the number of the terminal device, network and server in Fig. 1 is only schematical.According to realizing need Will, can have any number of terminal device, network and server.

Fig. 2 is refer to, it illustrates the flow 200 of one embodiment of the software vulnerability restorative procedure according to the application. It should be noted that the software vulnerability restorative procedure that is provided of the embodiment of the present application typically by the terminal device 101 in Fig. 1, 102nd, 103 perform.This method comprises the following steps：

Step 201, the reparation file for the software vulnerability that the reception server is sent.

In the present embodiment, software vulnerability restorative procedure operation electronic equipment (such as Fig. 1 institutes thereon for terminal The terminal shown) the reparation file of software vulnerability can be received from server by wired connection mode or radio connection. Wherein, above-mentioned reparation file includes repairing code, location information and compatible information, and above-mentioned compatible information is used to indicate to above-mentioned Repair when code carries out compatible processing, it is necessary to be added to the information in the precalculated position of above-mentioned reparation code, above-mentioned location information is used In position to be repaired corresponding to the above-mentioned software vulnerability of instruction.The system information of above-mentioned terminal includes at least one of following：Above-mentioned end The system version information at end, the facility information of above-mentioned terminal, manufacturer's information of above-mentioned terminal, above-mentioned terminal kernel information, The processor information of above-mentioned terminal, the screen configuration information of terminal.The information of above-mentioned compatible information instruction includes following at least one ：Register use information, storehouse use information, perform address jump information, parameter information.

In the present embodiment, by taking android system as an example, above-mentioned software vulnerability can be in Android vulnerability informations storehouse The leak of issue.Leaky reparation source code, specific leak are prestored in above-mentioned server (such as server shown in Fig. 1) Difference, leak repairs source code and writes that the language that uses is different, and server can write language and end according to source code The system information at end is repaired source code to above-mentioned leak and is compiled, and above-mentioned reparation code is obtained, it is, for example, possible to use Android structure Build the similar compilation tool of (Android Build) system.Because the otherness between Android device is larger, compile what is obtained Repair code can not compatible each equipment, therefore also need to carry out compatible processing to repairing code, compatible processing mainly services Device end analyzes the information repaired in code on which position can be different because of the difference of equipment, then determine the letter on these positions The acquisition modes of breath so that server can obtain information on these positions by sending compatible information instruction terminal, and will These information, which are added to, repairs in code on corresponding position, and these information are probably register ID, storehouse balancing instructions, redirected Address, data etc..

In some optional implementations of the present embodiment, android system is divided into application layer, application program frame Rack-layer, system operation storehouse layer and Linux inner core, Java layers include a part and application program for application framework layer Layer, when above-mentioned software vulnerability is Java layer leaks, under Dalvik mechanism, above-mentioned reparation code can be compiled by Java language Write be used for repair the bytecode run in Java Virtual Machine that the program of above-mentioned software vulnerability compiles out, in ART Under (Android runtime, Android running environment) mechanism, above-mentioned reparation code can be the machine compiled out by above-mentioned bytecode Device instructs, because in ART environment, applies when installing first time, bytecode will be compiled into machine code in advance；When upper When to state software vulnerability be nation method Native layer leaks, above-mentioned reparation code includes being used to repair by what C/C++ language was write The machine instruction that the program of above-mentioned software vulnerability compiles out, machine instruction take the form of binary coding.

In some optional implementations of the present embodiment, the reparation text for the software vulnerability that above-mentioned the reception server is sent Part, including：Above-mentioned terminal is examined to whether there is predetermined software vulnerability；If it is, send above-mentioned software to above-mentioned server The acquisition request of the reparation file of leak, wherein, above-mentioned request also includes the system information of above-mentioned terminal；The reception server is sent The above-mentioned software vulnerability with said system information match reparation file.For example, instruction set corresponding to the CPU of different terminals Difference, its executable machine instruction are different, it is therefore desirable to send different reparation codes.File where different terminals leak Path may also be different, server can obtain where the above-mentioned leak of terminal of each manufacturer or each unit type in advance The path of file, can be according to manufacturer or unit type inquiry and the path of the file of terminal coupling with this.

Step 202, position to be repaired corresponding to the above-mentioned leak of location information instruction is determined.

In the present embodiment, the location information included based on the reparation file obtained in step 201, above-mentioned electronic equipment (such as terminal shown in Fig. 1) can determine position to be repaired corresponding to the above-mentioned leak of location information instruction.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned software vulnerability is Java layer leaks, above-mentioned location information also includes：It is predetermined with it is above-mentioned soft The title of class and the title of method of part leak association, and the predetermined method parameter number associated with above-mentioned software vulnerability With parameter type title；And position to be repaired corresponding to the above-mentioned software vulnerability of the above-mentioned above-mentioned location information instruction of determination, bag Include：The routing information of file, the title of above-mentioned class, the title of the above method, above method ginseng according to where above-mentioned software vulnerability Several number and above-mentioned parameter typonyms, by calling Java Virtual Machine interface to obtain the above method in above-mentioned Java Virtual Machine The method description scheme body in portion.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned reparation code is machine instruction, above-mentioned location information also include following binary features in extremely One item missing：The title of the predetermined component associated with above-mentioned software vulnerability, predetermined associated with above-mentioned software vulnerability Function title, the predetermined number of parameters associated with above-mentioned software vulnerability and parameter type, it is predetermined with it is upper State software vulnerability association function or combination of function compiling form command sequence binary features, it is predetermined with it is above-mentioned The binary features for the command sequence that the sentence of software vulnerability association or statement block compiling form；And the above-mentioned above-mentioned positioning of determination Position to be repaired corresponding to the above-mentioned software vulnerability of information instruction, including：The path of file is believed according to where above-mentioned software vulnerability Breath determines that file where above-mentioned software vulnerability is loaded into the address realm in the internal memory of above-mentioned terminal；In the range of address above mentioned Position where the above-mentioned binary features found is defined as treating corresponding to the above-mentioned software vulnerability of above-mentioned location information instruction Position is repaired, wherein, the position where above-mentioned binary features includes at least one of following：Generation where above-mentioned binary features It is the position of component where the position of function where the position of code block, above-mentioned binary features, above-mentioned binary features, above-mentioned The position of the predetermined portions of component where binary features.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned reparation code is machine instruction, above-mentioned location information also include by it is following compilation sequence signature in At least one of：The predetermined compilation that compiling is combined with the Fixed constant of above-mentioned software vulnerability association or Fixed constant and is formed Sequence, the predetermined function associated with above-mentioned software vulnerability or combination of function compile the compilation sequence formed, predefined The sentence associated with above-mentioned software vulnerability or the compilation sequence, predetermined with above-mentioned software vulnerability that forms of statement block compiling Jump list, the predetermined function associated with above-mentioned software vulnerability or the group of functions of sentence or statement block the compiling generation of association Compile in collaboration with compilation sequence signature, the predetermined language associated with above-mentioned software vulnerability that the command sequence dis-assembling translated obtains The compilation sequence signature that the command sequence dis-assembling that sentence or statement block compiling form obtains；And the above-mentioned above-mentioned location information of determination Position to be repaired corresponding to the above-mentioned software vulnerability indicated, including：The routing information of file is true according to where above-mentioned software vulnerability File where fixed above-mentioned software vulnerability is loaded into the address realm in the internal memory of above-mentioned terminal；By the machine in the range of address above mentioned Device instruction is converted to compilation sequence；Above-mentioned compilation sequence signature is searched in the compilation sequence changed, to determine above-mentioned compilation Position corresponding to sequence signature, wherein, position corresponding to above-mentioned compilation sequence signature includes at least one of following：Above-mentioned compilation sequence The position of code block corresponding to row feature, the position of function corresponding to above-mentioned compilation sequence signature, above-mentioned compilation sequence signature pair The position of the predetermined portions of component corresponding to the position for the component answered, above-mentioned compilation sequence signature.

Step 203, information and/or the utilization of above-mentioned compatible information instruction are searched in the context of above-mentioned position to be repaired The system information of the above-mentioned terminal obtained in advance and the system information and the information of above-mentioned compatible information instruction pre-set Corresponding relation searches the information of above-mentioned compatible information instruction.

In the present embodiment, based on the position to be repaired determined in step 202, above-mentioned electronic equipment (such as shown in Fig. 1 Terminal) information of above-mentioned compatible information instruction can be searched in the context of above-mentioned position to be repaired and/or is utilized and is obtained in advance The system information of the above-mentioned terminal taken and system information the corresponding of information with above-mentioned compatible information indicates pre-set are closed The information of above-mentioned compatible information instruction is searched by system.Server end can directly parse what leak in test machine was associated by testing The context of code is in a manner of determining the lookup of compatible processing information needed, or by dis-assembling engine dis-assembling context, The context after dis-assembling is parsed in a manner of determining the lookup of compatible processing information needed.Or the system information according to test machine Rule is found, establishes system information and compatible processing information needed corresponding relation.

Step 204, the precalculated position for the information found being added to above-mentioned reparation code obtains compatibility code.

In the present embodiment, the information based on the compatible information instruction found in step 203, above-mentioned electronic equipment (example Terminal as shown in Figure 1) precalculated position that the information found can be added to above-mentioned reparation code obtains compatibility code.By In the system information and context environmental that have considered terminal, above-mentioned compatibility can be directly performed on the virtual machine of terminal or terminal Code.It should be noted that " addition " above-mentioned in the application should not be construed as adding from scratch in the narrow sense, addition can also It is existing information on precalculated position, replaces already present information with information to be added, now can be regarded as " changing ".

Step 205, above-mentioned leak is repaired by above-mentioned compatibility code.

In the present embodiment, based on the compatibility code obtained in step 204, above-mentioned electronic equipment (such as the end shown in Fig. 1 End) above-mentioned leak can be repaired by above-mentioned compatibility code by the way of either statically or dynamically.Static state can be understood as by Change code in executable file, the code changed during such running paper will be loaded into the process space, for example, There is leak in some functional unit of android system, can statically replace the code or functional unit of whole functional unit In the part relevant with leak code.Dynamic can be understood as controlling it to go to perform spy when program will perform certain section of logic Determine code.In Android the mode such as injection (inject) and hook (hook) can be used by compatibility code patching bugs.

In some optional implementations of the present embodiment, repair above-mentioned software above by above-mentioned compatibility code and leak Hole, including：It is above-mentioned compatibility code by the code revision of above-mentioned position to be repaired；Or above-mentioned compatibility code is stored in above-mentioned In the free memory space of terminal, and the position stored is arranged to the jump location of position to be repaired；Or by above-mentioned The predetermined portions of component where the static above-mentioned software vulnerability of replacement of compatibility code or the component where above-mentioned software vulnerability；Or The method description scheme body information of the method where above-mentioned software vulnerability is changed by above-mentioned compatibility code to replace above-mentioned software Method where leak.

In some optional implementations of the present embodiment, repair above-mentioned software above by above-mentioned compatibility code and leak Hole, including：In response to pre-programmed operation, above-mentioned software vulnerability is repaired by above-mentioned compatibility code, wherein, above-mentioned predetermined journey Sequence includes at least one of following：Kernel program, the program for creating program process, loading/linker program, software leakage Program where hole.Pre-programmed operation is responded, entrance is with the addition of equivalent to for the execution of repair module.Repair module refers to use In the module that software vulnerability is repaired by compatibility code, different leaks are corresponding with different repair modules.Reparation is performed as control The module of the entrance of module can be named as reparation starting module, all repair module uniform registrations can be started into mould to reparation Block so that repair module can be scheduled execution.

It is above-mentioned in response to pre-programmed operation in some optional implementations of the present embodiment, by above-mentioned simultaneous Hold code and repair above-mentioned software vulnerability, including：When above-mentioned preset program is kernel program, will be repaired by above-mentioned compatibility code The content insertion kernel module of above-mentioned software vulnerability；When above-mentioned preset program is non-core program, modifications or substitutions are above-mentioned pre- Program is determined, to add the content that above-mentioned software vulnerability is repaired by above-mentioned compatibility code in above-mentioned preset program；Or to upper State pre-programmed dependence item so that when above-mentioned preset program starts, above-mentioned software vulnerability is repaired by above-mentioned compatibility code；Or What person created when the content Dynamic injection that above-mentioned software vulnerability is repaired by above-mentioned compatibility code is performed to above-mentioned preset program In process.

As an example, in Android, if (Executable and Linkable Format, can hold an ELF Row is with that can link form) file participation dynamic link, there will be one to contain Dynamic Section for its program header table The element of (dynamic part).The set-up mode for relying on item can be that repair module is compiled as into dynamic link library file, and modification is treated Addition relies on dynamic (dynamic) section of the component of item, and the DT_ of a dependence repair module is added in dynamic sections NEEDED items, or the characteristic according to Android connector (linker) program without using DT_SONAME items, change dynamic Section, its DT_SONAME item is changed to DT_NEEDED items and changes the file path that string table is repair module.Rely on item Set and can also be that some dependence component addition to the component of dependence item to be added relies on, make the group of dependence item to be added indirectly Part relies on the dynamic link library file that repair module is compiled into.

Can be incubator (Zygote) process for create program process as an example, in Android, Zygote is a virtual machine process, and whenever system requirements performs an Android application program, Zygote will be established (fork) subprocess is gone out to perform the application program.Modifications or substitutions Zygote configuration processor (app_ can be passed through Process programs), repaired with loading repair module.Loading/linker program can be linker programs, Android systems The executable file and dynamic link library file of the Native layers of system are loaded by linker programs.After changing linker programs Repair module can be performed before program where leak loads and is not carried out to be repaired.In Android, it can also change Lou System component where hole, the dependence item using repair module as system component where leak.When the uneasy whole assembly is loaded, Repair module is automatically loaded execution, it is ensured that the component that leak be present has been repaired before being executed.It is also possible to Kernel module is inserted, reparation is performed by kernel module, or involved by Dynamic injection to each leak including zygote And process so that these processes can actively perform reparation when running, while monitor these runnings state of a process, once this A little processes are restarted, and repair module will re-execute Dynamic injection to ensure its security to these processes.

With continued reference to Fig. 3, Fig. 3 is the application scenarios according to the software vulnerability restorative procedure for terminal of the present embodiment One schematic diagram.In Fig. 3 application scenarios, leak, which repairs framework 300, mainly includes management module 301 and leak reparation unit 302.Wherein, management module 301 is used for administrative vulnerability reparation unit 302.Leak repairs unit 302 and is responsible for specific leak reparation Work.Specifically, the effect of management module 301 includes：Remediation management, it is responsible for starting the reparation flow that leak repairs unit；More New management, it is responsible for renewal leak and repairs the modules in unit and repair code；Unloading management, it is responsible for the reparation of unloading leak and mends Fourth does not repair state to return to；Status tracking, it is responsible for the reparation state of tracking leak；System environments detects, and is responsible for detection system System version, equipment vendors, unit type, kernel information and other system informations.Leak, which repairs unit 302, to be included：Detection module, For examining predetermined leak presence or absence；Locating module, for determining to repair target, such as goal approach address, target generation Code block address and Java layer goal approach structures etc.；Context detection module, the contextual information of target is repaired for analyzing, These contextual informations include but is not limited to register use information, storehouse use information, binary code information；Compatible processing Module, system environmental information and target context information for being obtained according to management module do compatible processing to repairing code.

The reparation text for the software vulnerability that the method that above-described embodiment of the application provides is sent by the server received Part, determine position to be repaired corresponding to leak and search the information of compatible information instruction, be then added to the information found The precalculated position for repairing code obtains compatibility code, finally by compatibility code patching bugs, realizes compatible distinct device The hot repair of software vulnerability is answered, and protects the safety of terminal device.

With further reference to Fig. 4, it illustrates the flow of another embodiment of the software vulnerability restorative procedure for terminal 400.This is used for the flow 400 of the software vulnerability restorative procedure of terminal, comprises the following steps：

Step 401, the reparation file for the software vulnerability that the reception server is sent.

In the present embodiment, software vulnerability restorative procedure operation electronic equipment (such as Fig. 1 institutes thereon for terminal The terminal shown) the reparation file of software vulnerability can be received from server by wired connection mode or radio connection. Above-mentioned reparation file includes repairing code, location information and compatible information, and above-mentioned location information is used to indicate above-mentioned software leakage The routing information of file where position to be repaired corresponding to hole, including above-mentioned software vulnerability.Server can obtain each in advance The path of file where the above-mentioned leak of the terminal of manufacturer or each unit type, can be looked into this according to manufacturer or unit type Ask the path with the file of terminal coupling.Server can also pass through to the title of the file where terminal transmission leak, terminal The path of the name acquiring file of search file.

Step 402, the routing information of file according to where software vulnerability determines that file where above-mentioned software vulnerability is loaded To the address realm in the internal memory of above-mentioned terminal.

In the present embodiment, the road of file where the software vulnerability included based on the reparation file obtained in step 401 Footpath information, above-mentioned electronic equipment (such as terminal shown in Fig. 1) can determine that file where above-mentioned software vulnerability is loaded into State the address realm in the internal memory of terminal.

Step 403, the routing information of file, the title of class, the title of method, method parameter according to where software vulnerability Number and parameter type title, by calling Java Virtual Machine interface to obtain method of the above method inside above-mentioned Java Virtual Machine Description scheme body.

In the present embodiment, based on the address realm obtained in step 402, and predetermined and above-mentioned software vulnerability The title of the class of association and the title of method, and the predetermined method parameter number and parameter associated with above-mentioned software vulnerability Typonym, above-mentioned electronic equipment (such as terminal shown in Fig. 1) can when above-mentioned software vulnerability is Java layer leaks, according to The routing information of file where above-mentioned software vulnerability, the title of above-mentioned class, the title of the above method, above method number of parameters and Above-mentioned parameter typonym, by calling Java Virtual Machine interface to obtain method of the above method inside above-mentioned Java Virtual Machine Description scheme body.Methods described description scheme body is complicated target to be repaired, it is understood that is position to be repaired.Deposited in Java It is a part for heap in a method area.In the inside of a virtual machine instance, type information is stored in one and is referred to as method In the internal memory logic area in area.Type information is extracted from class file by Classloader when class loads.Class (static state) Variable also is stored in method area.

Step 404, it is above-mentioned fixed the position where the above-mentioned binary features found in the range of address above mentioned to be defined as Position to be repaired corresponding to the above-mentioned software vulnerability of position information instruction.

In the present embodiment, based on the address realm obtained in step 402, above-mentioned electronic equipment (such as the end shown in Fig. 1 End) can be when above-mentioned reparation code be machine instruction, by where the above-mentioned binary features found in the range of address above mentioned Position be defined as position to be repaired corresponding to the above-mentioned software vulnerability of above-mentioned location information instruction.Binary features are included in State in location information, binary features include at least one of following：The predetermined component associated with above-mentioned software vulnerability Title, the title of the predetermined function associated with above-mentioned software vulnerability, predetermined associated with above-mentioned software vulnerability The instruction that number of parameters and parameter type, the predetermined function associated with above-mentioned software vulnerability or combination of function compiling form The command sequence that the binary features of sequence, the predetermined sentence associated with above-mentioned software vulnerability or statement block compiling form Binary features.Wherein, the position where above-mentioned binary features includes at least one of following：Where above-mentioned binary features The position of code block, the position of function where above-mentioned binary features, component where above-mentioned binary features position, The position of the predetermined portions of component where above-mentioned binary features.Above-mentioned binary features refer to some binary numbers fixed According to block or data block combinations

Step 405, the machine instruction in the range of address above mentioned is converted into compilation sequence.

In the present embodiment, based on the address realm obtained in step 402, above-mentioned electronic equipment (such as the end shown in Fig. 1 End) machine instruction in the range of address above mentioned can be converted into compilation sequence when above-mentioned reparation code is machine instruction.

Step 406, above-mentioned compilation sequence signature is searched in the compilation sequence changed, to determine that above-mentioned compilation sequence is special Position corresponding to sign.

In the present embodiment, based on the compilation sequence being converted in step 405, above-mentioned electronic equipment (such as shown in Fig. 1 Terminal) above-mentioned compilation sequence signature can be searched in the compilation sequence changed, to determine above-mentioned compilation sequence signature pair The position answered, and as position to be repaired.Wherein, above-mentioned location information is also included in following compilation sequence signature at least One：The Fixed constant or Fixed constant of the predetermined association with above-mentioned software vulnerability combine compile form compilation sequence, The predetermined function associated with above-mentioned software vulnerability or combination of function compiling form compilation sequence, it is predetermined with it is upper State the sentence of software vulnerability association or compilation sequence that statement block compiling forms, predetermined associate with above-mentioned software vulnerability The sentence or jump list of statement block compiling generation, the predetermined function associated with above-mentioned software vulnerability or combination of function compiling Compilation sequence signature that the command sequence dis-assembling formed obtains, the predetermined sentence or language associated with above-mentioned software vulnerability The compilation sequence signature that the command sequence dis-assembling that sentence block compiling forms obtains.For example, multiple conditional branchings (switch-case) The command sequence and jump list of sentence compiling generation.Position corresponding to above-mentioned compilation sequence signature includes at least one of following：On State the position of code block corresponding to compilation sequence signature, the position of function corresponding to above-mentioned compilation sequence signature, above-mentioned compilation sequence The position of component corresponding to row feature, component corresponding to above-mentioned compilation sequence signature predetermined portions position.The sequence that collects is special Position corresponding to sign can be to look for collect sequence signature where position correspondence machine instruction position.

Step 407, information and/or the utilization of above-mentioned compatible information instruction are searched in the context of above-mentioned position to be repaired The system information of the above-mentioned terminal obtained in advance and the system information and the information of above-mentioned compatible information instruction pre-set Corresponding relation searches the information of above-mentioned compatible information instruction.

In the present embodiment, based on the position to be repaired determined in step 403, step 404 or step 406, above-mentioned electronics Equipment (such as terminal shown in Fig. 1) can search the letter of above-mentioned compatible information instruction in the context of above-mentioned position to be repaired The system information for ceasing and/or utilizing the system information of the above-mentioned terminal obtained in advance and pre-set refers to above-mentioned compatible information The corresponding relation for the information shown searches the information of above-mentioned compatible information instruction.

Step 408, the precalculated position for the information found being added to above-mentioned reparation code obtains compatibility code.

In the present embodiment, the information based on the compatible information instruction found in step 407, above-mentioned electronic equipment (example Terminal as shown in Figure 1) precalculated position that the information found can be added to above-mentioned reparation code obtains compatibility code.

Step 409, above-mentioned leak is repaired by above-mentioned compatibility code.

In the present embodiment, based on the compatibility code obtained in step 408, above-mentioned electronic equipment (such as the end shown in Fig. 1 End) above-mentioned leak can be repaired by above-mentioned compatibility code.

Figure 4, it is seen that compared with embodiment corresponding to Fig. 2, the software vulnerability for terminal in the present embodiment The flow 400 of restorative procedure highlights the step of position to be repaired corresponding to the leak for determining location information instruction.Thus, this reality Position to be repaired can more flexibly be determined by applying the scheme of example description, realize the more accurate of compatible distinct device different levels Leak reparation, preferably protect the safety of terminal device.

With further reference to Fig. 5, as the realization to method shown in above-mentioned each figure, this application provides a kind of for terminal One embodiment of software vulnerability prosthetic device, the device embodiment is corresponding with the embodiment of the method shown in Fig. 2, device tool Body can apply in various electronic equipments.

As shown in figure 5, the above-mentioned software vulnerability prosthetic device 500 for terminal of the present embodiment includes：Receiving unit 501st, determining unit 502, searching unit 503, adding device 504 and reparation unit 505.Wherein, receiving unit 501, configuration are used In the reception server send software vulnerability reparation file, wherein, above-mentioned reparation file include repair code, location information with And compatible information, it is necessary to be added to above-mentioned repair when above-mentioned compatible information is used to indicate to above-mentioned reparation code progress compatible processing The information in the precalculated position of multiplexed code；Determining unit 502, it is configured to determine the above-mentioned software vulnerability of above-mentioned location information instruction Corresponding position to be repaired；Searching unit 503, it is configured to search above-mentioned compatible letter in the context of above-mentioned position to be repaired Cease instruction information and/or using the system information of above-mentioned terminal obtained in advance and the system information pre-set with it is above-mentioned The corresponding relation of the information of compatible information instruction searches the information of above-mentioned compatible information instruction；Adding device 504, be configured to by The precalculated position that the information found is added to above-mentioned reparation code obtains compatibility code；Unit 505 is repaired, is configured to Above-mentioned compatibility code repairs above-mentioned software vulnerability.

In the present embodiment, for receiving unit 501 in the software vulnerability prosthetic device 500 of terminal, determining unit 502, Searching unit 503, adding device 504 and repair unit 505 specific processing can be corresponded to referring to Fig. 2 step 201 in embodiment, The associated description of the implementation of step 202, step 203 step 204 and step 205, will not be repeated here.

It is above-mentioned to repair when above-mentioned software vulnerability is Java layer leaks in some optional implementations of the present embodiment What the program for being used to repair above-mentioned software vulnerability that multiplexed code includes being write by Java language compiled out transports in Java Virtual Machine Capable bytecode, or the machine instruction compiled out by above-mentioned bytecode；When above-mentioned software vulnerability leaks for nation method Native layers During hole, above-mentioned reparation code includes the machine for being used to repair the program of above-mentioned software vulnerability and compiling out write by C/C++ language Instruction.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned software vulnerability is Java layer leaks, above-mentioned location information also includes：It is predetermined with it is above-mentioned soft The title of class and the title of method of part leak association, and the predetermined method parameter number associated with above-mentioned software vulnerability With parameter type title；And above-mentioned determining unit 502 is further configured to：The road of file according to where above-mentioned software vulnerability Footpath information, the title of above-mentioned class, the title of the above method, above method number of parameters and above-mentioned parameter typonym, pass through tune Method description scheme body of the above method inside above-mentioned Java Virtual Machine is obtained with Java Virtual Machine interface.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned software vulnerability is Native layer leaks, above-mentioned location information also include following binary features in At least one of：The routing information of file where above-mentioned location information includes above-mentioned software vulnerability, when above-mentioned reparation code is machine When device instructs, above-mentioned location information also includes at least one in following binary features：It is predetermined to be leaked with above-mentioned software The title of component of hole association, the title of the predetermined function associated with above-mentioned software vulnerability, it is predetermined with it is above-mentioned The number of parameters and parameter type of software vulnerability association, the predetermined function associated with above-mentioned software vulnerability or combination of function Compile binary features, the predetermined sentence associated with above-mentioned software vulnerability or the statement block compiling of the command sequence formed The binary features of the command sequence formed；And above-mentioned determining unit 502 is further configured to：According to above-mentioned software vulnerability The routing information of place file determines that file where above-mentioned software vulnerability is loaded into the address realm in the internal memory of above-mentioned terminal； Position where the above-mentioned binary features found in the range of address above mentioned is defined as the above-mentioned of above-mentioned location information instruction Position to be repaired corresponding to software vulnerability, wherein, the position where above-mentioned binary features includes at least one of following：Above-mentioned two Position, the above-mentioned binary features place of function where the position of code block where system feature, above-mentioned binary features The position of component, component where above-mentioned binary features predetermined portions position.

In some optional implementations of the present embodiment, above-mentioned location information includes file where above-mentioned software vulnerability Routing information, when above-mentioned reparation code is machine instruction, above-mentioned location information also include by it is following compilation sequence signature in At least one of：The predetermined compilation that compiling is combined with the Fixed constant of above-mentioned software vulnerability association or Fixed constant and is formed Sequence, the predetermined function associated with above-mentioned software vulnerability or combination of function compile the compilation sequence formed, predefined The sentence associated with above-mentioned software vulnerability or the compilation sequence, predetermined with above-mentioned software vulnerability that forms of statement block compiling Jump list, the predetermined function associated with above-mentioned software vulnerability or the group of functions of sentence or statement block the compiling generation of association Compile in collaboration with compilation sequence signature, the predetermined language associated with above-mentioned software vulnerability that the command sequence dis-assembling translated obtains The compilation sequence signature that the command sequence dis-assembling that sentence or statement block compiling form obtains；And above-mentioned determining unit 502 enters one Step is configured to：The routing information of file according to where above-mentioned software vulnerability determines that file where above-mentioned software vulnerability is loaded into Address realm in the internal memory of above-mentioned terminal；Machine instruction in the range of address above mentioned is converted into compilation sequence；Changed Compilation sequence in search above-mentioned compilation sequence signature, to determine position corresponding to above-mentioned compilation sequence signature, wherein, above-mentioned remittance Position corresponding to sequence signature is compiled including at least one of following：It is the position of code block corresponding to above-mentioned compilation sequence signature, above-mentioned Collect the position of function corresponding to sequence signature, the position of component corresponding to above-mentioned compilation sequence signature, above-mentioned compilation sequence spy The position of the predetermined portions of component corresponding to sign.

In some optional implementations of the present embodiment, above-mentioned reparation unit 505 is further configured to：Will be above-mentioned The code revision of position to be repaired is above-mentioned compatibility code；Or above-mentioned compatibility code is stored in the free memory of above-mentioned terminal In space, and the position stored is arranged to the jump location of position to be repaired；Or replaced by above-mentioned compatibility code static state Change the predetermined portions for stating the component where software vulnerability or the component where above-mentioned software vulnerability；Or pass through above-mentioned compatible generation Code changes the method description scheme body information of the method where above-mentioned software vulnerability to replace the method where above-mentioned software vulnerability.

In some optional implementations of the present embodiment, above-mentioned reparation unit 505 is further configured to：In response to Pre-programmed operation, above-mentioned software vulnerability is repaired by above-mentioned compatibility code, wherein, above-mentioned preset program include it is following at least One：Program where kernel program, the program for creating program process, loading/linker program, software vulnerability.

In some optional implementations of the present embodiment, above-mentioned reparation unit 505 is further configured to：When above-mentioned When preset program is kernel program, the content that above-mentioned software vulnerability is repaired by above-mentioned compatibility code is inserted into kernel module；When When above-mentioned preset program is non-core program, the above-mentioned preset program of modifications or substitutions, passed through with being added in above-mentioned preset program Above-mentioned compatibility code repairs the content of above-mentioned software vulnerability；Or to above-mentioned pre-programmed dependence item so that above-mentioned predetermined journey When sequence starts, above-mentioned software vulnerability is repaired by above-mentioned compatibility code；Or above-mentioned software will be repaired by above-mentioned compatibility code In the process that the content Dynamic injection of leak creates when being performed to above-mentioned preset program.

In some optional implementations of the present embodiment, above-mentioned receiving unit 501 is further configured to：In inspection State terminal and whether there is predetermined software vulnerability；If it is, the reparation file of above-mentioned software vulnerability is sent to above-mentioned server Acquisition request, wherein, above-mentioned request also includes the system information of above-mentioned terminal；What the reception server was sent believes with said system The reparation file of the above-mentioned software vulnerability of manner of breathing matching.

Below with reference to Fig. 6, it illustrates suitable for for realizing the knot of the computer system 600 of the terminal of the embodiment of the present application Structure schematic diagram.

As shown in fig. 6, computer system 600 includes CPU (CPU) 601, it can be read-only according to being stored in Program in memory (ROM) 602 or be loaded into program in random access storage device (RAM) 603 from storage part 608 and Perform various appropriate actions and processing.In RAM 603, also it is stored with system 600 and operates required various programs and data. CPU 601, ROM 602 and RAM 603 are connected with each other by bus 604.Input/output (I/O) interface 605 is also connected to always Line 604.

I/O interfaces 605 are connected to lower component：Importation 606 including keyboard, mouse etc.；Penetrated including such as negative electrode The output par, c 607 of spool (CRT), liquid crystal display (LCD) etc. and loudspeaker etc.；Storage part 608 including hard disk etc.； And the communications portion 609 of the NIC including LAN card, modem etc..Communications portion 609 via such as because The network of spy's net performs communication process.Driver 610 is also according to needing to be connected to I/O interfaces 605.Detachable media 611, such as Disk, CD, magneto-optic disk, semiconductor memory etc., it is arranged on as needed on driver 610, in order to read from it Computer program be mounted into as needed storage part 608.

Especially, in accordance with an embodiment of the present disclosure, it may be implemented as computer above with reference to the process of flow chart description Software program.For example, embodiment of the disclosure includes a kind of computer program product, it includes being tangibly embodied in machine readable Computer program on medium, the computer program include the program code for being used for the method shown in execution flow chart.At this In the embodiment of sample, the computer program can be downloaded and installed by communications portion 609 from network, and/or from removable Medium 611 is unloaded to be mounted.When the computer program is performed by CPU (CPU) 601, perform in the present processes The above-mentioned function of limiting.

Flow chart and block diagram in accompanying drawing, it is illustrated that according to the system of the various embodiments of the application, method and computer journey Architectural framework in the cards, function and the operation of sequence product.At this point, each square frame in flow chart or block diagram can generation The part of one module of table, program segment or code, a part for the module, program segment or code include one or more For realizing the executable instruction of defined logic function.It should also be noted that some as replace realization in, institute in square frame The function of mark can also be with different from the order marked in accompanying drawing generation.For example, two square frames succeedingly represented are actual On can perform substantially in parallel, they can also be performed in the opposite order sometimes, and this is depending on involved function.Also It is noted that the combination of each square frame and block diagram in block diagram and/or flow chart and/or the square frame in flow chart, Ke Yiyong Function as defined in execution or the special hardware based system of operation are realized, or can be referred to specialized hardware and computer The combination of order is realized.

Being described in unit involved in the embodiment of the present application can be realized by way of software, can also be by hard The mode of part is realized.Described unit can also be set within a processor, for example, can be described as：A kind of processor bag Include receiving unit, determining unit, searching unit, adding device and repair unit.Wherein, the title of these units is in certain situation Under do not form restriction to the unit in itself, for example, receiving unit is also described as the " software that the reception server is sent The unit of the reparation file of leak ".

As on the other hand, present invention also provides a kind of nonvolatile computer storage media, the non-volatile calculating Machine storage medium can be the nonvolatile computer storage media included in device described in above-described embodiment；Can also be Individualism, without the nonvolatile computer storage media in supplying terminal.Above-mentioned nonvolatile computer storage media is deposited One or more program is contained, when one or more of programs are performed by an equipment so that the equipment：From letter Cease the input information that input terminal receives user；Scan for operating based on the input information, obtain search result information；Base One or more in the following item of information determine information output terminals：The reparation text for the software vulnerability that the reception server is sent Part, wherein, the reparation file includes repairing code, location information and compatible information, and the compatible information is used for instruction pair It is described to repair when code carries out compatible processing, it is necessary to be added to the information in the precalculated position of the reparation code；It is described fixed to determine Position to be repaired corresponding to the software vulnerability of position information instruction；Searched in the context of the position to be repaired described simultaneous Hold information instruction information and/or using the system information of the terminal obtained in advance and the system information pre-set with The corresponding relation of the information of the compatible information instruction searches the information of the compatible information instruction；The information found is added Compatibility code is obtained to the precalculated position of the reparation code；The software vulnerability is repaired by the compatibility code.

Above description is only the preferred embodiment of the application and the explanation to institute's application technology principle.People in the art Member should be appreciated that invention scope involved in the application, however it is not limited to the technology that the particular combination of above-mentioned technical characteristic forms Scheme, while should also cover in the case where not departing from the inventive concept, carried out by above-mentioned technical characteristic or its equivalent feature The other technical schemes for being combined and being formed.Such as features described above has similar work(with (but not limited to) disclosed herein The technical scheme that the technical characteristic of energy is replaced mutually and formed.

Claims

1. a kind of software vulnerability restorative procedure for terminal, it is characterised in that methods described includes：

The reparation file for the software vulnerability that the reception server is sent, wherein, the reparation file includes repairing code, location information And compatible information, it is necessary to be added to described when the compatible information is used to indicate to carry out compatible processing to the reparation code Repair the information in the precalculated position of code；

Determine position to be repaired corresponding to the software vulnerability of the location information instruction；

The information of the compatible information instruction is searched in the context of the position to be repaired and/or utilizes the institute obtained in advance The corresponding relation of the system information and the information of compatible information instruction stating the system information of terminal and pre-set is searched The information of the compatible information instruction；

The precalculated position that the information found is added to the reparation code obtains compatibility code；

The software vulnerability is repaired by the compatibility code.

2. according to the method for claim 1, it is characterised in that described to repair when the software vulnerability is Java layer leaks What the program for being used to repair the software vulnerability that multiplexed code includes being write by Java language compiled out transports in Java Virtual Machine Capable bytecode, or the machine instruction compiled out by the bytecode；When the software vulnerability leaks for nation method Native layers During hole, the machine for being used to repair the program of the software vulnerability and compiling out repaired code and include being write by C/C++ language Instruction.

3. according to the method for claim 2, it is characterised in that the location information includes file where the software vulnerability Routing information, when the software vulnerability is Java layer leaks, the location information also includes：It is predetermined with it is described soft The title of class and the title of method of part leak association, and the predetermined method parameter number associated with the software vulnerability With parameter type title；And

Position to be repaired corresponding to the software vulnerability for determining the location information instruction, including：

The routing information of file, the title of the class, the title of methods described, methods described ginseng according to where the software vulnerability Several numbers and the parameter type title, by calling Java Virtual Machine interface to obtain methods described in the Java Virtual Machine The method description scheme body in portion.

4. according to the method any one of claim 1-3, it is characterised in that the location information is leaked including the software The routing information of file where hole, when the reparation code is machine instruction, the location information also includes following binary system At least one of in feature：The title of the predetermined component associated with the software vulnerability, it is predetermined with it is described soft It is title, the predetermined number of parameters associated with the software vulnerability and the parameter type of the function of part leak association, advance It is the binary features for the command sequence that function associate with the software vulnerability or the combination of function compiling determined forms, true in advance The binary features for the command sequence that the fixed sentence associated with the software vulnerability or statement block compiling form；And

The routing information of file according to where the software vulnerability determines that file where the software vulnerability is loaded into the end Address realm in the internal memory at end；

Position where the binary features that will be found in the address realm is defined as the location information instruction Position to be repaired corresponding to the software vulnerability, wherein, the position where the binary features includes at least one of following：Institute State the position of the function where the position of the code block where binary features, the binary features, the binary features The position of the predetermined portions of component where the position of the component at place, the binary features.

5. according to the method any one of claim 1-3, it is characterised in that the location information is leaked including the software The routing information of file where hole, when the reparation code is machine instruction, the location information also includes by following compilation At least one of in sequence signature：It is predetermined to combine compiling with the Fixed constant of software vulnerability association or Fixed constant The compilation sequence that compilation sequence, the predetermined function associated with the software vulnerability or the combination of function compiling formed forms Row, predetermined sentence associate with the software vulnerability or statement block compile form compilation sequence, it is predetermined and The sentence of software vulnerability association or the jump list of statement block compiling generation, predetermined associated with the software vulnerability Compilation sequence signature, the predetermined and software that the command sequence dis-assembling that function or combination of function compiling form obtains The compilation sequence signature that the command sequence dis-assembling that the sentence of leak association or statement block compiling form obtains；And

Machine instruction in the address realm is converted into compilation sequence；

The compilation sequence signature is searched in the compilation sequence changed, to determine position corresponding to the compilation sequence signature Put, wherein, position corresponding to the compilation sequence signature includes at least one of following：Code corresponding to the compilation sequence signature The position of function, the collect position of component, the institute corresponding to sequence signature corresponding to the position of block, the compilation sequence signature State the position of the predetermined portions of component corresponding to compilation sequence signature.

6. according to the method any one of claim 1-3, it is characterised in that described to repair institute by the compatibility code Software vulnerability is stated, including：

It is the compatibility code by the code revision of the position to be repaired；Or

The compatibility code is stored in the free memory space of the terminal, and the position stored is arranged to be repaired The jump location of position；Or

Pass through the static component replaced where the software vulnerability of the compatibility code or the component where the software vulnerability Predetermined portions；Or

It is described to replace by the method description scheme body information of the method where the compatibility code modification software vulnerability Method where software vulnerability.

7. according to the method any one of claim 1-3, it is characterised in that described to repair institute by the compatibility code Software vulnerability is stated, including：

In response to pre-programmed operation, the software vulnerability is repaired by the compatibility code, wherein, the preset program bag Include at least one of following：Kernel program, the program for creating program process, loading/linker program, software vulnerability institute In program.

8. according to the method for claim 7, it is characterised in that it is described in response to pre-programmed operation, by described simultaneous Hold code and repair the software vulnerability, including：

When the preset program is kernel program, by the content insertion that the software vulnerability is repaired by the compatibility code Core module；

When the preset program is non-core program, preset program described in modifications or substitutions, to add in the preset program Enter the content that the software vulnerability is repaired by the compatibility code；Or to the pre-programmed dependence item so that described When preset program starts, the software vulnerability is repaired by the compatibility code；Or institute will be repaired by the compatibility code State in the process created when the content Dynamic injection of software vulnerability performs to the preset program.

9. according to the method any one of claim 1-3, it is characterised in that the software leakage that the reception server is sent The reparation file in hole, including：

The terminal is examined to whether there is predetermined software vulnerability；

If it is, the acquisition that the reparation file of the software vulnerability is sent to the server is asked, wherein, the request is also Include the system information of the terminal；

The reparation file for the software vulnerability to match with the system information that the reception server is sent.

10. a kind of software vulnerability prosthetic device for terminal, it is characterised in that described device includes：

Receiving unit, the reparation file of the software vulnerability of the reception server transmission is configured to, wherein, the reparation file includes Code, location information and compatible information are repaired, the compatible information is used to indicate to carry out compatible processing to the reparation code When, it is necessary to be added to it is described reparation code precalculated position information；

Determining unit, it is configured to determine position to be repaired corresponding to the software vulnerability of the location information instruction；

Searching unit, be configured to search in the context of the position to be repaired the compatible information instruction information and/ Or the system information using the terminal obtained in advance and the system information pre-set and compatible information instruction The corresponding relation of information searches the information of the compatible information instruction；

Adding device, the precalculated position that the information for being configured to find is added to the reparation code obtain compatibility code；

Unit is repaired, the compatibility code is configured to and repairs the software vulnerability.

11. device according to claim 10, it is characterised in that described when the software vulnerability is Java layer leaks Repairing code includes being used to repair that the program of the software vulnerability to compile out in Java Virtual Machine by what Java language was write The bytecode of operation, or the machine instruction compiled out by the bytecode；When the software vulnerability is nation method Native layers During leak, the machine for being used to repair the program of the software vulnerability and compiling out repaired code and include being write by C/C++ language Device instructs.

12. device according to claim 11, it is characterised in that the location information includes text where the software vulnerability The routing information of part, when the software vulnerability is Java layer leaks, the location information also includes：It is predetermined with it is described The title of class and the title of method of software vulnerability association, and the predetermined method parameter associated with the software vulnerability Number and parameter type title；And

The determining unit is further configured to：The routing information of file, the name of the class according to where the software vulnerability Title, the title of methods described, methods described number of parameters and the parameter type title, by calling Java Virtual Machine interface to obtain Take method description scheme body of the methods described inside the Java Virtual Machine.

13. according to the device any one of claim 10-12, it is characterised in that the location information includes described soft The routing information of file where part leak, when the reparation code is machine instruction, the location information also includes following two At least one of in system feature：The title of the predetermined component associated with the software vulnerability, predetermined and institute State software vulnerability association function title, the predetermined number of parameters associated with the software vulnerability and parameter type, It is the binary features for the command sequence that the predetermined function associated with the software vulnerability or combination of function compiling form, pre- The binary features for the command sequence that the sentence associated with the software vulnerability or the statement block compiling first determined forms；And

The determining unit is further configured to：The routing information of file determines the software according to where the software vulnerability File where leak is loaded into the address realm in the internal memory of the terminal；Described two will found in the address realm Position where system feature is defined as position to be repaired corresponding to the software vulnerability of the location information instruction, wherein, Position where the binary features includes at least one of following：The position of code block where the binary features, institute State position, the binary features institute of the component where the position of the function where binary features, the binary features Component predetermined portions position.

14. according to the device any one of claim 10-12, it is characterised in that the location information includes described soft The routing information of file where part leak, when the reparation code is machine instruction, the location information also includes by following At least one of in compilation sequence signature：It is predetermined to be combined with the Fixed constant of software vulnerability association or Fixed constant Compile the compilation that the compilation sequence formed, the predetermined function associated with the software vulnerability or combination of function compiling form The compilation sequence, predetermined that sequence, the predetermined sentence associated with the software vulnerability or statement block compiling form The jump list of sentence or statement block the compiling generation associated with the software vulnerability, predetermined associated with the software vulnerability Function or the command sequence dis-assembling that forms of combination of function compiling obtain compilation sequence signature, it is predetermined with it is described soft The compilation sequence signature that the command sequence dis-assembling that the sentence of part leak association or statement block compiling form obtains；And

The determining unit is further configured to：The routing information of file determines the software according to where the software vulnerability File where leak is loaded into the address realm in the internal memory of the terminal；Machine instruction in the address realm is changed For the sequence that collects；The compilation sequence signature is searched in the compilation sequence changed, to determine the compilation sequence signature pair The position answered, wherein, position corresponding to the compilation sequence signature includes at least one of following：The compilation sequence signature is corresponding The position of code block, the position of function corresponding to the compilation sequence signature, component corresponding to the compilation sequence signature The position of the predetermined portions of component corresponding to position, the compilation sequence signature.

15. according to the device any one of claim 10-12, it is characterised in that repair unit and be further configured to：

16. according to the device any one of claim 10-12, it is characterised in that the reparation unit further configures For：

17. device according to claim 16, it is characterised in that the reparation unit is further configured to：

18. according to the device any one of claim 10-12, it is characterised in that the receiving unit further configures For：