WO2017028729A1

WO2017028729A1 - Method, apparatus, and electronic device for determining whether an application program is an authorized application program

Info

Publication number: WO2017028729A1
Application number: PCT/CN2016/094449
Authority: WO
Inventors: 舒鑫; 张楠
Original assignee: 北京金山安全软件有限公司
Priority date: 2015-08-19
Filing date: 2016-08-10
Publication date: 2017-02-23
Also published as: CN106469259A; CN106469259B

Abstract

A method, an apparatus, and an electronic device for determining whether an application program is an authorized application program, being capable of conveniently determining whether an application program is authorized. The method for determining whether an application program is an authorized application program comprises: acquiring an executable file of an application program to be identified; determining whether the executable file contains an inner class having no corresponding main class; if the executable file has any inner class that has no definition of a corresponding main class, determining that the application program to be identified is not authorized; otherwise, determining that the application program to be identified is authorized.

Description

Method, device and electronic device for determining whether an application is a genuine application

Cross-reference to related applications

This application claims the priority of the Chinese patent application number "201510511426.8" submitted by Beijing Jinshan Security Software Co., Ltd. on August 19, 2015.

Technical field

The present invention relates to the field of mobile security, and in particular, to a method, device, and electronic device for determining whether an application is a genuine application.

Background technique

With the popularity of the network, a large number of applications to meet the different needs of users have emerged, but the non-genuine applications that have emerged have affected the order of the application market.

In order to be able to identify whether the application is genuine, the prior art generally judges by comparing the application to be identified with the genuine application, or by comparing the signature of the application to be identified with the signature of the genuine application. If the same, it is genuine, otherwise it is non-genuine. However, in the prior art, in order to identify whether the application is genuine, it needs to be judged by the genuine application corresponding to the application, which is inconvenient. For example, when there is no genuine application, it is impossible to determine whether another application is a genuine application.

Summary of the invention

In view of this, the embodiments of the present invention provide a method, an apparatus, and an electronic device for determining whether an application is a genuine application, and can conveniently identify whether the application is genuine.

In order to achieve the above object, embodiments of the present invention adopt the following technical solutions:

In one aspect, an embodiment of the present invention provides a method for determining whether an application is a genuine application, including:

Obtaining an executable file of the application to be identified;

Determining whether the executable file contains an inner class that does not have a corresponding main class;

If the executable file contains an internal class that does not have a corresponding main class, it is determined that the application to be identified is non-genuine, otherwise, it is determined that the application to be identified is genuine.

The method for determining whether an application is a genuine application provided by the embodiment of the present invention, if the executable file of the application to be identified contains an internal class that does not have a corresponding main class, that is, an executable file of the application to be identified The corresponding main class of the inner class that should exist does not exist or is not defined in the executable file of the application to be identified, and the generation process of the executable file of the to-be-identified application and the non-genuine application are described. The process of generating the executable file of the program is the same, thereby determining that the application to be identified is non-genuine, otherwise, determining that the application to be identified is genuine; thus, in the case that there is no genuine application for comparison, It is also convenient to identify whether the application to be identified is genuine.

In another aspect, an embodiment of the present invention provides an apparatus for determining whether an application is a genuine application, including:

An obtaining unit, configured to acquire an executable file of the application to be identified;

a determining unit, configured to determine whether the executable file acquired by the acquiring unit includes an inner class that does not have a corresponding main class;

a determining unit, configured to: if the determining unit determines that the executable file contains an internal class that does not have a corresponding main class, determine that the application to be identified is non-genuine, otherwise, determine the application to be identified It is genuine.

The device for determining whether the application is a genuine application provided by the embodiment of the present invention, if the executable file of the application to be identified contains an internal class that does not have a corresponding main class, that is, an executable file of the application to be identified The corresponding main class of the inner class that should exist does not exist in the executable file of the application to be identified, and the execution process of the executable file of the to-be-identified application and the executable file of the non-genuine application are described. The generation process is the same, thereby determining that the application to be identified is non-genuine, otherwise, determining that the application to be identified is genuine; thus, in the case where there is no genuine application for comparison, the identification can be easily recognized. Whether the application to be identified is genuine.

In still another aspect, an embodiment of the present invention provides an electronic device, including: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor And a memory disposed on the circuit board; a power supply circuit for powering each circuit or device of the electronic device; a memory for storing executable program code; and the processor operating by reading executable program code stored in the memory Execute the program corresponding to the program code to perform the following steps:

Obtaining an executable file of the application to be identified;

The electronic device provided by the embodiment of the present invention, if the executable file of the application to be identified contains an internal class that does not have a corresponding main class, that is, the internal class that should exist in the executable file of the application to be identified If the corresponding main class does not exist in the executable file of the application to be identified, the process of generating the executable file of the to-be-identified application is the same as the process of generating the executable file of the non-genuine application, thereby Determining that the application to be identified is non-genuine, otherwise, determining that the application to be identified is genuine; In the absence of a genuine application to compare, it is also convenient to identify whether the application to be identified is genuine.

In still another aspect, an embodiment of the present invention provides a storage medium, where the storage medium stores one or more modules, when the one or more modules are executed by an electronic device, causing the electronic device to perform:

Obtaining an executable file of the application to be identified;

In still another aspect, an embodiment of the present invention provides an application for performing, at runtime,:

Obtaining an executable file of the application to be identified;

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic flowchart of a method for determining whether an application is a genuine application according to an embodiment of the present application;

2 is a partial flow chart of another embodiment of a method for determining whether an application is a genuine application according to the present application;

3 is a schematic flow chart of an embodiment of S2 in FIG. 1;

4 is a schematic flow chart of an embodiment of S20 in FIG. 3;

FIG. 5 is a schematic flow chart of an embodiment of S201 in FIG. 4;

6 is a schematic flow chart of an embodiment of S21 in FIG. 3;

7 is a schematic flow chart of an embodiment of S2100 in FIG. 6;

8 is a block diagram showing an embodiment of an apparatus for determining whether an application is a genuine application according to an embodiment of the present application;

9 is a block diagram showing an embodiment of an acquisition unit of FIG. 8;

FIG. 10 is a block diagram showing the structure of an embodiment of the determining unit of FIG. 8; FIG.

11 is a block diagram showing the structure of an embodiment of the first determining subunit of FIG. 10;

12 is a block diagram showing the structure of an embodiment of the first determining module of FIG. 11;

FIG. 13 is a block diagram showing the structure of an embodiment of the second determining subunit of FIG. 10; FIG.

14 is a block diagram showing the structure of an embodiment of a corresponding main class name obtaining module in FIG. 13;

FIG. 15 is a schematic structural diagram of an embodiment of an electronic device according to the present application.

detailed description

A method and an apparatus for determining whether an application is a genuine application are described in detail below with reference to the accompanying drawings.

It should be understood that the described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1, an embodiment of the present invention provides a method for determining whether an application is a genuine application, including:

S1. Obtain an executable file of the application to be identified.

S2: Determine whether the executable file contains an inner class that does not have a corresponding main class.

In this embodiment, for example, the main class X has an inner class Y, which can be represented as X$Y; wherein X is the main class of Y, and Y is an inner class of X.

S3. If the executable file includes an internal class that does not have a corresponding main class, determine that the application to be identified is non-genuine, otherwise, determine that the application to be identified is genuine.

In this embodiment, the system environment in which the application to be identified is running may be an Android system or other operating systems, which is not limited by the present invention.

The process of generating an executable file for a non-genuine application is usually to first decompile the genuine executable file into a format file, such as a file in smali format, and then package the decompiled file into a pre-compiled file. A file with the same executable file format. In the process of implementing the present invention, the inventor found that in the process, the original file is often optimized, resulting in the loss of some class names.

The method for determining whether an application is a genuine application provided by the embodiment of the present invention, if the executable file of the application to be identified contains an internal class that does not have a corresponding main class, that is, an executable file of the application to be identified The corresponding main class of the inner class that should exist does not exist in the executable file of the application to be identified, and the execution process of the executable file of the to-be-identified application and the executable file of the non-genuine application are described. The generation process is the same, thereby determining that the application to be identified is non-genuine, otherwise, determining that the application to be identified is genuine; thus, in the case where there is no genuine application for comparison, the identification can be easily recognized. Whether the application to be identified is genuine.

Optionally, in another embodiment of the method for determining whether the application is a genuine application, the application is an application running on an Android operating system;

The obtaining an executable file of the application to be identified includes:

Obtaining an executable file dex file in the application to be identified.

In this embodiment, the dex file is a type of executable file on the Android platform.

Optionally, referring to FIG. 2, in another embodiment of the method for determining whether an application is a genuine application, the obtaining an executable file dex file in the application to be identified includes:

S10. Obtain a file in an apk format of the application to be identified.

S11. Acquire an executable file dex file in the application to be identified by decompressing the file in the apk format.

In this embodiment, if the file in the apk format of the application to be identified is obtained, the file needs to be decompressed, so that the executable file classes.dex can be obtained.

Among them, apk is the abbreviation of AndroidPackage, which is the Android installation package. Package the android sdk compiled project into an installer file in the format apk. It can be installed by directly transferring the apk file to the Android emulator or Android phone.

Optionally, referring to FIG. 3, in another embodiment of the method for determining whether an application is a genuine application, the determining whether the executable file contains an inner class that does not have a corresponding main class (S2) ,include:

S20. Determine whether an internal class exists in the executable file.

S21. If an internal class exists in the executable file, determine whether a corresponding main class of each inner class existing in the executable file exists in the executable file.

S22. If there is an inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file, determining that the executable file does not exist corresponding to the main host The inner class of the class, otherwise, it is determined that the executable file does not contain an inner class that does not have a corresponding main class.

In this embodiment, a class is a definition of an object in an object-oriented programming language, and contains information about the action mode of the object, including names, methods, attributes, and events.

You can define another class inside a class called a nested class, which has two types, statically nested and non-statically nested. Static nested classes are rarely used, the most important of which are non-static nested classes, which are called inner classes.

Optionally, referring to FIG. 4, in another embodiment of the method for determining whether an application is a genuine application, the determining whether an internal class exists in the executable file (S20) includes:

S200. Extract a name list of a class in the executable file from the executable file.

S201. Determine whether an internal class name exists in the name list of the class, and if yes, determine the There is an inner class in the executable file, otherwise it is determined that there is no inner class in the executable.

In this embodiment, it can be conveniently determined whether an internal class exists in the executable file by determining whether the name of the inner class exists in the name list of the class in the executable file.

Optionally, referring to FIG. 5, in another embodiment of the method for determining whether the application is a genuine application, the determining whether the name of the internal class exists in the name list of the class (S201) includes:

S2010. Determine whether a name of the ‘X$Y’ format exists in the name list of the class. Wherein the 'X' and the 'Y' both represent any one or more characters.

S2011, if there is a name in the name of the class in the 'X$Y' format, it is determined that the name of the inner class exists in the name list of the class; otherwise, it is determined that the inner class does not exist in the name list of the class The name.

In this embodiment, since the name of the inner class is in the form of 'X$Y', it is only necessary to determine whether the name of the class in the 'X$Y' format exists in the name list of the class, and it can be determined whether there is an internal name in the name list of the class. Class name: If there is a name in the 'X$Y' format, the name in the 'X$Y' format is the name of the inner class.

Optionally, referring to FIG. 6, in another embodiment of the method for determining whether an application is a genuine application, if there is an internal class in the executable file, determining that the executable file exists Whether the corresponding main class of each inner class exists in the executable file (S21), including:

S210. Obtain a name of a corresponding main class of each inner class existing in the executable file.

S211. Determine whether a name of a corresponding main class of each inner class existing in the executable file exists in a name list of the class.

S212. If the name of the corresponding main class of each inner class existing in the executable file exists in the name list of the class, determine that the corresponding main class of each inner class existing in the executable file is The executable file exists, otherwise, it is determined that there is an inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file.

In this embodiment, the name list of the class includes the names of all the classes in the executable file, and whether the name of the class of the class is the same as the name of the corresponding main class of the inner class existing in the executable file by querying the name list of the class. It is convenient to determine whether there is a corresponding main class of the inner class in the executable file.

Optionally, referring to FIG. 7, in another embodiment of the method for determining whether an application is a genuine application, the acquiring a name of a corresponding main class of each inner class existing in the executable file (S210) ),include:

S2100: If the name of the ‘X$Y’ format exists in the name list of the class, obtain the name of the ‘X$Y’ format existing in the name list of the class.

S2101: Extract a character string of the 'X' part from the name of the 'X$Y' format, that is, a name of a corresponding main class of the inner class 'X$Y'.

In this embodiment, the string of the 'X' part of the name of the 'X$Y' form of the inner class represents the name of the corresponding main class of the inner class, for example, the name of an inner class is Landroid/graphics/PorterDuff$ Mode", the name of the corresponding main class of the inner class is "Landroid/graphics/PorterDuff".

Referring to FIG. 8, an embodiment of the present invention provides an apparatus for determining whether an application is a genuine application, including:

The obtaining unit 1 is configured to obtain an executable file of the application to be identified.

The determining unit 2 is configured to determine whether the executable file acquired by the obtaining unit 1 contains an inner class that does not have a corresponding main class. In this embodiment, for example, the main class X has an inner class Y, which can be represented as X$Y; wherein X is the main class of Y, and Y is an inner class of X.

Determining unit 3, if the determining unit 2 determines that the executable file contains an internal class that does not have a corresponding main class, determining that the application to be identified is non-genuine, otherwise determining the to-be-identified The app is genuine.

As mentioned above, the process of generating executable files for non-genuine applications is usually to first decompile the genuine executable files into a format file, such as a file in smali format, and then package the decompiled files into The same file format as the executable file before decompilation. In the process of implementing the present invention, the inventor found that in the process, the original file is often optimized, resulting in the loss of some class names.

Optionally, in another embodiment of the apparatus of the present invention for determining whether the application is a genuine application, the application is an application running on an Android operating system.

The obtaining unit is configured to acquire an executable file dex file in the application to be identified.

Optionally, referring to FIG. 9, in another embodiment of the apparatus for determining whether an application is a genuine application, the obtaining unit 1 includes:

The first obtaining subunit 10 is configured to acquire a file in an apk format of the application to be identified.

The second obtaining sub-unit 11 is configured to obtain an executable file dex file in the application to be identified by decompressing the file in the apk format acquired by the first obtaining sub-unit 10.

Optionally, referring to FIG. 10, in another embodiment of the apparatus for determining whether an application is a genuine application, the determining unit 2 includes:

The first determining sub-unit 20 is configured to determine whether an internal class exists in the executable file acquired by the obtaining unit 1.

a second determining sub-unit 21, configured to: if the first determining sub-unit 20 determines that an internal class exists in the executable file, determine that a corresponding main class of each inner class existing in the executable file is in the Whether the executable file exists.

Determining the sub-unit 22, if the second judging sub-unit 21 determines that there is an inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file And determining that the executable file contains an inner class that does not have a corresponding main class; otherwise, determining that the executable file does not contain an inner class that does not exist corresponding to the main class.

In this embodiment, a class is a definition of an object in an object-oriented programming language, and contains information about the action mode of the object, including names, methods, attributes, and events. You can define another class inside a class called a nested class, which has two types, statically nested and non-statically nested. Static nested classes are rarely used, the most important of which are non-static nested classes, which are called inner classes.

Optionally, referring to FIG. 11, in another embodiment of the apparatus for determining whether the application is a genuine application, the first determining subunit 20 includes:

The extracting module 200 is configured to extract a name list of the classes in the executable file from the executable file acquired by the obtaining unit 1.

The first determining module 201 is configured to determine whether the name of the internal class exists in the name list of the class extracted by the extraction module 200.

The first determining module 202 is configured to determine that an internal class exists in the executable file if the first determining module 201 determines that a name of an inner class exists in the name list of the class, otherwise, the executable is determined to be executable There are no inner classes in the file.

Optionally, referring to FIG. 12, another embodiment of the apparatus for determining whether an application is a genuine application in the present invention In the embodiment, the first determining module 201 includes:

The judging sub-module 2010 is configured to determine whether a name in the 'X$Y' format exists in the name list of the class extracted by the extraction module 200. Wherein the 'X' and the 'Y' both represent any one or more characters.

Determining a sub-module 2011, if the determining sub-module 2010 determines that a name of the 'X$Y' format exists in the name list of the class, determining that the name of the inner class exists in the name list of the class; otherwise, Determines that the name of the inner class does not exist in the list of names for the class.

Optionally, referring to FIG. 13, in another embodiment of the apparatus for determining whether the application is a genuine application, the second determining sub-unit 21 includes:

The corresponding main class name obtaining module 210 is configured to obtain a name of a corresponding main class of each inner class existing in the executable file.

The second judging module 211 is configured to determine whether the name of the corresponding main class of each inner class existing in the executable file acquired by the corresponding main class name obtaining module 210 exists in the name list of the class. .

a second determining module 212, configured to determine, if the second determining module 211 determines a name of a corresponding main class of each inner class existing in the executable file, exists in a name list of the class, The corresponding main class of each inner class existing in the executable file exists in the executable file; otherwise, it is determined that there is an inner class in each inner class existing in the executable file, and the inner class corresponds to The main class does not exist in the executable.

In this embodiment, the name list of the class includes the names of all the classes in the executable file, and whether the name of the class of the class is the same as the name of the corresponding main class of the inner class existing in the executable file by querying the name list of the class. It is convenient to determine whether the corresponding main class of the inner class exists in the executable file.

Optionally, referring to FIG. 14, in another embodiment of the apparatus for determining whether the application is a genuine application, the corresponding main class name obtaining module 210 includes:

The obtaining sub-module 2100 is configured to: if the determining sub-module 2011 determines that a name of the 'X$Y' format exists in the name list of the class, obtain a name of the 'X$Y' format existing in the name list of the class .

The extraction sub-module 2101 is configured to extract a character string of the 'X' part from the name of the 'X$Y' format acquired by the obtaining sub-module 2100, that is, a corresponding main class of the inner class 'X$Y' The name.

An embodiment of the present invention further provides an electronic device, where the electronic device includes the device described in any of the foregoing embodiments.

FIG. 15 is a schematic structural diagram of an embodiment of an electronic device according to the present invention, which may implement the process of the embodiment shown in FIG. 1-7 of the present invention. As shown in FIG. 15, the electronic device may include: a housing 151, a processor 152, and a memory. 153, a circuit board 154 and a power circuit 155, wherein the circuit board 154 is disposed inside the space enclosed by the housing 151, the processor 152 and the memory 153 are disposed on the circuit board 154; and the power circuit 155 is used for the electronic device Each circuit or device is powered; the memory 153 is for storing executable program code; the processor 152 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 153 for performing the following steps: An executable file of the identified application; determining whether the executable file contains an inner class that does not have a corresponding main class; and if the executable file includes an inner class that does not have a corresponding main class, determining the to-be-identified The application is non-genuine, otherwise it is determined that the application to be identified is genuine.

The description of the embodiment shown in FIG. 1-7 of the present invention is omitted, and the details are not described herein.

The electronic device provided by the embodiment of the present invention, if the executable file of the application to be identified contains an internal class that does not have a corresponding main class, that is, the internal class that should exist in the executable file of the application to be identified If the corresponding main class does not exist in the executable file of the application to be identified, the process of generating the executable file of the to-be-identified application is the same as the process of generating the executable file of the non-genuine application, thereby Determining that the application to be identified is non-genuine, otherwise, determining that the application to be identified is genuine; thus, in the absence of a genuine application for comparison, it is also convenient to identify whether the application to be identified is genuine .

The electronic device exists in a variety of forms including, but not limited to:

(1) Mobile communication devices: These devices are characterized by mobile communication functions and are mainly aimed at providing voice and data communication. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

(2) Ultra-mobile personal computer equipment: This type of equipment belongs to the category of personal computers, has computing and processing functions, and generally has mobile Internet access. Such terminals include: PDAs, MIDs, and UMPC devices, such as the iPad.

(3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio, video players (such as iPod), handheld game consoles, e-books, and smart toys and portable car navigation devices.

(4) Server: A device that provides computing services. The server consists of a processor, a hard disk, a memory, a system bus, etc. The server is similar to a general-purpose computer architecture, but because of the need to provide highly reliable services, processing power and stability High reliability in terms of reliability, security, scalability, and manageability.

(5) Other electronic devices with data interaction functions.

In addition, an embodiment of the present invention further provides a storage medium, where the storage medium stores one or more modules, when the one or more modules are executed by one electronic device, causing the electronic device to execute the determining application. Whether it is a method of a genuine application, the method includes:

Obtaining an executable file of the application to be identified;

The application is an application running on an Android operating system; wherein the obtaining an executable file of the application to be identified includes: acquiring an executable file dex file in the application to be identified.

The obtaining the executable file dex file in the application to be identified includes: acquiring a file in the apk format of the application to be identified; and decompressing the file in the apk format to obtain the application to be identified The executable file dex file in the program.

Determining whether the executable file contains an internal class that does not exist in the executable main class includes: determining whether an internal class exists in the executable file; if an internal class exists in the executable file, determining the Whether the corresponding main class of each inner class existing in the execution file exists in the executable file; if there is any inner class in each inner class existing in the executable file, the corresponding main class of the inner class is If the executable file does not exist, it is determined that the executable file contains an inner class that does not have a corresponding main class. Otherwise, it is determined that the executable file does not contain an inner class that does not have a corresponding main class.

Determining whether an internal class exists in the executable file includes: extracting, from the executable file, a name list of a class in the executable file; determining whether an internal class name exists in the name list of the class If yes, it is determined that there is an inner class in the executable file, otherwise, it is determined that there is no inner class in the executable file.

Determining whether the name of the internal class exists in the name list of the class includes: determining whether a name of the type of 'X$Y' exists in the name list of the class; wherein the 'X' and the 'Y 'each represents any one or more characters; if there is a name in the 'X$Y' format in the name list of the class, it is determined that the name of the inner class exists in the name list of the class; otherwise, the class is determined The name of the inner class does not exist in the name list.

If the internal class exists in the executable file, it is determined whether the corresponding main class of each inner class existing in the executable file exists in the executable file, including: obtaining the executable file The name of the corresponding main class of each inner class that exists; determining whether the name of the corresponding main class of each inner class existing in the executable file exists in the name list of the class; if the executable file is The name of the corresponding main class of each inner class exists, and the corresponding main class of each inner class existing in the executable file is determined to exist in the executable file. Otherwise, it is determined in the executable file There is an inner class in each inner class that exists, and the corresponding main class of the inner class does not exist in the executable file.

And obtaining the name of the corresponding main class of each inner class existing in the executable file, including: if the name of the class in the 'X$Y' format exists in the name list of the class, obtaining the name list in the class The name of the 'X$Y' format; the string of the 'X' part is extracted from the name of the 'X$Y' format, which is the name of the corresponding main class of the inner class 'X$Y'.

In addition, the embodiment of the present invention further provides an application program, where the application program performs the method for determining whether the application is a genuine application according to the foregoing embodiment, and the method is not described herein again.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. All should be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

A method of determining whether an application is a genuine application, comprising:

Obtaining an executable file of the application to be identified;

Determining whether the executable file contains an inner class that does not have a corresponding main class;

If the executable file contains an internal class that does not have a corresponding main class, it is determined that the application to be identified is non-genuine, otherwise, it is determined that the application to be identified is genuine.
The method for determining whether an application is a genuine application according to claim 1, wherein the application is an application running on an Android operating system;

The obtaining an executable file of the application to be identified includes:

Obtaining an executable file dex file in the application to be identified.
The method for determining whether an application is a genuine application according to claim 2, wherein the obtaining an executable file dex file in the application to be identified comprises:

Obtaining a file in the apk format of the application to be identified;

The executable file dex file in the application to be identified is obtained by decompressing the file in the apk format.
The method for determining whether an application is a genuine application according to any one of claims 1 to 3, wherein the determining whether the executable file contains an internal class that does not have a corresponding main class comprises:

Determining whether an internal class exists in the executable file;

If an internal class exists in the executable file, determining whether a corresponding main class of each inner class existing in the executable file exists in the executable file;

If there is any inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file, it is determined that the executable file does not have a corresponding main class The inner class, otherwise, determines that the executable file does not contain an inner class that does not have a corresponding main class.
The method for determining whether an application is a genuine application according to claim 4, wherein the determining whether the internal class exists in the executable file comprises:

Extracting a list of names of classes in the executable file from the executable file;

Determining whether the name of the inner class exists in the name list of the class, and if so, determining that the inner class exists in the executable file; otherwise, determining that the inner class does not exist in the executable file.
The method for determining whether an application is a genuine application according to claim 5, wherein the determining whether the name of the internal class exists in the name list of the class comprises:

Determining whether there is a name in the name list of the class in the 'X$Y' format; wherein the 'X' is related to the ‘Y’ means any one or more characters;

If there is a name in the 'X$Y' format in the name list of the class, it is determined that the name of the inner class exists in the name list of the class; otherwise, it is determined that the name of the inner class does not exist in the name list of the class .
The method for determining whether an application is a genuine application according to claim 5 or 6, wherein if there is an inner class in the executable file, determining each inner class existing in the executable file Whether the corresponding main class exists in the executable file, including:

Obtaining a name of a corresponding main class of each inner class existing in the executable file;

Determining whether a name of a corresponding main class of each inner class existing in the executable file exists in a name list of the class;

If the name of the corresponding main class of each inner class existing in the executable file exists in the name list of the class, determining that the corresponding main class of each inner class existing in the executable file is in the The executable file exists, otherwise, it is determined that there is an inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file.
The method for determining whether an application is a genuine application according to claim 7, wherein the obtaining a name of a corresponding main class of each internal class existing in the executable file comprises:

If the name of the ‘X$Y’ format exists in the name list of the class, the name of the ‘X$Y’ format existing in the name list of the class is obtained;

The character string of the 'X' part is extracted from the name of the 'X$Y' format, that is, the name of the corresponding main class of the inner class 'X$Y'.
A device for determining whether an application is a genuine application, comprising:

An obtaining unit, configured to acquire an executable file of the application to be identified;

a determining unit, configured to determine whether the executable file acquired by the acquiring unit includes an inner class that does not have a corresponding main class;

a determining unit, configured to: if the determining unit determines that the executable file contains an internal class that does not have a corresponding main class, determine that the application to be identified is non-genuine, otherwise, determine the application to be identified It is genuine.
The device for determining whether an application is a genuine application according to claim 9, wherein the application is an application running on an Android operating system;

The obtaining unit is configured to acquire an executable file dex file in the application to be identified.
The device for determining whether an application is a genuine application according to claim 10, wherein the obtaining unit comprises:

a first obtaining subunit, configured to acquire a file in an apk format of the application to be identified;

And a second obtaining subunit, configured to obtain an executable file dex file in the application to be identified by decompressing the file in the apk format acquired by the first obtaining subunit.
The device for determining whether an application is a genuine application according to any one of claims 9 to 11, wherein the determining unit comprises:

a first determining subunit, configured to determine whether an internal class exists in the executable file acquired by the acquiring unit;

a second determining subunit, configured to: if the first determining subunit determines that an internal class exists in the executable file, determine that a corresponding main class of each inner class existing in the executable file is in the executable file Whether it exists in both;

Determining a subunit, configured to: if the second judging subunit determines that there is an inner class in each inner class existing in the executable file, and the corresponding main class of the inner class does not exist in the executable file, Determining that the executable file contains an inner class that does not have a corresponding main class. Otherwise, it is determined that the executable file does not contain an inner class that does not have a corresponding main class.
The device for determining whether an application is a genuine application according to claim 12, wherein the first determining subunit comprises:

An extracting module, configured to extract, from the executable file acquired by the obtaining unit, a name list of a class in the executable file;

a first determining module, configured to determine whether an internal class name exists in the name list of the class extracted by the extracting module;

a first determining module, configured to determine that an internal class exists in the executable file if the first determining module determines that a name of an inner class exists in the name list of the class, otherwise, determine the executable file There are no inner classes.
The device for determining whether an application is a genuine application according to claim 13, wherein the first determining module comprises:

a judging sub-module, configured to determine whether the name list of the class extracted by the extracting module exists

a name of the 'X$Y' format; wherein the 'X' and the 'Y' both represent any one or more characters;

Determining a submodule, if the determining submodule determines that a name of the 'X$Y' format exists in the name list of the class, determining that the name of the inner class exists in the name list of the class; otherwise, determining the The name of the inner class does not exist in the name list of the class.
The device for determining whether an application is a genuine application according to claim 13 or 14, wherein the second determining subunit comprises:

Corresponding to the main class name obtaining module, configured to obtain a corresponding main body of each inner class existing in the executable file The name of the class;

a second judging module, configured to determine whether a name of a corresponding main class of each inner class existing in the executable file acquired by the corresponding main class name obtaining module exists in the name list of the class;

a second determining module, configured to: if the second determining module determines, for a name of a corresponding main class of each inner class existing in the executable file, exists in a name list of the class, determining the Corresponding main classes of each inner class existing in the executable file exist in the executable file; otherwise, it is determined that there is an inner class in each inner class existing in the executable file, and the corresponding main body of the inner class The class does not exist in the executable.
The apparatus for determining whether an application is a genuine application according to claim 15, wherein the corresponding main class name obtaining module comprises:

Obtaining a sub-module, if the determining sub-module determines that a name of the ‘X$Y’ format exists in the name list of the class, and obtaining a name of the “X$Y” format existing in the name list of the class;

An extraction submodule, configured to extract a string of the 'X' part from the name of the 'X$Y' format obtained by the obtaining submodule, that is, a name of a corresponding main class of the inner class 'X$Y' .
An electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside a space enclosed by the housing, and the processor and the memory are disposed in the circuit a power supply circuit for supplying power to each circuit or device of the electronic device; a memory for storing executable program code; and a processor for operating the executable program code by reading executable program code stored in the memory A program for performing the method of determining whether an application is a genuine application according to any one of claims 1 to 8.
A storage medium, wherein the storage medium stores one or more modules, when the one or more modules are executed by an electronic device, causing the electronic device to:

A method of determining whether an application is a genuine application according to any one of claims 1 to 8.
An application, characterized in that, at runtime, a method of determining whether an application is a genuine application according to any one of claims 1 to 8.