CN110221961A - Global hook self-repairing method, device, equipment and storage medium - Google Patents
Global hook self-repairing method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN110221961A CN110221961A CN201910341769.2A CN201910341769A CN110221961A CN 110221961 A CN110221961 A CN 110221961A CN 201910341769 A CN201910341769 A CN 201910341769A CN 110221961 A CN110221961 A CN 110221961A
- Authority
- CN
- China
- Prior art keywords
- class
- hook
- title
- collapse
- circulation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/362—Software debugging
- G06F11/3628—Software debugging of optimised code
Abstract
The invention discloses global hook self-repairing method, device, equipment and storage mediums based on security monitoring field, cause the global class collapsed for automatic shield, avoid the modification to code, improve remediation efficiency.The method of the present invention includes: to define a circulation, and the circulation is for carrying out hook to all classes；A variable function is defined, the variable function is used to record the title of the class to hook；According to the title of the circulation and the variable function judgement class to hook whether in filter list；If the title of the class to hook in the filter list, shields collapse class corresponding with the title of the class to hook, the collapse class is to cause the class of collapse or exception.
Description
Technical field
The present invention relates to operating system security monitoring fields, more particularly to overall situation hook self-repairing method, device, equipment
And storage medium.
Background technique
With the fast development of mobile phone industry, cell phone system also develops accordingly, and the system of mainstream has Android system at present
With IOS system.For IOS system, IOS project tests code coverage if necessary, and a relatively good method is exactly
Hook all classes, then add statistics codes in all methods of all classes, but because the type of the class of each project
Complicated and substantial amounts, the literary style of some classes will lead to a hook and just cause to collapse.
Way more conventional at present is to need manual amendment's code to carry out shielding by manually being excluded manually and cause
The relevant class of collapse, remediation efficiency are low.
Summary of the invention
The embodiment of the invention provides a kind of overall situation hook self-repairing method, device, equipment and storage mediums, for certainly
Dynamic shielding causes the global class collapsed, and avoids the modification to code, improves remediation efficiency.
The first aspect of the embodiment of the present invention provides a kind of global hook self-repairing method based on data analysis, packet
It includes: defining a circulation, the circulation is for carrying out hook to all classes；Define a variable function, the variable function
For recording the title of the class to hook；It is according to the circulation and the variable function judgement title to the class of hook
It is no in filter list；If the title of the class to hook is in the filter list, shielding and the class to hook
The corresponding collapse class of title, it is described collapse class be cause collapse or exception class.
Optionally, described according to the circulation and institute in the first implementation of first aspect of the embodiment of the present invention
After the title described in variable function judgement to the class of hook is stated whether in filter list, the method also includes: if described
The title of class to hook then calls the circulation to carry out hook to the class to hook not in the filter list.
Optionally, in second of implementation of first aspect of the embodiment of the present invention, it is described shielding with it is described to hook
Class the corresponding collapse class of title, it is described collapse class be cause collapse or exception class after, the method also includes: monitor
Abnormal function, the abnormal function is for monitoring and recording the corresponding array of the collapse class；It is corresponding according to the collapse class
Array determines the title of the collapse class in the abnormal function；The title of the collapse class is imported into the filter list.
Optionally, in the third implementation of first aspect of the embodiment of the present invention, one circulation of the definition is described
Recycling for carrying out hook to all classes includes: the path for obtaining currently running destination application；Obtain the target
The title and quantity of each class of application program；A for circulation, institute are defined according to the title of each class and quantity
It states for circulation and overall situation hook is carried out to each class for the path according to the destination application.
Optionally, in the 4th kind of implementation of first aspect of the embodiment of the present invention, one variable function of the definition,
The title that the variable function is used to record the class to hook includes: to obtain preset key value；According to the preset key value
Call the array for the collapse class being stored in system storage or initialized data base；One is defined according to the array of the collapse class
A variable function, the variable function are used to record the title of the class to hook.
Optionally, described according to the circulation and institute in the 5th kind of implementation of first aspect of the embodiment of the present invention
State whether the variable function judgement title to the class of hook comprises determining that the number called in the circulation in filter list
Group；The variable function is determined in the array of the calling；It determines the title in the variable function to the class of hook, and sentences
Whether the title of the disconnected class to hook is in filter list.
Optionally, in the 6th kind of implementation of first aspect of the embodiment of the present invention, the method also includes: if described
The quantity that class is collapsed in filter list is greater than threshold value, then integrates to the class for causing collapse；It determines identical in the collapse class
The prefix of the collapse class of type；Collapse class with the prefix is subjected to batch shielding.
The second aspect of the embodiment of the present invention provides a kind of overall situation hook automatic repariring equipment, comprising: the first definition is single
Member, for defining a circulation, the circulation is for carrying out hook to all classes；Second definition unit, for defining one
Variable function, the variable function are used to record the title of the class to hook；Judging unit, for according to it is described circulation and it is described
Whether the title of the variable function judgement class to hook is in filter list；First screen unit, if described to hook's
The title of class is in the filter list, then described to collapse for shielding collapse class corresponding with the title of the class to hook
Routed class is to cause the class of collapse or exception.
Optionally, in the first implementation of second aspect of the embodiment of the present invention, global hook automatic repariring equipment
Further include: call unit, if the title of the class to hook not in the filter list, is used to call the circulation pair
The class to hook carries out hook.
Optionally, in second of implementation of second aspect of the embodiment of the present invention, global hook automatic repariring equipment
Further include: monitoring unit, for monitoring abnormal function, the abnormal function is for monitoring and recording the corresponding number of the collapse class
Group；First determination unit, for determining the title of the collapse class in the abnormal function according to the corresponding array of the collapse class；
Import unit, for the title of the collapse class to be imported into the filter list.
Optionally, in the third implementation of second aspect of the embodiment of the present invention, the first definition unit is specifically used for:
Obtain the path of currently running destination application；Obtain the title and quantity of each class of the destination application；
A for circulation is defined according to the title of each class and quantity, for circulation is for according to the target application journey
The path of sequence carries out overall situation hook to each class.
Optionally, in the 4th kind of implementation of second aspect of the embodiment of the present invention, the second definition unit is specifically used for:
Obtain preset key value；The collapse being stored in system storage or initialized data base is called according to the preset key value
The array of class；A variable function is defined according to the array of the collapse class, the variable function is used to record the class to hook
Title.
Optionally, in the 5th kind of implementation of second aspect of the embodiment of the present invention, judging unit is specifically used for: determining
The array called in the circulation；The variable function is determined in the array of the calling；Determine in the variable function to
The title of the class of hook, and judge the title of the class to hook whether in filter list.
Optionally, in the 6th kind of implementation of second aspect of the embodiment of the present invention, global hook automatic repariring equipment
Further include: integral unit, if the quantity for collapsing class in the filter list is greater than threshold value, for being carried out to the class for causing collapse
Integration；Second determination unit, for determining the prefix of the collapse class of same type in the collapse class；Secondary shielding unit is used
Batch shielding is carried out in the collapse class that there will be the prefix.
The third aspect of the embodiment of the present invention provides a kind of overall situation hook and is automatically repaired equipment, including memory, processing
Device and it is stored in the computer program that can be run on the memory and on the processor, the processor executes the meter
Global hook self-repairing method described in any of the above-described embodiment is realized when calculation machine program.
The fourth aspect of the embodiment of the present invention provides a kind of computer readable storage medium, including instruction, when the finger
When order is run on computers, so that computer executes global hook self-repairing method described in any of the above-described embodiment
Step.
In technical solution provided in an embodiment of the present invention, a circulation is defined, the circulation is for all class progress
hook；A variable function is defined, which is used to record the title of the class to hook；Sentenced according to circulation and variable function
Whether the title of the disconnected class to hook is in filter list；If the title of the class to hook in filter list, shielding with to
The corresponding collapse class of the title of the class of hook, the collapse class are to cause the class of collapse or exception.The embodiment of the present invention, automatic shield
Cause the global class collapsed, avoids the modification to code, improve remediation efficiency.
Detailed description of the invention
Fig. 1 is one embodiment schematic diagram of overall situation hook self-repairing method in the embodiment of the present invention；
Fig. 2 is another embodiment schematic diagram of overall situation hook self-repairing method in the embodiment of the present invention；
Fig. 3 is one embodiment schematic diagram of overall situation hook automatic repariring equipment in the embodiment of the present invention；
Fig. 4 is another embodiment schematic diagram of overall situation hook automatic repariring equipment in the embodiment of the present invention；
Fig. 5 is one embodiment schematic diagram that overall situation hook is automatically repaired equipment in the embodiment of the present invention.
Specific embodiment
The embodiment of the invention provides a kind of overall situation hook self-repairing method, device, equipment and storage mediums, for certainly
Dynamic shielding causes the global class collapsed, and avoids the modification to code, improves remediation efficiency.
In order to enable those skilled in the art to better understand the solution of the present invention, below in conjunction in the embodiment of the present invention
The embodiment of the present invention is described in attached drawing.
Description and claims of this specification and term " first ", " second ", " third ", " in above-mentioned attached drawing
The (if present)s such as four " are to be used to distinguish similar objects, without being used to describe a particular order or precedence order.It should manage
The data that solution uses in this way are interchangeable under appropriate circumstances, so that the embodiments described herein can be in addition to illustrating herein
Or the sequence other than the content of description is implemented.In addition, term " includes " or " having " and its any deformation, it is intended that covering is not
Exclusive includes, for example, the process, method, system, product or equipment for containing a series of steps or units be not necessarily limited to it is clear
Step or unit those of is listed on ground, but is not clearly listed or for these process, methods, product or is set
Standby intrinsic other step or units.
Referring to Fig. 1, a kind of flow chart of overall situation hook self-repairing method provided in an embodiment of the present invention, specific to wrap
It includes:
101, a circulation is defined, the circulation is for carrying out hook to all classes.
Server defines a circulation, and the circulation is for carrying out hook to all classes.Specifically, server defines one
For circulation carries out hook by all classes of for circulation to system or application program.For example, server obtains current operation
Destination application path；Server obtains the title and quantity of each class of destination application；Server according to
The title and quantity of each class define a for circulation, and for circulation is for the path according to destination application to each class
Carry out overall situation hook.
For example, obtaining current operation first when needing to carry out hook to an application program (application, APP)
APP path, e.g., dladdr (&_mh_execute_header , &info)；Secondly each of currently running APP is obtained
The quantity of the title of class and each class.For example, classes=objc_copyClassNamesForImage (info.dli_
fname,&count)；Wherein, two-dimensional array classes storage has the title of all classes, and count is stored with the number of all classes
Amount；A for circulation is finally defined according to the title of each class and quantity.For example, by array by the class in classes array
It takes out one by one, for circulation starts.
102, a variable function is defined, which is used to record the title of the class to hook.
Server defines a variable function, which is used to record the title of the class to hook.
Specifically, server first obtains preset key value；Then the array that collapse class is called according to preset key value, collapses
The storage of array for class of bursting is in system storage or initialized data base；A variable letter is defined further according to the array of collapse class
Number, wherein the variable function is used to record the title of the class to hook.
As soon as example, the character string that server defines, for example being PA_HookCrashListKey, system is then used
Included memory (or the database code finished writing in advance), is stored and is called.The class array of collapse is exactly to pass through
The object that key is obtained from database.
103, judge the title of the class to hook whether in filter list according to circulation and variable function.
Whether server judges the title of the class to hook in filter list according to circulation and variable function.Specifically,
Server determines the array called in circulation；Server determines variable function in the array of calling；Server determines variable letter
Title in number to the class of hook, and judge the title of class to hook whether in filter list.If the name of the class to hook
Claim in filter list, then server shields collapse class corresponding with the title of the class to hook.If the title of the class to hook
Not in filter list, then the class that server calls circulation treats hook carries out hook.
Specifically, server carries out hook by the class that for circulation treats hook, wherein hook (hook) is Windows
One platform of message processing facility, application program (APP) sub- journey can be set above with monitor specified window certain disappear
Breath, and the window monitored can be what other processes were created.After message reaches, before target window handles function
Handle it.Hook Mechanism allows application program to intercept and capture processing window message or particular event.Hook is actually a processing
The program segment of message, is called by system, it is linked into system.After the sending of specific message, and in no arrival purpose
Before window, hook program just first captures the message, i.e. Hook Function first obtains control.At this moment Hook Function can process place
(change) message is managed, can not also deal with and continue to transmit the message, the transmitting of end message can also be forced.
It should be noted that the sequence of hook be it is random, the array of my all classes is returned to depending on systems approach
Sequentially, I takes out one by one from array carry out hook again.And hook standard are as follows: obtain all methods of class, filtering one
The method that a little systems included method and needs filter, it is that staff is pre- that the method for needing to filter, which depends on project and business,
First configure, and to remaining method, method address is changed, C (objective-C, OC) language of forced trigger object-oriented
Then the message forwarding mechanism of speech rewrites the forwardInvocation method called when message forwarding, inside this method again
Address is gained, but before gaining, some hook codes can also be write, to achieve the purpose that hook.
If 104, the title to the class of hook is in filter list, collapse corresponding with the title of the class to hook is shielded
Class, the collapse class are to cause the class of collapse or exception.
If the title of the class to hook, in filter list, server shielding is corresponding with the title of the class to hook to collapse
Routed class, the collapse class are to cause the class of collapse or exception.
It is understood that system is monitored by included abnormal function, before each collapse, array is saved
To filter list range.When starting next time, filter list will increase the title of a collapse class, and be used as judgement mark
It is quasi-.
The embodiment of the present invention defines a circulation, and the circulation is for carrying out hook to all classes；Define a variable letter
Number, the variable function are used to record the title of the class to hook；The title of the class to hook is judged according to circulation and variable function
Whether in filter list；If the title of the class to hook in filter list, shields corresponding with the title of the class to hook
Collapse class, the collapse class be cause collapse or exception class.It can cause the global class collapsed with automatic shield, avoid to being
The modification of system code, improves remediation efficiency.
Referring to Fig. 2, another embodiment of overall situation hook self-repairing method includes: in the embodiment of the present invention
201, a circulation is defined, the circulation is for carrying out hook to all classes.
Server defines a circulation, and the circulation is for carrying out hook to all classes.Specifically, server defines one
For circulation carries out hook by all classes of for circulation to system or application program.For example, server obtains current operation
Destination application path；Server obtains the title and quantity of each class of destination application；Server according to
The title and quantity of each class define a for circulation, and for circulation is for the path according to destination application to each class
Carry out overall situation hook.
For example, obtaining current operation first when needing to carry out hook to an application program (application, APP)
APP path, e.g., dladdr (&_mh_execute_header , &info)；Secondly each of currently running APP is obtained
The quantity of the title of class and each class.For example, classes=objc_copyClassNamesForImage (info.dli_
fname,&count)；Wherein, two-dimensional array classes storage has the title of all classes, and count is stored with the number of all classes
Amount；A for circulation is finally defined according to the title of each class and quantity.For example, by array by the class in classes array
It takes out one by one, for circulation starts.
202, a variable function is defined, which is used to record the title of the class to hook.
Server defines a variable function, which is used to record the title of the class to hook.
Specifically, server first obtains preset key value；Then the array that collapse class is called according to preset key value, collapses
The storage of array for class of bursting is in system storage or initialized data base；A variable letter is defined further according to the array of collapse class
Number, wherein the variable function is used to record the title of the class to hook.
As soon as example, the character string that server defines, for example being PA_HookCrashListKey, system is then used
Included memory (or the database code finished writing in advance), is stored and is called.The class array of collapse is exactly to pass through
The object that key is obtained from database.
203, judge the title of the class to hook whether in filter list according to circulation and variable function.
Whether server judges the title of the class to hook in filter list according to circulation and variable function.Specifically,
Server determines the array called in circulation；Server determines variable function in the array of calling；Server determines variable letter
Title in number to the class of hook, and judge the title of class to hook whether in filter list.If the name of the class to hook
Claim in filter list, then server shields collapse class corresponding with the title of the class to hook.If the title of the class to hook
Not in filter list, then the class that server calls circulation treats hook carries out hook.
Specifically, server carries out hook by the class that for circulation treats hook, wherein hook (hook) is Windows
One platform of message processing facility, application program (APP) sub- journey can be set above with monitor specified window certain disappear
Breath, and the window monitored can be what other processes were created.After message reaches, before target window handles function
Handle it.Hook Mechanism allows application program to intercept and capture processing window message or particular event.Hook is actually a processing
The program segment of message, is called by system, it is linked into system.After the sending of specific message, and in no arrival purpose
Before window, hook program just first captures the message, that is, Hook Function first obtains control.At this moment Hook Function can be processed
(change) message is handled, can not also deal with and continue to transmit the message, the transmitting of end message can also be forced.
It should be noted that the sequence of hook be it is random, the array of my all classes is returned to depending on systems approach
Sequentially, I takes out one by one from array carry out hook again.And hook standard are as follows: obtain all methods of class, filtering one
The method that a little systems included method and needs filter, it is that staff is pre- that the method for needing to filter, which depends on project and business,
First configure, and to remaining method, method address is changed, message forwarding mechanism of the forced trigger towards OC language, then
The forwardInvocation method called when message forwarding is rewritten again, and address is gained inside this method, but is being changed
Before going back, some hook codes can also be write, to achieve the purpose that hook.
If 204, the title to the class of hook is in filter list, collapse corresponding with the title of the class to hook is shielded
Class, the collapse class are to cause the class of collapse or exception.
If the title of the class to hook, in filter list, server shielding is corresponding with the title of the class to hook to collapse
Routed class, the collapse class are to cause the class of collapse or exception.
It is understood that system is monitored by included abnormal function, before each collapse, array is saved
To filter list range.When starting next time, filter list will increase the title of a collapse class, and by increased collapse class
Name be referred to as judgment criteria.
205, abnormal function is monitored, the abnormal function is for monitoring and recording the corresponding array of collapse class.
Server monitors the abnormal function in system, wherein the abnormal function is for monitoring and recording collapse class
Corresponding array.Storage of array has specific data corresponding with each class.For example, if variable function is a, because of a in array,
It is to be deposited into before starting hook, i.e., does a label in data, then after the method call of hook code,
A is deleted.In turn, if hook code collapses, subsequent code is had no chance operation, and a in this array would not be deleted
Fall, when next hook, finds this in collapse array, we are just no longer hook, avoid falling into circulation collapse.
206, the title of the collapse class in abnormal function is determined according to the corresponding array of collapse class.
Server determines the title of the collapse class in abnormal function according to the corresponding array of collapse class.For example, server root
The collapse collapsed is determined in abnormal function NSSetUncaughtExceptionHandler according to the corresponding array of collapse class
The title of class.
207, the title for collapsing class is imported into filter list.
The title for collapsing class is imported into filter list by server, includes that can cause system crash or different in the filter list
The title of normal class.
Optionally, if the quantity for collapsing class in filter list is greater than threshold value, server is whole to causing the class of collapse to carry out
It closes；Server determines the prefix of the collapse class of same type in collapse class；Collapse class with prefix is carried out batch by server
Shielding.
The embodiment of the present invention defines a circulation, and the circulation is for carrying out hook to all classes；Define a variable letter
Number, the variable function are used to record the title of the class to hook；The title of the class to hook is judged according to circulation and variable function
Whether in filter list；If the title of the class to hook in filter list, shields corresponding with the title of the class to hook
Collapse class, the collapse class be cause collapse or exception class；Abnormal function is monitored, which collapses for monitoring and recording
The routed corresponding array of class.In the embodiment of the present invention, the every collapse of system is primary, collapse in array will more one need to shield
Class, according to the strategy of front, does not execute hook to this class, the class collapsed in this way is just when next time starts hook code
Will not hook, would not also lead to system crash, the global class collapsed can be caused with automatic shield, is avoided to system generation
The modification of code, improves remediation efficiency.
Optionally, on the basis of above-mentioned Fig. 2 corresponding embodiment, overall situation hook provided in an embodiment of the present invention is repaired automatically
In the alternative embodiment of compound method, can also include:
Judge whether variable function is empty in circulation；If variable function be not it is empty, by the array for collapsing class with variable
The corresponding class of function is deleted.
Specifically, server judges whether variable function is empty in circulation.If variable function is not sky, server will collapse
Class corresponding with variable function is deleted in the array for class of bursting.If variable function is sky, server ignores the variable function.
Optionally, on the basis of above-mentioned Fig. 2 corresponding embodiment, overall situation hook provided in an embodiment of the present invention is repaired automatically
In the alternative embodiment of compound method, method further include:
If the title of the class to hook not in the filter list, is carried out by the class that circulation treats hook
hook。
The embodiment of the present invention defines a circulation, and the circulation is for carrying out hook to all classes；Define a variable letter
Number, the variable function are used to record the title of the class to hook；The title of the class to hook is judged according to circulation and variable function
Whether in filter list；If the title of the class to hook in filter list, shields corresponding with the title of the class to hook
Collapse class, the collapse class be cause collapse or exception class；Abnormal function is monitored, which collapses for monitoring and recording
The routed corresponding array of class.It can cause the global class collapsed with automatic shield, avoid the modification to system code, improve reparation
Efficiency.
Overall situation hook self-repairing method in the embodiment of the present invention is described above, below to the embodiment of the present invention
Middle overall situation hook automatic repariring equipment is described, referring to Fig. 3, overall situation hook automatic repariring equipment in the embodiment of the present invention
One embodiment includes:
First definition unit 301, for defining a circulation, the circulation is for carrying out hook to all classes；
Second definition unit 302, for defining a variable function, the variable function is used to record the class to hook
Title；
Judging unit 303, for being according to the circulation and the variable function judgement title to the class of hook
It is no in filter list；
First screen unit 304, if the title of the class to hook in the filter list, is used to shield and institute
The corresponding collapse class of title of the class to hook is stated, the collapse class is to cause the class of collapse or exception.
The embodiment of the present invention defines a circulation, and the circulation is for carrying out hook to all classes；Define a variable letter
Number, the variable function are used to record the title of the class to hook；The title of the class to hook is judged according to circulation and variable function
Whether in filter list；If the title of the class to hook in filter list, shields corresponding with the title of the class to hook
Collapse class, the collapse class be cause collapse or exception class.It can cause the global class collapsed with automatic shield, avoid to being
The modification of system code, improves remediation efficiency.
Referring to Fig. 4, one embodiment of overall situation hook automatic repariring equipment includes: in the embodiment of the present invention
First definition unit 301, for defining a circulation, the circulation is for carrying out hook to all classes；
Second definition unit 302, for defining a variable function, the variable function is used to record the class to hook
Title；
Judging unit 303, for being according to the circulation and the variable function judgement title to the class of hook
It is no in filter list；
First screen unit 304, if the title of the class to hook in the filter list, is used to shield and institute
The corresponding collapse class of title of the class to hook is stated, the collapse class is to cause the class of collapse or exception.
Optionally, global hook automatic repariring equipment further include:
Call unit 305, if the title of the class to hook not in the filter list, is used to follow by described
Ring carries out hook to the class to hook.
Optionally, global hook automatic repariring equipment further include:
Monitoring unit 306, for monitoring abnormal function, the abnormal function is corresponding for monitoring and recording the collapse class
Array；
First determination unit 307, for determining the collapse in the abnormal function according to the corresponding array of the collapse class
The title of class；
Import unit 308, for the title of the collapse class to be imported into the filter list.
Optionally, the first definition unit 301 is specifically used for:
Obtain the path of currently running destination application；Obtain the title of each class of the destination application with
And quantity；A for circulation is defined according to the title of each class and quantity, for circulation is for according to the mesh
The path for marking application program carries out overall situation hook to each class.
Optionally, the second definition unit 302 is specifically used for:
Obtain preset key value；System storage or initialized data base are stored according to the preset key value calling
In collapse class array；According to it is described collapse class array define a variable function, the variable function for record to
The title of the class of hook.
Optionally, judging unit 303 is specifically used for:
Determine the array called in the circulation；The variable function is determined in the array of the calling；Described in determination
Title in variable function to the class of hook, and judge the title of the class to hook whether in filter list.
Optionally, global hook automatic repariring equipment further include:
Integral unit 309, if the quantity for collapsing class in the filter list is greater than threshold value, for the class for causing collapse
It is integrated；
Second determination unit 310, for determining the prefix of the collapse class of same type in the collapse class；
Secondary shielding unit 311, for that will have the collapse class of the prefix to carry out batch shielding.
The embodiment of the present invention defines a circulation, and the circulation is for carrying out hook to all classes；Define a variable letter
Number, the variable function are used to record the title of the class to hook；The title of the class to hook is judged according to circulation and variable function
Whether in filter list；If the title of the class to hook in filter list, shields corresponding with the title of the class to hook
Collapse class, the collapse class be cause collapse or exception class；Abnormal function is monitored, which collapses for monitoring and recording
The routed corresponding array of class.It can cause the global class collapsed with automatic shield, avoid the modification to system code, improve reparation
Efficiency.
Angle of the above figure 3 to Fig. 4 from modular functionality entity is automatically repaired the global hook in the embodiment of the present invention
Device is described in detail, and is automatically repaired equipment to overall situation hook in the embodiment of the present invention from the angle of hardware handles below and carries out
Detailed description.
Fig. 5 is the structural schematic diagram that a kind of overall situation hook provided in an embodiment of the present invention is automatically repaired equipment, the overall situation
Hook, which is automatically repaired equipment 500, to generate bigger difference because configuration or performance are different, may include one or one with
Upper processor (central processing units, CPU) 501 (for example, one or more processors) and memory
509, one or more storage application programs 507 or data 506 storage medium 508 (such as one or more sea
Amount storage equipment).Wherein, memory 509 and storage medium 508 can be of short duration storage or persistent storage.Storage is stored in be situated between
The program of matter 508 may include one or more modules (diagram does not mark), and each module may include to global hook
The series of instructions operation being automatically repaired in equipment.Further, processor 501 can be set to logical with storage medium 508
Letter is automatically repaired the series of instructions operation executed in storage medium 508 in equipment 500 in global hook.
It can also include one or more power supplys 502 that global hook, which is automatically repaired equipment 500, one or more
Wired or wireless network interface 503, one or more input/output interfaces 504, and/or, one or more operations
System 505, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD etc..Those skilled in the art can be with
Understanding, overall situation hook shown in Fig. 5 is automatically repaired device structure and does not constitute the restriction for being automatically repaired equipment to global hook,
It may include perhaps combining certain components or different component layouts than illustrating more or fewer components.Processor 501
The first definition unit 301 in above-described embodiment, the second definition unit 302, judging unit 303, the first screen unit can be executed
304, in call unit 305, monitoring unit 306, the first determination unit 307 and import unit 308 any cell function.Processing
Device 501 can also be performed any in integral unit 309 in above-described embodiment, the second determination unit 310 and secondary shielding unit 311
The function of unit.
The global hook each component parts for being automatically repaired equipment is specifically introduced below with reference to Fig. 5:
Processor 501 is the control centre that global hook is automatically repaired equipment, can be automatic according to the global hook of setting
Restorative procedure is handled.Using various interfaces and connection, entirely overall situation hook is automatically repaired each of equipment to processor 501
A part by running or execute the software program and/or module that are stored in memory 509, and calls and is stored in storage
Data in device 509 execute various functions and processing data that overall situation hook is automatically repaired equipment, to realize the screen of collapse class
It covers.Storage medium 508 and memory 509 are all the carriers of storing data, and in the embodiment of the present invention, storage medium 508 be can be
Refer to that storage volume is smaller, but fireballing built-in storage, and memory 509 can be that storage volume is big, but storage speed is slow
External memory.
Memory 509 can be used for storing software program and module, and processor 501 is stored in memory 509 by operation
Software program and module, the various function application and data processing of equipment 500 are automatically repaired thereby executing global hook.
Memory 509 can mainly include storing program area and storage data area, wherein storing program area can storage program area, at least
Application program needed for one function (for example monitor abnormal function etc.) etc.；Storage data area can store automatic according to global hook
Prosthetic appliance uses created data (such as one variable function of definition etc.) etc..In addition, memory 509 may include height
Fast random access memory, can also include nonvolatile memory, a for example, at least disk memory, flush memory device,
Or other volatile solid-state parts.The global hook self-repairing method program provided in embodiments of the present invention and reception
In memory, when it is desired to be used, processor 501 is called from memory 509 for the data flow storage arrived.
When loading on computers and executing the computer program instructions, entirely or partly generate according to of the invention real
Apply process described in example or function.The computer can be general purpose computer, special purpose computer, computer network or its
His programmable device.The computer instruction may be stored in a computer readable storage medium, or can from a computer
Read storage medium transmitted to another computer readable storage medium, for example, the computer instruction can from a web-site,
Computer, server or data center pass through wired (such as coaxial cable, optical fiber, twisted pair) or wireless (such as infrared, nothing
Line, microwave etc.) mode transmitted to another web-site, computer, server or data center.It is described computer-readable
Storage medium can be any usable medium that computer can store or include that one or more usable mediums are integrated
The data storage devices such as server, data center.The usable medium can be magnetic medium, (for example, floppy disk, hard disk, magnetic
Band), optical medium (for example, CD) or semiconductor medium (such as solid state hard disk (Solid State Disk, SSD)) etc..
It is apparent to those skilled in the art that for convenience and simplicity of description, the system of foregoing description,
The specific work process of device and unit, can refer to corresponding processes in the foregoing method embodiment, and details are not described herein.
In several embodiments provided by the present invention, it should be understood that disclosed system, device and method can be with
It realizes by another way.For example, the apparatus embodiments described above are merely exemplary, for example, the unit
It divides, only a kind of logical function partition, there may be another division manner in actual implementation, such as multiple units or components
It can be combined or can be integrated into another system, or some features can be ignored or not executed.Another point, it is shown or
The mutual coupling, direct-coupling or communication connection discussed can be through some interfaces, the indirect coupling of device or unit
It closes or communicates to connect, can be electrical property, mechanical or other forms.
The unit as illustrated by the separation member may or may not be physically separated, aobvious as unit
The component shown may or may not be physical unit, it can and it is in one place, or may be distributed over multiple
In network unit.It can select some or all of unit therein according to the actual needs to realize the mesh of this embodiment scheme
's.
In addition, each functional unit in embodiments of the present invention can integrate in one processing unit, it is also possible to each
A unit physically exists alone, and can also be integrated in one unit with two or more units.Above-mentioned integrated unit was both
It can take the form of hardware realization, can also realize in the form of software functional units.
If the integrated unit is realized in the form of SFU software functional unit and sells or use as independent product
When, it can store in a computer readable storage medium.Based on this understanding, technical solution of the present invention is substantially
The all or part of the part that contributes to existing technology or the technical solution can be in the form of software products in other words
It embodies, which is stored in a storage medium, including some instructions are used so that a computer
Equipment (can be personal computer, server or the network equipment etc.) executes the complete of each embodiment the method for the present invention
Portion or part steps.And storage medium above-mentioned include: USB flash disk, mobile hard disk, read-only memory (read-only memory,
ROM), random access memory (random access memory, RAM), magnetic or disk etc. are various can store program
The medium of code.
The above, the above embodiments are merely illustrative of the technical solutions of the present invention, rather than its limitations；Although referring to before
Stating embodiment, invention is explained in detail, those skilled in the art should understand that: it still can be to preceding
Technical solution documented by each embodiment is stated to modify or equivalent replacement of some of the technical features；And these
It modifies or replaces, the spirit and scope for technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution.
Claims (10)
1. a kind of overall situation hook self-repairing method characterized by comprising
A circulation is defined, the circulation is for carrying out hook to all classes；
A variable function is defined, the variable function is used to record the title of the class to hook；
According to the title of the circulation and the variable function judgement class to hook whether in filter list；
If the title of the class to hook in the filter list, shields corresponding with the title of the class to hook
Class is collapsed, the collapse class is to cause the class of collapse or exception.
2. overall situation hook self-repairing method according to claim 1, which is characterized in that described according to the circulation and institute
After the title described in variable function judgement to the class of hook is stated whether in filter list, the method also includes:
If the title of the class to hook not in the filter list, call it is described circulation to the class to hook into
Row hook.
3. overall situation hook self-repairing method according to claim 2, which is characterized in that it is described shielding with it is described to hook
Class the corresponding collapse class of title, it is described collapse class be cause collapse or exception class after, the method also includes:
Abnormal function is monitored, the abnormal function is for monitoring and recording the corresponding array of the collapse class；
The title of the collapse class in the abnormal function is determined according to the corresponding array of the collapse class；
The title of the collapse class is imported into the filter list.
4. overall situation hook self-repairing method according to claim 1, which is characterized in that described to define a circulation, institute
Circulation, which is stated, for carrying out hook to all classes includes:
Obtain the path of currently running destination application；
Obtain the title and quantity of each class of the destination application；
A for circulation is defined according to the title of each class and quantity, for circulation according to the target for answering
Overall situation hook is carried out to each class with the path of program.
5. overall situation hook self-repairing method according to claim 1, which is characterized in that one variable letter of the definition
Number, the title that the variable function is used to record the class to hook include:
Obtain preset key value；
The array for the collapse class being stored in system storage or initialized data base is called according to the preset key value；
A variable function is defined according to the array of the collapse class, the variable function is used to record the name of the class to hook
Claim.
6. overall situation hook self-repairing method according to claim 1, which is characterized in that described according to the circulation and institute
State the variable function judgement class to hook title whether in filter list include:
Determine the array called in the circulation；
The variable function is determined in the array of the calling；
It determines the title in the variable function to the class of hook, and judges the title of the class to hook whether in filtering name
Dan Zhong.
7. any global hook self-repairing method in -6 according to claim 1, which is characterized in that the method is also wrapped
It includes:
If the quantity for collapsing class in the filter list is greater than threshold value, the class for causing collapse is integrated；
Determine the prefix of the collapse class of same type in the collapse class；
Collapse class with the prefix is subjected to batch shielding.
8. a kind of overall situation hook automatic repariring equipment characterized by comprising
First definition unit, for defining a circulation, the circulation is for carrying out hook to all classes；
Second definition unit, for defining a variable function, the variable function is used to record the title of the class to hook；
Judging unit, for whether being filtered according to the circulation and the variable function judgement title to the class of hook
In list；
First screen unit, if the title of the class to hook in the filter list, for shield with it is described to
The corresponding collapse class of the title of the class of hook, the collapse class is to cause the class of collapse or exception.
9. a kind of overall situation hook is automatically repaired equipment, which is characterized in that including memory, processor and be stored in the memory
Computer program that is upper and can running on the processor, the processor realize such as right when executing the computer program
It is required that global hook self-repairing method described in any one of 1-7.
10. a kind of computer readable storage medium, which is characterized in that including instruction, when described instruction is run on computers,
So that computer executes the global hook self-repairing method as described in any one of claim 1-7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910341769.2A CN110221961A (en) | 2019-04-26 | 2019-04-26 | Global hook self-repairing method, device, equipment and storage medium |
| PCT/CN2019/103162 WO2020215567A1 (en) | 2019-04-26 | 2019-08-29 | Global hook automatic repair method, apparatus, device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910341769.2A CN110221961A (en) | 2019-04-26 | 2019-04-26 | Global hook self-repairing method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110221961A true CN110221961A (en) | 2019-09-10 |
Family
ID=67819920
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910341769.2A Pending CN110221961A (en) | 2019-04-26 | 2019-04-26 | Global hook self-repairing method, device, equipment and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN110221961A (en) |
| WO (1) | WO2020215567A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113110965A (en) * | 2021-03-12 | 2021-07-13 | 北京健康之家科技有限公司 | Abnormal information monitoring method and device, computer storage medium and terminal |
| CN115859311A (en) * | 2023-02-17 | 2023-03-28 | 杭州孝道科技有限公司 | Taint analysis method and system based on shielding hook, storage medium and electronic equipment |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090204980A1 (en) * | 2008-02-11 | 2009-08-13 | Blue Coat Systems, Inc. | Method for implementing ejection-safe API interception |
| CN102831043A (en) * | 2011-06-17 | 2012-12-19 | 阿里巴巴集团控股有限公司 | Monitoring method and device for application program |
| CN106126397A (en) * | 2016-06-19 | 2016-11-16 | 乐视控股（北京）有限公司 | The processing method of program crashing message and system |
| CN108052407A (en) * | 2017-12-13 | 2018-05-18 | 深圳乐信软件技术有限公司 | A kind of application crash means of defence, device, equipment and storage medium |
| CN109582574A (en) * | 2018-11-27 | 2019-04-05 | 平安科技（深圳）有限公司 | A kind of code coverage statistical method, device, storage medium and terminal device |
| CN109656773A (en) * | 2017-10-12 | 2019-04-19 | 卓望数码技术（深圳）有限公司 | A kind of processing frame collapsed extremely based on the application of IOS system |
| CN109669798A (en) * | 2018-12-25 | 2019-04-23 | 北京金山安全软件有限公司 | Crash analysis method, crash analysis device, electronic equipment and storage medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9116717B2 (en) * | 2011-05-27 | 2015-08-25 | Cylance Inc. | Run-time interception of software methods |
| CN104050418B (en) * | 2013-03-13 | 2017-10-13 | 阿里巴巴集团控股有限公司 | A kind of method and apparatus of web browser text background secure print |
| CN104992123A (en) * | 2015-04-16 | 2015-10-21 | 中安比特(江苏)软件技术有限公司 | Database transparency encryption method |
| CN104966018A (en) * | 2015-06-18 | 2015-10-07 | 华侨大学 | Windows system-based software program abnormal behavior analysis method |
| CN106997313B (en) * | 2017-03-28 | 2022-04-05 | 腾讯科技（深圳）有限公司 | Signal processing method and system of application program and terminal equipment |
-
2019
- 2019-04-26 CN CN201910341769.2A patent/CN110221961A/en active Pending
- 2019-08-29 WO PCT/CN2019/103162 patent/WO2020215567A1/en active Application Filing
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090204980A1 (en) * | 2008-02-11 | 2009-08-13 | Blue Coat Systems, Inc. | Method for implementing ejection-safe API interception |
| CN102831043A (en) * | 2011-06-17 | 2012-12-19 | 阿里巴巴集团控股有限公司 | Monitoring method and device for application program |
| CN106126397A (en) * | 2016-06-19 | 2016-11-16 | 乐视控股（北京）有限公司 | The processing method of program crashing message and system |
| CN109656773A (en) * | 2017-10-12 | 2019-04-19 | 卓望数码技术（深圳）有限公司 | A kind of processing frame collapsed extremely based on the application of IOS system |
| CN108052407A (en) * | 2017-12-13 | 2018-05-18 | 深圳乐信软件技术有限公司 | A kind of application crash means of defence, device, equipment and storage medium |
| CN109582574A (en) * | 2018-11-27 | 2019-04-05 | 平安科技（深圳）有限公司 | A kind of code coverage statistical method, device, storage medium and terminal device |
| CN109669798A (en) * | 2018-12-25 | 2019-04-23 | 北京金山安全软件有限公司 | Crash analysis method, crash analysis device, electronic equipment and storage medium |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113110965A (en) * | 2021-03-12 | 2021-07-13 | 北京健康之家科技有限公司 | Abnormal information monitoring method and device, computer storage medium and terminal |
| CN115859311A (en) * | 2023-02-17 | 2023-03-28 | 杭州孝道科技有限公司 | Taint analysis method and system based on shielding hook, storage medium and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2020215567A1 (en) | 2020-10-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109218139B (en) | Gateway test system | |
| CN109697153A (en) | Monitoring method, monitoring system and computer readable storage medium | |
| CN105653630A (en) | Data migration method and apparatus for distributed database | |
| CN106354646B (en) | A method of analysis dump file | |
| CN110221961A (en) | Global hook self-repairing method, device, equipment and storage medium | |
| CN105871587A (en) | Log uploading method and device | |
| CN104991821A (en) | Monitor task batch processing method and apparatus | |
| CN107451060A (en) | A kind of across mobile terminal automated test frame system | |
| CN107273412A (en) | A kind of clustering method of text data, device and system | |
| CN111143403B (en) | SQL conversion method and device and storage medium | |
| CN108446149A (en) | A kind of third party's dynamic bank interface hold-up interception method and system | |
| CN109885310A (en) | A kind of method and device reducing mobile phone games Shader module EMS memory occupation | |
| CN108829430A (en) | Java Web project update method and relevant apparatus based on Eclipse and Tomcat | |
| CN109117172A (en) | A kind of method and device of the terminal versions number identification of target terminal | |
| CN106777368A (en) | Data base query language adaptation method and device, distributed data-storage system | |
| CN106445546B (en) | A kind of creation method and device of event system | |
| CN106997313A (en) | A kind of signal processing method of application program, system and terminal device | |
| CN105955790B (en) | Data processing method and device | |
| CN104010078B (en) | Method and device for processing intercepted information through terminal | |
| CN109063040A (en) | Client-side program collecting method and system | |
| CN105159545A (en) | Method and device for processing popup box on intelligent terminal for test | |
| CN108170459A (en) | Method for upgrading software, intelligent terminal and the device with store function | |
| CN110413311A (en) | ' In System Reconfiguration Method and server | |
| CN110413437A (en) | Network namespace abnormality eliminating method, device, equipment and readable storage medium storing program for executing | |
| CN102420722A (en) | Comprehensive networking automation testing method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |