CN109828758A - A kind of analytic method of SO file - Google Patents
A kind of analytic method of SO file Download PDFInfo
- Publication number
- CN109828758A CN109828758A CN201811478041.6A CN201811478041A CN109828758A CN 109828758 A CN109828758 A CN 109828758A CN 201811478041 A CN201811478041 A CN 201811478041A CN 109828758 A CN109828758 A CN 109828758A
- Authority
- CN
- China
- Prior art keywords
- file
- section
- header
- area
- offset
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
A kind of analytic method of SO file, comprising the following steps: open SO file, SO file is read into memory；Obtain the Elf32_Ehdr of SO file；The FILE_HEADER of SO file is parsed；The SECTION_HEADER of SO file is parsed；The PROGRAM_HEADERS of SO file is parsed；The DYNAMIC_SETCION of SO file is parsed；The RELOC_SECTION of SO file is parsed；The SYMBOL_TABLE of SO file is parsed.The analytic method of SO file of the invention can successively parse the content in SO file, so that resolving is more quick and easy, operate convenient for user.
Description
Technical field
The present invention relates to the file format field of (SuSE) Linux OS and Android mobile platform, more particularly to
The safety problem of Android mobile platform SO dynamic link library file.
Background technique
ELF (Executable and Linking Format) file type is a kind of format of obj ect file, is used for
It defines and has all put what content in different types of obj ect file (Object files) and all gone to put with which type of format
These contents.It is accepted extensively by unix system from most occurring early in System V system, as default binary system
File format come using.It can be said that ELF is one of the basis for constituting numerous unix systems.
There are three types of types for ELF file:
1. the obj ect file (Relocatable file) of relocatable is collected by assembler and generates " .o " file；
2. executable obj ect file (Executable file), executable application programs；
3. obj ect file (the Shared object file) dynamic library file that can be shared, i.e. " .so " file.
Reverse-engineering (also known as reversal technique) is a kind of product design technology reproducing processes, i.e., to a target product into
Row conversed analysis and research, thus process flow, institutional framework, functional characteristic and the technical specification etc. deducing and obtain the product
Design element.Parsing for ELF file, most complicated is native layers, that is, the parsing of SO file.
With the safe ever more important of android system, the executable file reinforcing with traditional pc safety, using reinforcing
It is a very important ring in android system safety.
Android can be divided into dex using reinforcing and reinforce with Native reinforcing at present, and the protected object that Native is reinforced is
Native layers of SO file, using shell adding, anti-debug, obscure, the means such as VM increase the decompiling difficulty of SO file.It is most main at present
The SO file protection scheme of stream is encryption technology, and in the art of attack and defense field of SO file shell adding and shelling, most basic is pair
In the understanding and parsing of SO file format.
And in the prior art to the parsing of SO file there is speed is slow, the problem of resolving complexity.
Summary of the invention
In order to solve the shortcomings of the prior art, it is an object of the invention to can provide a kind of parsing side of SO file
Method, allow user more quickly, simply understand SO file, and SO file is parsed.
To achieve the above object, the analytic method of a kind of SO file provided by the invention, comprising the following steps:
1) SO file is opened, SO file is read into memory；
2) Elf32_Ehdr of SO file is obtained；
3) FILE_HEADER of SO file is parsed；
4) SECTION_HEADER of SO file is parsed；
5) PROGRAM_HEADERS of SO file is parsed；
6) DYNAMIC_SETCION of SO file is parsed；
7) RELOC_SECTION of SO file is parsed；
8) SYMBOL_TABLE of SO file is parsed.
Further, in the step 2, the e_ident attribute of elf_header, is read first in acquisition SO file
Enter into mark array, according to the EI_CLASS of e_ident attribute, judges that this SO file is 32 files or is 64 texts
Part；The file internal pointer of SO file is reset to the starting position of file, is obtained in Elf32_Ehdr whole in SO file
Hold, defines the object elf_header of Elf32_Ehdr type, the Elf32_Ehdr assignment that will acquire to object elf_header
In.
Further, in the step 3), EI_MAG0, EI_ in elf_header in e_ident attribute are first determined whether
Whether MAG1, EI_MAG2, EI_MAG3 meet the magic number of ELF file；EI_CLASS, file destination version E_ are obtained later
Offset E_PHOFF, the SO file of the program header table of virtual address E_ENTRY, the SO file of VERSION, SO file
Save size E_EHSIZE, the program head table of flags, SO top of file of offset E_SHOFF, the SO file of area's header table
The list item size E_PHENTSIZE of lattice, obtain SO file program header table list item number E_PHNUM, SO file section
List item number E_SHNUM and the SO text of section area's header table of list item size E_SHENTSIZE, the SO file of area's header table
The index E_SHSTRNDX of the relevant list item of the area header table Zhong Yujie, the area Jian Jie name character string list.
Further, in the step 4), the number and SECTION_HEADER phase of SECTION_HEADER are obtained first
For the offset of the initial position of SO file；It is obtained in SECTION_HEADER according to the number of acquisition and offset later
Hold, defines the object section_headers of Elf_Shdr type, the SECTION_HEADER content assignment that will acquire to object
In section_headers, the content of string_table is obtained according to section area's offset of string_table and number；
Section_headers is looped through to obtain dynamic_symbols and dynamic_strings；
It parses SECTION_HEADER and saves area's header table, the title SH_NAME for obtaining section area, the type SH_TYPE for saving area, section
The mark SH_FLAGS in area, the address SH_ADDR for saving area, the offset SH_OFFSET for saving area, the head indexed links SH_ for saving area
LINK, save area additional information SH_INFO, He Jiequ section alignment amount SH_ADDRALIGN.
Further, in the step 5), the list item number E_PHNUM of program header table is first determined whether, if it is 0
Terminate the parsing to PROGRAM_HEADERS；The size with program header table is deviated according to E_PHOFF if not for 0, from
PROGRAM_HEADERS content is obtained in SO file；
The object pheaders that type is Elf32_Phdr is defined, the content that will acquire copies in pheaders；It loops through
Pheaders obtains P_TYPE, P_OFFSET, P_VADDR, P_PADDR and P_FILES, P_MEMSZ, P_FLAGS and PT_
ALIGN。
Further, in the step 6), offset and the handle of SO file in area are saved by DYNAMIC_SETCION first
Obtain the content in entire DYNAMIC_SETCION section area；Circular treatment dynamic_setion object obtains DYNAMIC_
Type mark D_TAG and the name/VALUE value of SETCION section area member.
Further, in the step 7), section_headers is looped through, the type of section is obtained；When
When the type of section is SHT_RELA or SHT_REL, handled to obtain the offset rel_ of RELOC_SECTION
Offset and size rel_size；When the type of section is SHT_RELA, according to the sh_ in section_headers
Link navigates to the symsec symbol table section area head of Elf32_shdr type, and obtains symsec symbol table section area type；
When symsec type be SHT_SYMTAB or SHT_DYNSYM then continue to execute, calculate the number nsyms of symbol table,
The symbol table symtab of SO file is obtained according to symsec and the SO file handle of opening；According to symsec symbol table section area
Sh_link gets this section area associated string table strsec section area head；According to strsec save area head obtain with
The associated string table content strtab in symsec symbol table section area, by open SO file handle, rel_offset,
Rel_size, symtab, nsyms, strtab object information parse RELOC_SECTION.
Further, in the step 8), using symtab, strtab, string_table object information of acquisition,
Circular treatment symtab object obtains ST_NAME, ST_VALUE, ST_SIZE, ST_INFO and ST_SHNDX.
To achieve the above object, the present invention also provides a kind of computer readable storage mediums, are stored thereon with computer and refer to
The step of order, the computer instruction executes the analytic method of above-mentioned SO file when running.
The analytic method of SO file provided by the invention, from program chains angle to SO file successively in SO file
Appearance is parsed, so that resolving is more quick and easy, is best understood from the attribute of SO file convenient for user and is operated.
Other features and advantages of the present invention will be illustrated in the following description, also, partly becomes from specification
It obtains it is clear that understand through the implementation of the invention.
Detailed description of the invention
Attached drawing is used to provide further understanding of the present invention, and constitutes part of specification, and with it is of the invention
Embodiment together, is used to explain the present invention, and is not construed as limiting the invention.In the accompanying drawings:
Fig. 1 is the analytic method flow chart of SO file according to the present invention.
Specific embodiment
Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings, it should be understood that preferred reality described herein
Apply example only for the purpose of illustrating and explaining the present invention and is not intended to limit the present invention.
In reverse-engineering, parsing for ELF file, most complicated is native layers, that is, the parsing of so file.
For non-security direction developer, the SO file of profound understanding system is also advanced necessary condition.
Fig. 1 is the analytic method flow chart of SO file according to the present invention, below with reference to Fig. 1, to this hair of the invention
The analytic method of bright SO file is described in detail.
Firstly, in step 101: being first turned on SO file, SO file is read into memory.
In this step, principal function will acquire the file handle for the SO file being opened.
In step 102, according to the file handle got, the Elf32_Ehdr(for obtaining SO file has ELF file header).
In this step, program obtains elf_header(in SO file first has ELF file header) e_ident attribute
(some identification informations of ELF file) are read into mark array, according to the EI_CLASS of e_ident attribute, to judge
The classification of this SO file judges that this SO file is 32 files or is 64 files.By the file internal pointer weight of SO file
The starting position of file is set, Elf32_Ehdr content whole in SO file is obtained, defines an Elf32_Ehdr type
Object elf_header, the Elf32_Ehdr assignment that will acquire is into object elf_header.
In step 103, according to the elf_header obtained in step 102, there is SO to the FILE_HEADER(of SO file
File header) it is parsed.
In this step, process priority judges EI_MAG0, EI_MAG1, EI_ in elf_header in e_ident attribute
MAG2, EI_MAG3(file identification) whether meet magic number (file of many types, the several bytes of starting of ELF file
Content is fixed, therefore is assured that file type, therefore the content of these bytes according to the content of these bytes
Referred to as magic number).EI_CLASS is obtained later, this attribute indicates the classification or capacity of file.Obtain file destination version E_
VERSION, obtains the virtual address E_ENTRY of SO file, this file destination does not have be 0 when program entry.Obtain SO text
The offset E_PHOFF of the program header table of part.Obtain the offset E_SHOFF of section area's header table of SO file.It obtains
The flags(read-write of SO file executes mark), save associated with the file, specific to the mark of processor, mark name is adopted
With the format of EF_MACHINE_FLAG.Obtain the size E_EHSIZE of SO top of file.The list item for obtaining program header table is big
Small E_PHENTSIZE(is calculated by byte).The list item number E_PHNUM(for obtaining the program header table of SO file can be for 0).
The list item size E_SHENTSIZE(for obtaining section area's header table of SO file is calculated by byte).Obtain the section area head of SO file
The list item number E_SHNUM(of portion's table can be for 0).Obtain the area header table Zhong Yujie, the section area name character string list of SO file
The index E_SHSTRNDX of relevant list item.
In step 104, according to the elf_header obtained in step 102, to the SECTION_HEADER(SO text of SO file
The area Jian Jie head) it is parsed.
In this step, the number and SECTION_HEADER that program obtains SECTION_HEADER first are relative to SO text
The offset of the initial position of part.The content for obtaining SECTION_HEADER according to number and offset later, defines one
The object section_headers of Elf_Shdr type.SECTION_HEADER content assignment be will acquire to object
In section_headers.In order to show that the title symbolic animal of the birth year of SECTION_HEADER needs to obtain string_table(character string
Table) content, the content of string_table is obtained according to section area's offset of string_table and number.For subsequent solution
Analysis is convenient, loops through section_headers here to obtain dynamic_symbols(dynamic symbol table) and
Dynamic_strings(dynamic section area's character string).
Later, parsing SECTION_HEADER saves area's header table, obtains the title (SH_NAME) in section area.Obtain section area
Type (SH_TYPE), this attribute be save area content and semanteme classify.The mark (SH_FLAGS) in section area is obtained, and
And the address (SH_ADDR) in section area is obtained, if section area appears in the memory image of process, which provides the first of section area
The position that a byte should be located.Obtain section area offset (SH_OFFSET), the value of the offset provide section area first character section with
Offset between file header, but the section area of SHT_NOBITS type is not take up the space of file.Obtain the length (SH_ in section area
SIZE).Obtain the head indexed links (SH_LINK) in section area.Obtain the additional information (SH_INFO) in section area.Obtain section area
The alignment amount (SH_ADDRALIGN) of section, certain section zone have address align constraint.Obtain SH_ENTSIZE, certain section area Zhong Bao
Project (such as symbol table) containing fixed size provides the length byte number of each list item for this kind of section area.
In step 105, according to the elf_header obtained in step 102, to the PROGRAM_HEADERS(SO of SO file
The paragraph header of file) it is parsed.
In this step, the list item number E_PHNUM for first determining whether program header table, if it to terminate if 0 couple
The parsing of PROGRAM_HEADERS.Later according to E_PHOFF(field offset) offset and program header table size, from SO text
PROGRAM_HEADERS content is obtained in part.The object pheaders that a type is Elf32_Phdr is defined, what be will acquire is interior
Appearance copies in pheaders.Loop through pheaders, first acquisition segment type (P_TYPE), mainly include PT_NULL,
The types such as PT_LOAD, PT_DYNAMIC, PT_NOTE.P_OFFSET is obtained, this member provides from SO file header to the section first
The offset of a byte.P_VADDR is obtained, this member provides virtual address of the first character section of section in memory.Obtain P_
PADDR, this member are only used in system relevant to physical address, because of System V(Unix operating system) ignore all answer
With the physical address information of program.P_FILES is obtained, this member provides section occupied byte number in File Mapping.It obtains
P_MEMSZ, this member provide section occupied byte number in memory mapping.
Obtain P_FLAGS(sections of relevant marks) member.PT_ALIGN is obtained, this member indicates the process section that can be loaded
P_VADDR(sections of virtual address) and P_OFFSET(field offset) value must be suitable, for the modulus of page-size,
This member provides how section is aligned in memory hereof.PROGRAM_HEADERS is parsed, wherein in order to parse
The dynamic section area of DYNAMIC_SETCION(SO file) it saves in area, then this step, calculate the offset of DYNAMIC_SECTION
The size DYNAMIC_SIZE of DYNAMIC_ADDR and section area.
In step 106, file handle is got according to step 101 and offset DYNAMIC_ADDR that step 105 is got
With the size DYNAMIC_SIZE in section area, DYNAMIC_SETCION is read from SO file and saves area.Defining a type is
The object dynamic_setion of Elf32_Dyn, the content assignment obtained from SO file to dynamic_setion object
In.It is solved using the dynamic_symbols and dynamic_strings obtained in dynamic_setion object and step 104
It analyses DYNAMIC_SETCION and saves area.
In this step, entire by the offset in DYNAMIC_SETCION section area and the handle acquiring of SO file first
The content in DYNAMIC_SETCION section area.Circular treatment dynamic_setion object, first acquisition DYNAMIC_SETCION
The type mark D_TAG of area member is saved, main type mark is DT_NEEDED, DT_PLTGOT, DT_HASH, DT_
STRTAB, DT_SYMTAB, DT_RELA, DT_INIT, DT_FINI, DT_SYMBOLIC etc..Name/VALUE(section is obtained below
Area's name) value, this value obtains attribute that area's symbol is saved by D_VAL(dynamic) determine, and D_TAG controls D_UN.D_
VAL(dynamic save area's symbol an attribute) explanation meaning, name by dynamic_strings(dynamic section area's character string) and
D_UN.D_VAL is determined.
In step 107, the section_headers(in file handle and step 104 obtained according to step 101 saves area
Head) come parse RELOC_SECTION(reorientation section area).
In this step, loop through section_headers(section area head), according to section(save area) SH_TYPE
(section area's type) is judged, type is SHT_RELA or is that SHT_REL handle, and obtains RELOC_ after processing
The offset rel_offset and size rel_size of SECTION, when the type in this section area is SHT_RELA, according to section_
Headers(section area head) in sh_link(save area head table sitation index) navigate to Elf32_shdr type symsec symbol
Number area Biao Jie head.Symsec symbol table section area type is judged, when type is that SHT_SYMTAB or SHT_DYNSYM then continues to hold
Row, calculates the number nsyms of symbol table, and the symbol table of SO file is obtained according to symsec and the SO file handle of opening
symtab.The associated string table strsec in this section area is got according to the sh_link in symsec symbol table section area later to save
Area head.Area head, which is saved, according to strsec obtains string table content strtab associated with the symbol table section area symsec.It
Afterwards by open SO file handle, rel_offset(relocate offset), rel_size(relocate size), symtab
The number of (symbol table), nsyms(symbol table), strtab(string table) etc. object informations parse RELOC_SECTION.
In step 108, according to the file handle that step 101 obtains, the symtab and strtab obtained in step 107, and
The string_table obtained in step 104 parses SYMBOL_TABLE(symbol table).
In this step, using object informations such as symtab, strtab, the string_table obtained in preceding step,
Circular treatment symtab object.ST_NAME is obtained, this member includes the index of the sign character string list of target SO file.It obtains
ST_VALUE, this member provide the value of associated symbol, it may be possible to an absolute value or address.Obtain ST_SIZE, table
Show the size of symbol table.ST_INFO is obtained, this member provides the type and bind properties of symbol.ST_SHNDX is obtained, this
Member provides the index on associated section area head.
Those of ordinary skill in the art will appreciate that: the foregoing is only a preferred embodiment of the present invention, and does not have to
In the limitation present invention, although the present invention is described in detail referring to the foregoing embodiments, for those skilled in the art
For, still can to foregoing embodiments record technical solution modify, or to part of technical characteristic into
Row equivalent replacement.All within the spirits and principles of the present invention, any modification, equivalent replacement, improvement and so on should all include
Within protection scope of the present invention.
Claims (9)
1. a kind of analytic method of SO file, comprising the following steps:
1) SO file is opened, SO file is read into memory；
2) Elf32_Ehdr of SO file is obtained；
3) FILE_HEADER of SO file is parsed；
4) SECTION_HEADER of SO file is parsed；
5) PROGRAM_HEADERS of SO file is parsed；
6) DYNAMIC_SETCION of SO file is parsed；
7) RELOC_SECTION of SO file is parsed；
8) SYMBOL_TABLE of SO file is parsed.
2. the analytic method of SO file according to claim 1, which is characterized in that in the step 2, acquisition SO first
The e_ident attribute of elf_header in file is read into mark array, according to the EI_CLASS of e_ident attribute,
Judge that this SO file is 32 files or is 64 files；The file internal pointer of SO file is reset to the start bit of file
It sets, obtains Elf32_Ehdr content whole in SO file, define the object elf_header of Elf32_Ehdr type, will acquire
Elf32_Ehdr assignment into object elf_header.
3. the analytic method of SO file according to claim 2, which is characterized in that in the step 3), first determine whether
Whether EI_MAG0, EI_MAG1, EI_MAG2, EI_MAG3 in elf_header in e_ident attribute meet the evil spirit of ELF file
Number；Later obtain EI_CLASS, file destination version E_VERSION, SO file virtual address E_ENTRY, SO file journey
The flags of offset E_SHOFF, the SO file of section area's header table of offset E_PHOFF, the SO file of sequence header table,
The size E_EHSIZE of SO top of file, program header table list item size E_PHENTSIZE, obtain the program header of SO file
The section of list item size E_SHENTSIZE, the SO file of section area's header table of list item number E_PHNUM, the SO file of portion's table
The area header table Zhong Yujie, the section area name character string list of list item number E_SHNUM and the SO file of area's header table is relevant
The index E_SHSTRNDX of list item.
4. the analytic method of SO file according to claim 1, which is characterized in that in the step 4), obtain first
Offset of the number and SECTION_HEADER of SECTION_HEADER relative to the initial position of SO file；Basis obtains later
The number and offset taken obtains the content of SECTION_HEADER, defines the object section_ of Elf_Shdr type
Headers, the SECTION_HEADER content assignment that will acquire is into object section_headers, according to string_
The section area's offset and number of table obtains the content of string_table；Section_headers is looped through to obtain
Dynamic_symbols and dynamic_strings；
It parses SECTION_HEADER and saves area's header table, the title SH_NAME for obtaining section area, the type SH_TYPE for saving area, section
The mark SH_FLAGS in area, the address SH_ADDR for saving area, the offset SH_OFFSET for saving area, the head indexed links SH_ for saving area
LINK, save area additional information SH_INFO, He Jiequ section alignment amount SH_ADDRALIGN.
5. the analytic method of SO file according to claim 1, which is characterized in that in the step 5), first determine whether journey
The list item number E_PHNUM of sequence header table, the parsing terminated if it is 0 to PROGRAM_HEADERS；If being not 0
According to the size of E_PHOFF offset and program header table, PROGRAM_HEADERS content is obtained from SO file；
The object pheaders that type is Elf32_Phdr is defined, the content that will acquire copies in pheaders；It loops through
Pheaders obtains P_TYPE, P_OFFSET, P_VADDR, P_PADDR and P_FILES, P_MEMSZ, P_FLAGS and PT_
ALIGN。
6. the analytic method of SO file according to claim 1, which is characterized in that in the step 6), pass through first
DYNAMIC_SETCION saves the content of the offset in area and the handle acquiring entire DYNAMIC_SETCION section area of SO file；Circulation
Dynamic_setion object is handled, the type mark D_TAG and name/VALUE of DYNAMIC_SETCION section area member are obtained
Value.
7. the analytic method of SO file according to claim 1, which is characterized in that in the step 7), loop through
Section_headers obtains the type of section；When the type of section is SHT_RELA or SHT_REL, located
It manages to obtain the offset rel_offset and size rel_size of RELOC_SECTION；When the type of section is SHT_RELA
When, the symsec symbol table section area head of Elf32_shdr type is navigated to according to the sh_link in section_headers, and
Obtain symsec symbol table section area type；
When symsec type be SHT_SYMTAB or SHT_DYNSYM then continue to execute, calculate the number nsyms of symbol table,
The symbol table symtab of SO file is obtained according to symsec and the SO file handle of opening；According to symsec symbol table section area
Sh_link gets this section area associated string table strsec section area head；According to strsec save area head obtain with
The associated string table content strtab in symsec symbol table section area, by open SO file handle, rel_offset,
Rel_size, symtab, nsyms, strtab object information parse RELOC_SECTION.
8. the analytic method of SO file according to claim 7, which is characterized in that in the step 8), utilize acquisition
Symtab, strtab, string_table object information, circular treatment symtab object, acquisition ST_NAME, ST_VALUE,
ST_SIZE, ST_INFO and ST_SHNDX.
9. a kind of computer readable storage medium is stored thereon with computer instruction, the right of execution when computer instruction is run
Benefit requires the step of analytic method of the described in any item SO files of 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811478041.6A CN109828758A (en) | 2018-12-05 | 2018-12-05 | A kind of analytic method of SO file |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811478041.6A CN109828758A (en) | 2018-12-05 | 2018-12-05 | A kind of analytic method of SO file |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109828758A true CN109828758A (en) | 2019-05-31 |
Family
ID=66859169
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811478041.6A Withdrawn CN109828758A (en) | 2018-12-05 | 2018-12-05 | A kind of analytic method of SO file |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109828758A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110764784A (en) * | 2019-10-24 | 2020-02-07 | 北京智游网安科技有限公司 | Method for identifying three-party SO file, intelligent terminal and storage medium |
| CN116909656A (en) * | 2023-09-14 | 2023-10-20 | 北京中天星控科技开发有限公司 | Method for realizing embedded dynamic APP loading based on elf file |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO1997012508A2 (en) * | 1995-10-04 | 1997-04-10 | Platinum Technology, Inc. | Transforming and manipulating program object code |
| EP1501009A1 (en) * | 1997-10-21 | 2005-01-26 | FTL Systems Inc. | Dynamic instruction set augmentation and multiprocessor synchronization using electronically reconfigurable logic arrays |
| US20050144608A1 (en) * | 2003-12-26 | 2005-06-30 | Hiroshi Oyama | Operating system allowing running of real-time application programs, control method therefor, and method of loading dynamic link libraries |
| US20150007137A1 (en) * | 2013-06-28 | 2015-01-01 | International Business Machines Corporation | Document quality review and testing |
| CN104991810A (en) * | 2015-07-24 | 2015-10-21 | 上海斐讯数据通信技术有限公司 | Method and processing system for automatically adding APK into Android system |
| US9262296B1 (en) * | 2014-01-31 | 2016-02-16 | Cylance Inc. | Static feature extraction from structured files |
| CN105468661A (en) * | 2014-12-31 | 2016-04-06 | 武汉安天信息技术有限责任公司 | Method and system for searching symbol information in ELF file |
| CN106681782A (en) * | 2016-12-09 | 2017-05-17 | 北京奇虎科技有限公司 | Method and device for compiling dynamic linking library SO file of Android installation package |
-
2018
- 2018-12-05 CN CN201811478041.6A patent/CN109828758A/en not_active Withdrawn
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO1997012508A2 (en) * | 1995-10-04 | 1997-04-10 | Platinum Technology, Inc. | Transforming and manipulating program object code |
| EP1501009A1 (en) * | 1997-10-21 | 2005-01-26 | FTL Systems Inc. | Dynamic instruction set augmentation and multiprocessor synchronization using electronically reconfigurable logic arrays |
| US20050144608A1 (en) * | 2003-12-26 | 2005-06-30 | Hiroshi Oyama | Operating system allowing running of real-time application programs, control method therefor, and method of loading dynamic link libraries |
| US20150007137A1 (en) * | 2013-06-28 | 2015-01-01 | International Business Machines Corporation | Document quality review and testing |
| US9262296B1 (en) * | 2014-01-31 | 2016-02-16 | Cylance Inc. | Static feature extraction from structured files |
| CN105468661A (en) * | 2014-12-31 | 2016-04-06 | 武汉安天信息技术有限责任公司 | Method and system for searching symbol information in ELF file |
| CN104991810A (en) * | 2015-07-24 | 2015-10-21 | 上海斐讯数据通信技术有限公司 | Method and processing system for automatically adding APK into Android system |
| CN106681782A (en) * | 2016-12-09 | 2017-05-17 | 北京奇虎科技有限公司 | Method and device for compiling dynamic linking library SO file of Android installation package |
Non-Patent Citations (1)
| Title |
|---|
| 双刃剑客: "Android逆向之旅---SO(ELF)文件格式详解", 《CSDN: HTTPS://BLOG.CSDN.NET/ZHANGMIAOPING23/ARTICLE/DETAILS/82314758》 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110764784A (en) * | 2019-10-24 | 2020-02-07 | 北京智游网安科技有限公司 | Method for identifying three-party SO file, intelligent terminal and storage medium |
| CN116909656A (en) * | 2023-09-14 | 2023-10-20 | 北京中天星控科技开发有限公司 | Method for realizing embedded dynamic APP loading based on elf file |
| CN116909656B (en) * | 2023-09-14 | 2023-12-08 | 北京中天星控科技开发有限公司 | Method for realizing embedded dynamic APP loading based on elf file |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| ES2563487T3 (en) | Place exception throw instruction in compiled code | |
| CN105224370B (en) | A kind of method and apparatus of loading ELF document | |
| CN108633309B (en) | Compiler optimization of co-programs | |
| US8850581B2 (en) | Identification of malware detection signature candidate code | |
| JP2004517390A (en) | Analysis virtual machine | |
| CN109471634A (en) | The inspection method and equipment of source code format | |
| CN109828758A (en) | A kind of analytic method of SO file | |
| US20220383988A1 (en) | Data processing system and method | |
| CN108027748A (en) | Instruction set simulator and its simulator generation method | |
| US20120180067A1 (en) | Information processing apparatus and computer program product | |
| Johnson et al. | Literate programming using noweb | |
| US20220108023A1 (en) | Docker image vulnerability inspection device and method for performing docker file analysis | |
| Lageman et al. | B in dnn: Resilient function matching using deep learning | |
| US7219337B2 (en) | Direct instructions rendering emulation computer technique | |
| Lowther et al. | Morello MicroPython: A Python Interpreter for CHERI | |
| US8935781B1 (en) | Native code module security for arm 64-bit instruction set architectures | |
| KR20160098794A (en) | Apparatus and method for skeleton code generation based on device program structure modeling | |
| US20060101412A1 (en) | Method to bridge between unmanaged code and managed code | |
| Hirt et al. | Oracle JRockit: The Definitive Guide | |
| Štill et al. | DIVINE: Explicit-State LTL Model Checker: (Competition Contribution) | |
| Li-Thiao-Té | Literate program execution for reproducible research and executable papers | |
| Bajczi et al. | Theta: Abstraction based techniques for verifying concurrency (competition contribution) | |
| CN105988811B (en) | The method and apparatus for obtaining the kernel control flow chart of operating system | |
| Haijiang et al. | Nightingale: Translating embedded VM code in x86 binary executables | |
| Herdt et al. | RVX-a tool for concolic testing of embedded binaries targeting RISC-V platforms |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20190531 |