WO2015074489A1

WO2015074489A1 - Method and apparatus for testing android application program

Info

Publication number: WO2015074489A1
Application number: PCT/CN2014/090259
Authority: WO
Inventors: 柴洪峰; 杨文博; 何朔; 李卷孺; 杨阳; 徐泽伟
Original assignee: 中国银联股份有限公司
Priority date: 2013-11-22
Filing date: 2014-11-04
Publication date: 2015-05-28
Also published as: CN104657259A; CN104657259B

Abstract

The present invention discloses a method and apparatus for testing Android application programs. The method comprises the following steps: A. locate an apparatus program command call; B. monitor the command call and acquire runtime data; C. analyse the acquired runtime data.

Description

Method and device for testing Android application

Technical field

The present invention relates to software testing, and more particularly to a method and apparatus for testing an Android application.

Background technique

In an application, standard cryptographic algorithms and protocols are often used to protect data. However, parameters may be incorrectly set during application development (for example, key length, key content) and/or usage steps (for example, whether to use a certificate, whether to verify the certificate chain), so that security is not To guarantee. To do this, you need to test your application to avoid such problems.

The prior art does not disclose a solution to the above problem. A problem with the static automated test methods of the prior art is that runtime parameters cannot be obtained, and runtime parameters are critical to the analysis of the application's cryptographic algorithms and portions of protocol usage. Dynamic testing methods in the prior art often need to modify the application or add breakpoints to debug, and this will reduce the transparency and stability of the program monitoring. For example, modifying the application may cause the application to run incorrectly and also damage the application. The signature mechanism of the program.

On the other hand, the prior art test methods are only for general-purpose code problems, and cannot be tested and analyzed for specific command calls in the application. For example, a specific security analysis (eg, whether a certificate is missing or tampered with) for an application's cryptographic algorithms and portions of the protocol cannot be performed, making it impossible to test and discover cryptographic algorithms and protocol usage in the application.

To this end, the present invention proposes a method and apparatus for testing an Android application.

Summary of the invention

In accordance with one aspect of the present invention, a method of testing an Android application is disclosed, comprising the steps of:

A: locate the command call of the application,

B: monitor the command call and get the runtime data,

C: Analyze the acquired runtime data.

In one technical solution, step A includes:

Decompilation of the application static code to get the class descriptor;

According to the class descriptor, the positioning command is called.

In one technical solution, step A includes:

Locate the command calls associated with cryptographic algorithms and/or protocol usage.

In one technical solution, step B includes:

The command call is monitored and the runtime data is retrieved using a monitoring module attached to the Zygote process of the Dalvik virtual machine.

In one technical solution, the runtime data is a parameter related to cryptographic algorithms and/or protocol usage.

In one technical solution, in step A, its command call is located in the binary code of the application.

In one technical solution, the command call is a method call or an instruction call.

According to another object of the present invention, an apparatus for testing an Android application is disclosed, including:

A positioning module for locating a command call of an application,

a monitoring module, configured to monitor the command call and obtain runtime data,

An analysis module for analyzing acquired runtime data.

In one technical solution, the positioning module is configured to:

Decompilation of the application static code to get the class descriptor;

According to the class descriptor, the positioning command is called.

In one technical solution, the positioning module is configured to:

In one technical solution, the monitoring module is attached to the Zygote process of the Dalvik virtual machine, thereby monitoring the command call and obtaining runtime data.

In one technical solution, the positioning module locates its command call in the binary code of the application.

The invention dynamically monitors the test program and obtains the operation content of the cryptographic algorithm and the protocol. One advantage of the present invention is that it can actively check the mechanism, mode, problem, and various operational information of the code during the running of the program, so that the summary analysis can be performed in stages, and the code quality related judgment result can be obtained according to the specified standard. In particular, the present invention can directly analyze the binary code of the program without relying on the source code of the program, and when the program is running, the technical solution of the present invention dynamically analyzes the program code loaded in the memory to find the insertion instruction. The location and add specific instructions for program monitoring.

DRAWINGS

Various aspects of the present invention will become apparent to those skilled in the <RTIgt; It should be understood by those skilled in the art that these drawings are only used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of the present invention.

1 is a schematic diagram showing the steps of a method of testing an Android application according to an embodiment of the present invention.

2 is a schematic structural diagram of an apparatus for testing an Android application according to an embodiment of the present invention.

detailed description

Specific embodiments of the present invention will be further described in detail below with reference to the drawings. In the following description, numerous specific details are set forth However, it will be apparent to those skilled in the art that one or more aspects of the various embodiments can be The following description is therefore not to be taken in a limiting

1 is a schematic diagram showing the steps of a method of testing an Android application according to an embodiment of the present invention. As shown in Figure 1, the method includes the following steps:

A: locate the command call of the application,

B: monitor the command call and get the runtime data,

C: Analyze the acquired runtime data.

In step A, a specific command call of the application can be located, such as a command call associated with a cryptographic algorithm and/or protocol usage. A command call can be a method call, an interface call, or a fine-grained instruction call for the application. In one example, the application is statically decompiled to get the class descriptor of the APK program; based on the class descriptor, the method call is filtered to filter out the specific method call.

In step B, the command call is monitored and the runtime data is retrieved using a monitoring module attached to the Zygote process of the Dalvik VM (Dalvik VM).

In one example, its command call is located in the application's binary code.

The programming language used by Android applications is the Java language and runs in the Dalvik VM. One embodiment of the present invention monitors the running of a program by adding a monitoring module to the Dalvik VM. An Android application runs in a corresponding Dalvik virtual machine instance, a virtual machine instance is a separate process space, so in order for the monitoring module to monitor each process, embodiments of the present invention attach the monitoring module to the Zygote process. on.

The Zygote process is a special virtual machine process and an incubator for a virtual machine instance. Whenever an Android application is to be executed, Zygote uses the fork function to create a child process to execute the application. The Zygote process completes the initialization of the virtual machine, the loading of the library, the loading and initialization of the preset class library, etc. When a new virtual machine instance is needed, Zygote provides a process template by copying itself. Therefore, when the monitoring module is loaded on the Zygote process, each newly launched APK program will have a monitoring module in the process space, thereby ensuring the reliability of the monitoring.

During the execution of the APK program, the interpreter is the execution engine of the Dalvik virtual machine, which is responsible for Explain the implementation of dex bytecode (that is, the runnable code that is finally generated after the Android source code is compiled). Dalvik's dex bytecode includes a constant pool (describes all constants, including references, method names, and numeric constants, as well as class definitions, including access permission flags, class names, etc.), and data segments (including all target virtual machine execution methods). The code and the data information associated with the class and method) and the class instance variables, which enable the monitoring module to monitor all the information in a fine-grained manner. In one embodiment, during the interpretation execution of the Dalvik dex bytecode, the monitoring module is used to perform policy matching monitoring on the command call. For example, in the process of matching monitoring, the application is first monitored, then monitored and analyzed for its specific class, and then filtered at the instruction level to obtain instructions related to the use of the cryptographic algorithm/protocol, and finally through the monitoring. The module extracts runtime data to analyze the application (eg, analyze encryption behavior). In one example, the runtime data is a parameter related to cryptographic algorithms and/or protocol usage.

2 is a schematic structural diagram of an apparatus for testing an Android application according to an embodiment of the present invention. As shown in FIG. 2, the device for testing an Android application includes a positioning module, a monitoring module, and an analysis module. The positioning module is configured to locate a command call of the application, the monitoring module is configured to monitor the command call and obtain runtime data, and the analysis module is configured to analyze the acquired runtime data. In one technical solution, the positioning module is configured to perform static code decompilation on the application to obtain a class descriptor; and to locate the method call according to the class descriptor. In one aspect, the positioning module is configured to locate and invoke command commands associated with cryptographic algorithms and/or protocol usage. In one technical solution, the monitoring module is attached to the Zygote process of the Dalvik virtual machine, thereby monitoring the command call and obtaining runtime data. In one technical solution, the runtime data is a parameter related to cryptographic algorithms and/or protocol usage. In one example, the positioning module locates its command call in the application's binary code.

Various changes and substitutions of the specific embodiments of the present invention can be made by those of ordinary skill in the art. Such changes and substitutions are intended to fall within the scope of the appended claims.

Claims

A method of testing an Android application, comprising the steps of:

A: locate the command call of the application,

B: monitor the command call and get the runtime data,

C: Analyze the acquired runtime data.
The method of claim 1 wherein step A comprises:

Decompilation of the application static code to get the class descriptor;

According to the class descriptor, the positioning command is called.
The method of claim 2 wherein step A comprises:

Locate the command calls associated with cryptographic algorithms and/or protocol usage.
The method of claim 3 wherein step B comprises:

The command call is monitored and the runtime data is retrieved using a monitoring module attached to the Zygote process of the Dalvik virtual machine.
The method of claim 4 wherein:

The runtime data is a parameter related to cryptographic algorithms and/or protocol usage.
The method of claim 5 wherein:

In step A, locate its command call in the application's binary code.
The method of claim 6 wherein:

The command call is a method call or an instruction call.
An apparatus for testing an Android application, comprising:

A positioning module for locating a command call of an application,

a monitoring module, configured to monitor the command call and obtain runtime data,

An analysis module for analyzing acquired runtime data.
The apparatus of claim 8 wherein the positioning module is configured to:

Decompilation of the application static code to get the class descriptor;

According to the class descriptor, the positioning command is called.
The apparatus of claim 9 wherein the positioning module is configured to:

Locate the command calls associated with cryptographic algorithms and/or protocol usage.
The device of claim 10 wherein:

The monitoring module is attached to the Zygote process of the Dalvik virtual machine, thereby monitoring the command call and obtaining runtime data.
The device of claim 11 wherein:

The runtime data is a parameter related to cryptographic algorithms and/or protocol usage.
The device of claim 12 wherein:

The positioning module locates its command call in the binary code of the application.
The device of claim 13 wherein:

The command call is a method call or an instruction call.