WO2018233379A1

WO2018233379A1 - Method and device for obtaining data plaintext, electronic terminal, and readable storage medium

Info

Publication number: WO2018233379A1
Application number: PCT/CN2018/085151
Authority: WO
Inventors: 周志刚; 陈少杰; 张文明
Original assignee: 武汉斗鱼网络科技有限公司
Priority date: 2017-06-23
Filing date: 2018-04-28
Publication date: 2018-12-27
Also published as: CN107277019B; CN107277019A

Abstract

The present application provides a method and device for obtaining data plaintext, an electronic terminal, and a readable storage medium. The method for obtaining data plaintext may be applied in an electronic terminal, and a browser is installed in the electronic terminal. The method comprises: monitoring, after starting a target website in the browser, the startup process of the target website, and searching for a process point of a hypertext transfer protocol corresponding to the target website before encryption; and obtaining plaintext information corresponding to the target website at the process point. The present application facilitates efficient obtaining of plaintext information corresponding to a target website, and helps to further resolve problems occurring to the target website.

Description

Data clear text acquisition method, device, electronic terminal and readable storage medium

Cross-reference to related applications

This application claims the priority of the Chinese Patent Application entitled "Data Clearance Acquisition Method, Apparatus, Electronic Terminal and Readable Storage Medium" submitted by the Chinese Patent Office on June 23, 2017, with the application number of 2017104876051. The citations are incorporated herein by reference.

Technical field

The present application relates to the field of computer technology, and in particular, to a data clear text acquisition method, apparatus, electronic terminal, and readable storage medium.

Background technique

At present, with the popularity of network security, more and more websites use HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) to transmit network protocols. HTTPS is a more secure HTTP. aisle. For the traditional HTTP, the network transmits the plaintext information of the data, and the network packet capture tool can obtain all the plaintext information of the HTTP, and the security is poor. In contrast, the data transmitted by the HTTPS is encrypted, and the network packet capture tool cannot obtain the plaintext information of the network data transmitted by the HTTPS, thereby effectively improving the security of the network data transmission.

However, when HTTPS is used to improve security, the following problems exist: the network packet capture tool is difficult to obtain the plaintext information of the HTTPS, and the problems encountered in the program are difficult to locate.

Application content

In view of this, the purpose of the present application includes providing a data plaintext acquisition method, apparatus, electronic terminal, and readable storage medium.

The data clear text obtaining method provided by the present application is applied to an electronic terminal, and a browser is installed in the electronic terminal, and the data clear text obtaining method includes:

After starting a target website in the browser, monitoring a startup process of the target website, and searching for a process point before the encryption of the hypertext transfer protocol corresponding to the target website;

Obtaining the plaintext information corresponding to the target website at the process point.

In a preferred embodiment, the step of acquiring the plaintext information corresponding to the target website at the process point includes:

Inserting a hook function at the process point, and acquiring the plaintext information of the target website by using the hook function.

In a preferred embodiment, the step of performing a hook function at the process point includes:

Inserting a hook function at the process point;

The hypertext transfer protocol corresponding to the target website currently being executed is jumped to the hook function preset to be executed by the hook function.

In a preferred embodiment, the step of acquiring the plaintext information of the target website by using the hook function includes:

Executing the hook function before encrypting the plaintext information;

And obtaining, by the hook function, a target parameter that is pushed into the stack, and acquiring a network packet before encryption according to the target parameter; wherein the network packet before encryption includes plaintext information of the target website.

In a preferred embodiment, before the step of performing a hook function at the process point to obtain the plaintext information of the target website by using the hook function, the method further includes:

Reverse analysis of the startup process of the startup website in the browser is performed by a reverse static analysis tool and a reverse dynamic debugging tool to obtain a process point before the website performs hypertext transfer protocol encryption.

In a preferred embodiment, the static analysis tool is an interactive disassembler; the dynamic debugging tool is an assembly-analysis debugger with a visual interface.

In a preferred embodiment, after the step of acquiring the plaintext information corresponding to the target website at the process point, the method further includes:

Write the plaintext information into a log file; or,

Printing the plaintext information to a debug window to display the plaintext information in the debug window; or

Send the plaintext information to a specified terminal or server.

The application also provides a data plaintext obtaining device, which is applied to an electronic terminal, wherein the electronic terminal is equipped with a browser, and the data plaintext obtaining device includes:

a monitoring module, configured to monitor a startup process of the target website after starting a target website in a browser, and search for a process point before the encryption of the hypertext transfer protocol corresponding to the target website;

The obtaining module is configured to obtain the plaintext information corresponding to the target website at the process point.

In a preferred embodiment, the obtaining module includes:

Inserting a unit configured to insert and execute a hook function at the process point;

And an obtaining unit configured to acquire the plaintext information of the target website by using the hook function.

In a preferred embodiment, the insertion unit is configured to: insert a hook function at the process point; and use the hook function to jump the current hypertext transfer protocol corresponding to the target website in the process before encryption Go to the hook function that is preset to be executed.

In a preferred embodiment, the obtaining unit is configured to: execute the hook function before encrypting the plaintext information; acquire a target parameter pushed into the stack by using the hook function, and obtain the pre-encrypted based on the target parameter a network data packet; wherein the pre-encrypted network data packet includes plaintext information of the target website.

In a preferred embodiment, the data plaintext obtaining device further includes:

The search module is configured to perform reverse analysis on the startup process of the startup website in the browser by using a reverse static analysis tool and a reverse dynamic debugging tool to obtain a process point before the website performs hypertext transfer protocol encryption.

Writing to the module, configured to write the plaintext information into a log file;

a printing module configured to print the plaintext information to a debug window to display the plaintext information in the debug window;

The sending module is configured to send the plaintext information to the designated terminal or the server.

The application also provides an electronic terminal, including:

Memory

processor;

The above-described data plaintext acquisition device installed/stored in the memory and executed by the processor.

The present application also provides a readable storage medium having stored thereon a computer program that implements the above-described data plaintext acquisition method when executed.

Compared with the prior art, the data clear text obtaining method, device, electronic terminal and readable storage medium of the present application monitor the startup process of the target website, and find the hypertext transfer protocol corresponding to the target website before encryption. a process point, which can obtain the plaintext information corresponding to the target website from the process point; and the network capture tool in the prior art is encrypted because the data transmitted by the HTTPS is difficult to obtain the plaintext information of the HTTPS, and it is difficult to locate the problem of the website. In this way, the method provided by the present application can obtain the plaintext information corresponding to the target website before the network data of the target website is encrypted, which helps to further locate the problem of the target website.

The above described objects, features, and advantages of the present invention will become more apparent from the following description.

DRAWINGS

In order to more clearly illustrate the technical solutions of the present application, the drawings to be used in the embodiments will be briefly described below. It should be understood that the following drawings show only certain embodiments of the present application and therefore should not be It is considered to be a limitation on the scope, and other related drawings may be obtained according to the drawings without any creative work for those skilled in the art.

FIG. 1 is a schematic block diagram of an electronic terminal according to a preferred embodiment of the present application.

FIG. 2 is a flowchart of a method for acquiring a plaintext data according to a preferred embodiment of the present application.

FIG. 3 is a flowchart of a method for acquiring a plaintext data according to another embodiment of the present application.

4 is a schematic diagram of functional modules of a data plaintext obtaining apparatus according to a preferred embodiment of the present application;

FIG. 5 is a schematic diagram of functional modules of a data plaintext obtaining apparatus according to another preferred embodiment of the present application.

Detailed ways

The technical solutions in the embodiments provided in the present application are clearly and completely described in the following with reference to the embodiments of the present application. It is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. . The components of the embodiments provided herein, which are generally described and illustrated in the figures herein, may be arranged and designed in various different configurations. The detailed description of the embodiments of the present application, which is set forth in the claims All other embodiments obtained by a person skilled in the art based on the embodiments of the present application without creative efforts are within the scope of the present application.

It should be noted that similar reference numerals and letters indicate similar items in the following figures. Therefore, once an item is defined in one figure, it is not necessary to further define and explain it in the subsequent figures. Also, in the description of the present application, the terms "first", "second", and the like are used merely to distinguish a description, and are not to be construed as indicating or implying a relative importance.

As shown in FIG. 1, it is a block schematic diagram of an electronic terminal 100. The electronic terminal 100 includes a data plaintext acquiring device 110, a memory 111, a memory controller 112, a processor 113, a peripheral interface 114, and an input and output unit 115.

The components of the memory 111, the memory controller 112, the processor 113, the peripheral interface 114, and the input and output unit 115 are electrically connected directly or indirectly to each other to implement data transmission or interaction. For example, the components can be electrically connected to one another via one or more communication buses or signal lines. The data plaintext obtaining device 110 includes at least one software function module that can be stored in the memory 111 or solidified in an operating system (OS) of the electronic terminal 100 in the form of software or firmware. The processor 113 is configured to execute an executable module stored in a memory, such as a software function module or a computer program included in the data plaintext acquiring device 110.

In this embodiment, the memory 111 further stores an executable module of each function in the browser, and the processor 113 executes the executable module of the browser stored in the memory 111.

The memory 111 can be, but not limited to, a random access memory (RAM), a read only memory (ROM), and a programmable read-only memory (PROM). Erasable Programmable Read-Only Memory (EPROM), Electric Erasable Programmable Read-Only Memory (EEPROM), and the like. The memory 111 is used to store a program, and the processor 113 executes the program after receiving the execution instruction. The method executed by the electronic terminal 100 defined by the process disclosed in any embodiment of the present application may be applied to the processor 113. Medium or implemented by processor 113.

The processor 113 may be an integrated circuit chip with signal processing capabilities. The processor 113 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP processor, etc.), or a digital signal processor (DSP), an application specific integrated circuit. (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. The methods, steps, and logical block diagrams disclosed in this application can be implemented or executed. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

The peripheral interface 114 couples various input/input devices to the processor 113 and the memory 111. In some embodiments, peripheral interface 114, processor 113, and memory controller 112 can be implemented in a single chip. In other instances, they can be implemented by separate chips.

The input and output unit 115 is configured to provide input data to the user. The input and output unit 115 may be, but not limited to, a mouse, a keyboard, and the like.

It can be seen that FIG. 1 is only a schematic structure of the electronic terminal 100 shown in the figure. The electronic terminal 100 in this embodiment may have more or less components than FIG. 1 . Of course, the electronic terminal 100 may also be 1 completely different components.

The above electronic terminal 100 provided by the present application includes but is not limited to: a server, a personal computer (PC), a tablet computer, a personal digital assistant (PDA), a mobile internet device (MID), and a smart device. Mobile phones or portable wearable devices, etc.

Please refer to FIG. 2 , which is a flowchart of a method for acquiring data plaintext applied to the electronic terminal 100 shown in FIG. 1 according to a preferred embodiment of the present application. The specific flow shown in FIG. 2 will be described in detail below.

Step S101, starting a target website in the browser.

In one example, the browser of the electronic terminal launches the target website after receiving a selection operation of the user selecting a target website. Specifically, a browser can be installed on the electronic terminal, and the user can input the website address of the desired website (that is, the target website) in the browser, or select the desired website on the website shortcut interface of the browser (also That is, the target website). The electronic terminal determines the target website through the browser and launches the target website.

Step S102, monitoring the startup process of the target website, and searching for a process point before the encryption of the hypertext transfer protocol corresponding to the target website. In other embodiments, the data plaintext acquisition method may not include step S101. Step S102 is performed in the browser directly started in step S102; or, when the electronic terminal monitors that the target website is started, step S102 is performed.

Step S103: Obtain the plaintext information corresponding to the target website at the process point.

In this embodiment, before the step S103, the method further includes: performing a reverse analysis on the startup process of starting the website in the browser by using a reverse static analysis tool and a reverse dynamic debugging tool to obtain a website for super The process point before the text transfer protocol is encrypted. Reverse analysis includes static analysis and dynamic analysis; among them, static analysis is the behavior of reverse analysis when the program is not running, and dynamic analysis is the behavior of reverse analysis when the program is dynamically running in the order of instructions.

In this embodiment, the static analysis tool may be IDA Pro (Interactive Disassembler Professional, Interactive Disassembler Professional). Among them, IDA Pro is a static reverse decompilation tool for disassembly and dynamic debugging.

In this embodiment, the dynamic debugging tool may be Ollydbg. Ollydbg is a 32-bit assembly-analysis debugger with a visual interface. It is also the current dynamic trace debugging tool for reverse engineering. One of the biggest features of Ollydbg is the more powerful analysis. Specifically, Ollydbg can analyze function procedures, loop statements, select statements, tables, constants, strings in code, tricky constructs, API calls, and the number of arguments in a function. Ollydbg's analysis capabilities increase the readability of the binary code, reducing the possibility of errors and making our debugging work easier.

In one example, the SSL library is invoked by the browser to send the network data packet to be sent before the browser sends the network data packet of the target website by disassembling the analysis. Therefore, the plaintext information of all networks sent by the browser can be obtained before encryption. In an embodiment, the electronic terminal launches the website in the browser by using a reverse static analysis tool IDA Pro (Interactive Disassembler Professional) and a reverse dynamic debugging tool Ollydbg. The process performs a reverse analysis. Through the above reverse analysis, the network data packets of all the websites are finally sent by the Socket function of the calling system to send the network data packets. In an embodiment, the electronic terminal may break points on the network sending function WSASend by using the dynamic debugging tool. When a network data packet needs to be sent, it is interrupted when it reaches the process point of the WSASend function. At this time, the calling function call stack of the WSASend function is called, and the function call stack is called to find the network packet to be sent. In the previous function logic, you can find the function of clear text information using SSL encryption. In this embodiment, the information included in the network data packet before encryption is the plaintext information.

In one example, the specific implementation of the previous function logic by calling the function call stack to look up the network packet is as follows:

Among them, the content enclosed by asm{} indicates that the assembly code is embedded in the C language.

Among them, the push assembly instruction pushes the plaintext network information netdata into the stack.

Among them, SSLThis is the instantiation object of the SSL library, and is passed to the ecx register.

Among them, the function SSL_Encode is used to encrypt network packets.

Therefore, the sequence of the above stack can be found in the process point before the website performs hypertext transfer protocol encryption.

The step S103 includes: executing a hook function at the process point, and acquiring the plaintext information of the target website by using the hook function. Among them, the hook function is part of the computer Windows message processing mechanism. By setting a "hook", the application can filter all messages and events at the system level to access messages that are normally inaccessible. The essence of a hook is a program that processes system messages and hooks it into the system through system calls. Whenever a particular message is sent, the hook program can first capture the message before it reaches the destination window, ie the hook function gets control first. In practice, there are many types of hook functions, and each type of hook function enables an application to monitor different types of system message processing mechanisms. The hook function inserted in this embodiment is mainly used to obtain the plaintext information of the target website.

In an embodiment, the electronic terminal searches the process point that the browser specifically encrypts the network data packet by using the static analysis tool and the dynamic debugging tool, and executes the hook before encrypting the plaintext information. And obtaining, by the hook function, a target parameter that is pushed into the stack, and acquiring a network packet before encryption according to the target parameter; wherein the network packet before encryption includes plaintext information of the target website.

In a specific implementation, the hook function is executed before the calling function SSL_Encode is encrypted, so that the hook function can obtain the target parameter netdata pushed into the stack, and the network packet before encryption can be obtained, wherein the encryption is performed. The previous network packet includes all plaintext information.

In one example, the hook function can be implemented in the following manner.

The hook function prototype is as follows:

In this embodiment, the read/write file function of the system may also be called in the hook function to write the plaintext information into the log file.

In another embodiment, a hypertext transfer protocol corresponding to the target website is inserted at a process point before encryption to insert a hook function, and the hook function is used to execute a hypertext transfer protocol corresponding to the target website. The process before encryption jumps to the hook function, thereby implementing the step of inserting the execution hook function at the process point. In one example, the instruction prior to the call SSL_Encode assembly code is modified into a JUMP instruction such that the execution flow of the assembly code jumps from the original flow to the hook function to read or print the plaintext Information, when the execution of the hook function is completed, the original assembly code continues to execute. In this way, a function function for printing network information can be inserted in the original assembly code execution flow, so that all network plaintext information can be obtained.

For ease of understanding, the present embodiment further explains the insertion process of the above hook function as follows: In an embodiment, a module is injected into the browser process by calling an API function provided by the Windows system. In one example, a remote thread is created in the browser process via the Windows system API function CreateRemoteThread. The remote thread may be a thread created in a browser process. In this example, the created remote thread calls the system function LoadLibrary to load the module that needs to be injected into the browser process, such as the hook function described above.

In this example, the module is injected into the browser process by calling an API function provided by the Windows system, and the specific implementation is as follows.

a. Allocate memory in the memory space of the target process through the VirtualAllocEx function in the Windows API function.

b. Write the disk path of the pre-written module to be injected to the memory already allocated in step a through the WriteProcessMemory function in the Windows API function.

c. Call the CreateRemoteThread function in the Windows API function to create a thread in the target process. The execution logic of the thread is to call the Windows API function LoadLibrary to load the disk path of the injection module written in the target process space in step b.

In the above manner, the hook function can be inserted into the process point before the encryption of the hypertext transfer protocol corresponding to the target website, that is, the hook function is injected into the browser process.

The data clear text obtaining method provided by the embodiment of the present application can obtain the encrypted information by acquiring the plaintext information of the target website before the network data of the target website is encrypted, by monitoring the startup process of the target website. The plaintext information corresponding to the website helps to further solve the problems of the target website.

In other embodiments, as shown in FIG. 3, after the step S103, the method further includes steps S104 to S106, and the foregoing steps are specifically described below.

Step S104: Write the plaintext information into a log file.

Step S105, printing the plaintext information into a debugging window to display the plaintext information in the debugging window.

Step S106: Send the plaintext information to a designated terminal or server. In one example, the designated terminal may be an electronic terminal corresponding to a developer who needs the plaintext information.

According to the method in the foregoing embodiment, by storing, transmitting, or displaying the plaintext information at the target location, the developer can conveniently obtain the plaintext information, which is helpful for the developer to further locate the target website based on the obtained plaintext information. problem.

Referring to FIG. 4, it is a schematic diagram of functional modules of the data plaintext obtaining apparatus 110 shown in FIG. 1 according to a preferred embodiment of the present application. The data plaintext obtaining apparatus 110 in this embodiment is used to execute the respective steps in the above embodiments. The data plaintext obtaining device 110 includes a booting module 1101, a monitoring module 1102, and an obtaining module 1103.

The startup module 1101 is configured to launch a target website in a browser.

The monitoring module 1102 is configured to monitor a startup process of the target website to find a process point before the encryption of the hypertext transfer protocol corresponding to the target website. In other embodiments, the startup module 1101 can also be omitted. The monitoring module 1102 monitors whether there is activation of the target website.

The obtaining module 1103 is configured to acquire the plaintext information corresponding to the target website at the process point.

The above-mentioned data plaintext obtaining device provided by the embodiment can obtain the plaintext information corresponding to the target website before the network data of the target website is encrypted, which helps to further locate the problem of the target website.

In a specific implementation, the obtaining module 1103 includes: an inserting unit configured to insert and execute a hook function at the process point; and an acquiring unit configured to acquire the plaintext information of the target website by using the hook function.

In an embodiment, the inserting unit is further configured to: insert a hook function at the process point; and execute, by the hook function, a process jump of a hypertext transfer protocol corresponding to the target website currently being executed before encryption To the preset hook function to be executed. The obtaining unit is further configured to: execute the hook function before encrypting the plaintext information; acquire a target parameter pushed into the stack by using the hook function, and obtain a network packet before encryption based on the target parameter; wherein The network packet before encryption includes the plaintext information of the target website.

In this embodiment, referring to FIG. 5, on the basis of FIG. 4, FIG. 5 further illustrates that the data plaintext obtaining apparatus includes: a searching module 1104 configured to perform the browsing by using a reverse static analysis tool and a dynamic debugging tool. The startup process of the startup website is reverse-analyzed to obtain the process point before the website encrypts the hypertext transfer protocol. The static analysis tool may be an interactive disassembler; the dynamic debugging tool may be an assembly-analysis debugger with a visual interface.

In this embodiment, the data plaintext obtaining device further includes: a writing module 1105, a printing module 1106, and a sending module 1107.

The writing module 1105 is configured to write the plaintext information into a log file.

The printing module 1106 is configured to print the plaintext information to a debug window to display the plaintext information in the debug window.

The sending module 1107 is configured to send the plaintext information to a designated terminal or a server.

For further details of the data plaintext obtaining apparatus of the present embodiment, reference may be made to the description in the foregoing method embodiments, and details are not described herein again.

In summary, the data plaintext obtaining apparatus of the present application monitors the startup process of the target website, and searches for a process point before the encryption of the hypertext transfer protocol corresponding to the target website, and then obtains the target from the process point. The plaintext information corresponding to the website; compared with the prior art, the network packet capture tool is encrypted because the data transmitted by the HTTPS is difficult to obtain the plaintext information of the HTTPS, and the problem of the website problem is difficult to locate. Before the network data of the website is encrypted, the plaintext information corresponding to the target website is obtained, which helps to further locate the problem of the target website.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may also be implemented in other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and functionality of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present application. operating. In this regard, each block of the flowchart or block diagram can represent a module, a program segment, or a portion of code that includes one or more of the Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may also occur in a different order than those illustrated in the drawings. For example, two consecutive blocks may be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented in a dedicated hardware-based system that performs the specified function or action. Or it can be implemented by a combination of dedicated hardware and computer instructions.

In addition, each functional module in each embodiment of the present application may be integrated to form a separate part, or each module may exist separately, or two or more modules may be integrated to form a separate part.

The functions, if implemented in the form of software functional modules and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. . It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is any such actual relationship or order between them. Furthermore, the term "comprises" or "comprises" or "comprises" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element defined by the phrase "comprising a ...", without further limitation, does not exclude the presence of additional identical elements in the process, method, article or device that comprises the element.

The above description is only the preferred embodiment of the present application, and is not intended to limit the present application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application are intended to be included within the scope of the present application. It should be noted that similar reference numerals and letters indicate similar items in the following figures. Therefore, once an item is defined in one figure, it is not necessary to further define and explain it in the subsequent figures.

The foregoing is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application. It should be covered by the scope of protection of this application. Therefore, the scope of protection of the present application should be determined by the scope of the claims.

Industrial applicability:

By applying the technical solution of the present application, the plaintext information corresponding to the target website can be obtained before the network data of the target website is encrypted, which helps to further locate the problem of the target website.

Claims

A data plaintext obtaining method is applied to an electronic terminal, and a browser is installed in the electronic terminal, wherein the data clear text obtaining method includes:

After starting a target website in the browser, monitoring a startup process of the target website, and searching for a process point before the encryption of the hypertext transfer protocol corresponding to the target website;

Obtaining the plaintext information corresponding to the target website at the process point.
The method for obtaining the plaintext information of the target website according to claim 1, wherein the step of acquiring the plaintext information corresponding to the target website at the process point comprises:

Inserting a hook function at the process point, and acquiring the plaintext information of the target website by using the hook function.
The data plaintext acquisition method according to claim 2, wherein the step of inserting a hook function at the process point comprises:

Inserting a hook function at the process point;

The hypertext transfer protocol corresponding to the target website currently being executed is jumped to the hook function preset to be executed by the hook function.
The method of claim 2, wherein the step of acquiring the plaintext information of the target website by using the hook function comprises:

Executing the hook function before encrypting the plaintext information;

And obtaining, by the hook function, a target parameter that is pushed into the stack, and acquiring a network packet before encryption according to the target parameter; wherein the network packet before encryption includes plaintext information of the target website.
The data plaintext obtaining method according to claim 2, wherein the method further comprises: before the step of inserting a hook function at the process point, and acquiring the plaintext information of the target website by using the hook function, the method further include:

Reverse analysis of the startup process of the startup website in the browser is performed by a reverse static analysis tool and a reverse dynamic debugging tool to obtain a process point before the website performs hypertext transfer protocol encryption.
The data plaintext acquisition method according to claim 5, wherein the static analysis tool is an interactive disassembler; and the dynamic debugging tool is an assembly-analysis debugger having a visual interface.
The method for obtaining a plaintext data according to any one of claims 1-6, wherein after the step of acquiring the plaintext information corresponding to the target website at the process point, the method further includes:

Write the plaintext information into a log file; or,

Printing the plaintext information to a debug window to display the plaintext information in the debug window; or

Send the plaintext information to a specified terminal or server.
A data plaintext obtaining device is applied to an electronic terminal, and a browser is installed in the electronic terminal, wherein the data clear text obtaining device comprises:

The monitoring module is configured to monitor a startup process of the target website after starting a target website in the browser, and search for a process point before the encryption of the hypertext transfer protocol corresponding to the target website;

The obtaining module is configured to obtain the plaintext information corresponding to the target website at the process point.
The data plaintext obtaining apparatus according to claim 8, wherein the obtaining module comprises:

Inserting a unit configured to insert and execute a hook function at the process point;

And an obtaining unit configured to acquire the plaintext information of the target website by using the hook function.
The data plaintext obtaining apparatus according to claim 9, wherein the inserting unit is configured to: insert a hook function at the flow point; and perform hypertext transfer corresponding to the target website currently by the hook function The protocol before the encryption jumps to the hook function that is preset to be executed.
The data plaintext obtaining apparatus according to claim 9, wherein the obtaining unit is configured to: execute the hook function before encrypting the plaintext information; acquire the target parameter of the push stack by the hook function, based on The target parameter obtains a network packet before encryption; wherein the network packet before encryption includes plaintext information of the target website.
The data plaintext obtaining apparatus according to claim 2, wherein the data plaintext obtaining apparatus further comprises:

The search module is configured to perform reverse analysis on the startup process of the startup website in the browser by using a reverse static analysis tool and a reverse dynamic debugging tool to obtain a process point before the website performs hypertext transfer protocol encryption.
The data plaintext acquisition method according to claim 12, wherein the static analysis tool is an interactive disassembler; and the dynamic debugging tool is an assembly-analysis debugger having a visual interface.
The data plaintext obtaining apparatus according to any one of claims 8 to 13, wherein the data plaintext obtaining apparatus further comprises:

Writing to the module, configured to write the plaintext information into a log file;

a printing module configured to print the plaintext information to a debug window to display the plaintext information in the debug window;

The sending module is configured to send the plaintext information to the designated terminal or the server.
An electronic terminal characterized in that

include:

Memory

processor;

A data plaintext obtaining apparatus according to any one of claims 8 to 14 installed/stored in the memory and executed by the processor.
A readable storage medium having stored thereon a computer program, wherein the computer program, when executed, implements the data plaintext acquisition method according to any one of claims 1-7.