WO2020019482A1

WO2020019482A1 - Function hook detection method, function hook detection device, and computer-readable medium

Info

Publication number: WO2020019482A1
Application number: PCT/CN2018/107745
Authority: WO
Inventors: 刘瑞恺
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-07-27
Filing date: 2018-09-26
Publication date: 2020-01-30
Also published as: CN109145590A; CN109145590B

Abstract

A function hook detection method, a function hook detection device, and a computer-readable medium. The method comprises: when it is detected that a target terminal has an Xposed plug-in installed, acquiring a flag value of an objective function in the target terminal (101); determining whether the objective function has been hooked according to the flag value (102); when it is determined that the objective function has been hooked, acquiring, from a memory of the objective function, an objective function pointer corresponding to the objective function (103); and determining, according to pre-stored correlations between various function pointers and functions, an original function corresponding to the objective function pointer, and using the original function to replace the objective function (104). The method facilitates avoiding a false positive of a hook behavior, and enhancing the accuracy of hook detection.

Description

Function hook detection method, detection device and computer-readable medium

This application claims the priority of a Chinese patent application filed on July 27, 2018 with the Chinese Patent Office, application number 201810841834.3, and application name "A Function Hook Detection Method, Detection Equipment, and Computer-readable Media", its entire content Incorporated by reference in this application.

Technical field

The present application relates to the field of communication technologies, and in particular, to a function hook detection method, a detection device, and a computer-readable medium.

Background technique

Xposed is an open source framework, which provides a framework service that can affect the operation of programs through modules or code written by yourself without modifying the source code of the Android installation package (APK). Some illegal elements will use the Xposed plug-in to tamper with the device information, and the current equipment risk identification type products on the market generally cannot identify the above tampering behavior. Generally, it is only by detecting whether the Xposed plug-in is installed in the terminal to determine whether there is a hook behavior. This method only detects whether the Xposed plugin is installed to determine the hook behavior, and has a high false alarm rate.

Summary of the Invention

The present application provides a function hook detection method, a detection device, and a computer-readable medium, which can help avoid false reports of hook behavior and improve the accuracy of hook detection.

In a first aspect, the present application provides a function hook detection method, including:

When it is detected that the Xposed plug-in is installed on the target terminal, obtaining a flag value of an objective function in the target terminal, where the flag value is used to mark a state of the objective function;

Determining whether the objective function is hooked according to the flag value;

When it is determined that the objective function is hooked, obtaining an objective function pointer corresponding to the objective function from the memory of the objective function;

An original function corresponding to the target function pointer is determined according to a corresponding relationship between each function pointer and a function stored in advance, and the original function is used to replace the target function.

In a second aspect, the present application provides a detection device that includes a unit for performing the method of the first aspect.

According to a third aspect, the present application provides another detection device, including a processor, a user interface, a communication interface, and a memory. The processor, the user interface, the communication interface, and the memory are connected to each other. The memory is used for storing support. The detection device executes the computer program of the method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

In a fourth aspect, the present application provides a computer-readable storage medium, where the computer storage medium stores a computer program, the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute The method of the first aspect described above.

In the embodiment of the present application, a flag value of a function to be hook-detected in a terminal can be obtained to determine whether the function is hooked according to the flag value, and when it is determined that the function is hooked, a function pointer corresponding to the function can be obtained, In order to determine the true original function and replace the hooked function according to the function pointer, this helps to avoid false positives of hook behavior, improves the accuracy of hook detection, and can restore the real function to improve terminal security.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to explain the technical solution of the embodiment of the present application more clearly, the accompanying drawings used in the description of the embodiment will be described below.

FIG. 1 is a schematic flowchart of a function hook detection method according to an embodiment of the present application; FIG.

2 is a schematic flowchart of another function hook detection method according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of another function hook detection method according to an embodiment of the present application; FIG.

4 is a schematic structural diagram of a detection device according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of another detection device according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

The technical solution of the present application can be applied to a detection device, and the detection device may include various terminals, servers, or risk identification products (devices) connected to the terminal, etc., for detecting hook behavior in the terminal. The terminals involved in this application may be mobile phones, computers, tablets, smart watches, etc., and this application is not limited. An Xposed open source framework (or "installed with an Xposed plug-in"), or other open source framework is deployed in the terminal. Hook behavior often exists in this open source framework. Among them, hook is "hook" or "hook", which can change the result of function execution, such as the execution result of Application Programming Interface (API) functions. Therefore, illegal elements can modify device information through hook technology. For illegal purposes. This application can be found in time through this application.

In this application, functions can also be called different names, for example, they can also be called Method, ArtMethod, method, structure, Method structure, ArtMethod structure, or other names.

Specifically, in this application, a flag value of a function in a terminal can be obtained to determine whether the function is hooked according to the flag value, which helps to avoid false positives of hook behavior and improves the accuracy of hook detection. Before obtaining the flag value of a function, you can reduce the value of the function by detecting whether Xposed or other open source frameworks or plug-ins are installed on the terminal, and when determining that Xposed or other open source frameworks or plug-ins are installed. Equipment overhead. Further, when it is determined that a function is hooked, it is possible to obtain a function pointer corresponding to the function, and determine the corresponding original original function to replace the hooked function according to the function pointer, thereby realizing the restoration of the real function. To improve terminal security. The details are described below.

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a function hook detection method according to an embodiment of the present application. Specifically, as shown in FIG. 1, the function hook detection method may include the following steps:

101. Obtain a flag value of an objective function in a target terminal.

The target terminal may refer to any terminal that needs to perform hook detection, such as a terminal connected to a risk detection device, or a terminal in a specific risk control scenario, or triggered (such as by a preset button or gesture or a preset Other triggering methods) terminals for hook detection, etc. are not limited in this application. The risk control scenario may include a login scenario, a transaction scenario, an APP discount collection scenario, and so on.

The objective function may refer to any API function. In this application, the detection device may perform hook detection on all functions in the terminal, such as all API functions; or may specify only functions in the terminal, such as preset functions Functions in the list, or some functions that are easy to be hooked, etc., are used to perform hook detection to reduce the detection overhead of the device and improve the efficiency of hook detection. The specified function is usually an information function required for a specific demand or risk control scenario. For example, the specified function may be a positioning function, that is, a function corresponding to the positioning information. In order to prevent the taxi software from falsifying the positioning, a hook function may be performed on the positioning function such as the GPS function; for another example, the specified function may be a function of the device ID. The real device ID of the device can perform hook detection on the function that gets the device ID; for another example, the specified function can be terminal environment information such as battery information, Wi-Fi information, 4G network base station information, list of installed apps, Functions such as address book content, boot time, etc., in order to determine whether the target terminal is running in the simulator environment, the environmental information of the target terminal, such as battery information, Wi-Fi information, 4G network base station information, list of installed apps, Functions such as address book content, boot time, etc. are used for hook detection, etc., which are not listed here one by one.

Optionally, before obtaining the flag value of the target function in the target terminal, that is, the pending hook detection function (function requiring hook detection), the detection device can also detect whether the target terminal has an Xposed plug-in installed (the Xposed framework is deployed) , And when it is determined that the Xposed plug-in is installed, then obtain the flag value of the objective function. Therefore, it is possible to implement hook detection in a specific environment, improve the reliability of hook detection, and reduce equipment overhead.

102. Determine whether the objective function is hooked according to the flag value.

The flag value can be used to mark the state of the objective function. The state can refer to a state that has been tampered with, or can refer to a read-write state, a blocking and non-blocking state, an exit process or program state, and / or changes. The status of the content of the file, etc., so that whether the objective function is hooked can be determined according to the flag value. Specifically, each function has a corresponding flag. The flag is a variable. When a function is tampered, the flag corresponding to the function will change. Therefore, the detection device can determine whether the function is hooked by detecting whether the flag of the function has been changed. For example, the value of the obtained flag (or the flag processed according to a preset logical algorithm) and the default value (when not tampered) can be determined. Fixed value), if the value of flag (or the flag processed according to the preset logic algorithm) changes, that is, different from the default value, it means that the function is hooked, that is, the device information corresponding to the function has been tampered with . The value of the flag may be stored in a memory corresponding to the objective function.

103. When it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function.

Among them, the function pointer and the hooked function are stored in different fields in the same block of memory, and there is a mapping relationship between different function pointers and the original function, or a mapping relationship between different function pointers and the storage address of the original function.

Optionally, after it is determined that the target function is hooked, the detection device may further restore the hooked target function, so as to determine the real device information corresponding to the target function. Specifically, after determining that a function such as the objective function is hooked, a function pointer corresponding to the objective function can be quickly obtained from its memory, that is, the objective function pointer described above, so as to determine the objective function according to the objective function pointer. Corresponding primitive functions, such as native APIs, are real functions that have not been hooked.

104. Determine the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and use the original function to replace the target function.

After the target function pointer in the memory corresponding to the target function is determined, the original function corresponding to the target function pointer can be further determined, that is, the actual Method. Furthermore, the original function can be used to replace the objective function to achieve the reduction of the hooked function. Therefore, the detection device can determine the real device information of the target terminal through the original function, and control the operation of the target terminal based on the real device information, such as instructing the target terminal to output a prompt and requiring the user to input verification information; the user is prohibited from responding All request access operations in the risk control scenario, etc., are not listed here one by one.

It should be understood that the original function pointer stored in the memory will not be tampered with. According to the working principle of the Xposed plugin, before tampering with the target function, the original information of the function will be backed up and stored at a specific address in memory, that is, The address to which the objective function pointer points. Once these backup information has also been tampered with, the Xposed plugin will not work properly. Therefore, the original function obtained at the specific address pointed by the target function pointer must be the correct function, and it cannot be tampered with.

In the embodiment of the present application, the detection device can obtain a flag value of a function in the terminal to determine whether the function is hooked according to the flag value, and when determining that the function is hooked, it can obtain a function pointer corresponding to the function In order to determine the real original function and replace the hooked function according to the function pointer, this will help to avoid false positives of hook behavior, improve the accuracy of hook detection, and improve terminal security by restoring the real function. .

Please refer to FIG. 2, which is a schematic flowchart of another function hook detection method according to an embodiment of the present application. Specifically, as shown in FIG. 2, the function hook detection method may include the following steps:

201. Acquire current device information of a target terminal.

Optionally, the current device information may include one or more of the device information such as the model, brand, system version, and wind control scenario information of the target terminal. The wind control scene information may include a wind control scene identifier and / or scene description information, etc., and is used to indicate a wind control scene in which the terminal is located. For example, the risk control scenario identifier may include a login identifier, a transaction identifier, and the like; for another example, the scenario description information may include description information in which the terminal is in a login state, description information in which a terminal is in a transaction state, and the like, which are not listed here one by one .

202. Determine a function list corresponding to the current device information according to a preset correspondence between different device information and a function list.

The device information corresponds to the above-mentioned current device information, which may include one or more of information such as a terminal model, a brand, a system version, and risk control scenario information. Each function list includes at least one function that has a higher frequency of being hooked under the corresponding device information, such as the top M (M is an integer greater than 0, such as taking 8) functions with the highest frequency of being hooked, or the frequency of being hooked Functions that are greater than a preset frequency threshold; and / or, including functions that are more frequently hooked under the corresponding device information, such as the first N (N is an integer greater than 0, such as 10) functions that have been most frequently hooked , Or a function whose number of hooks is greater than a preset number of thresholds, and so on.

203: Obtain a flag value of an objective function in the target terminal, where the objective function is a function in a function list corresponding to the current device information.

Specifically, the functions that are hooked in the history can be grouped according to different device information in advance, the corresponding function grouping under each group of device information is determined, and multiple function lists are set in advance according to the function grouping, that is, each function list It includes a group of functions corresponding to a set of device information to preset the correspondence between different device information and function list. Furthermore, the detection device can find out its corresponding function list according to the current device information, and then perform hook detection on the functions in the function list without performing hook detection on all functions in the terminal, which improves the efficiency of hook detection and reduces Reduced equipment overhead.

For example, the device information is the system version of the terminal, and multiple function lists corresponding to different system versions are pre-configured. Then, when the detection device performs a hook detection on the target terminal, it can obtain the current system version of the target terminal, and then find out a function list corresponding to the current system version. The functions in the function list are functions that need to perform a hook function.

In another example, the device information is wind control scenario information of the terminal, and multiple function lists corresponding to different wind control scenario information are pre-configured. When the detection device performs a hook detection on the target terminal, it can obtain the current wind control scenario information of the target terminal, and then find out the function list corresponding to the current wind control scenario information. The functions in the function list are hooks that need to be performed Functions of functions.

In another example, the device information is a model of a terminal and information on a wind control scenario, and multiple function lists corresponding to different models and information on a wind control scenario are pre-configured. Then when the detection device performs a hook detection on the target terminal, it can obtain the function list corresponding to the model of the target terminal and the current risk control scenario by obtaining the model of the target terminal and the current risk control scenario information. The function list The function in is the function that needs to perform the hook function.

204. Determine whether the objective function is hooked according to the flag value.

Optionally, when determining whether the objective function is hooked according to the flag value, the detection device may compare a character at a preset position in the flag value with a preset fixed character; when the comparison obtains the preset position When the character of is different from the fixed character, it is determined that the objective function is hooked. The number of characters of the character at the preset position is the same as the number of characters of the fixed character, so as to facilitate matching and comparison. That is, a change in the value of the flag may refer to a change in one or more bits of the flag, and the one or more bits may refer to one or more bits in a preset position of the flag. Therefore, the detection device can compare one or more bits at the preset position of the obtained flag value with a fixed character that has not been tampered with. If the one or more bits of the flag value change, that is, one bit of the flag value If one or more bits are different from the fixed character, it indicates that the function is hooked, that is, the device information corresponding to the function has been tampered with.

For example, for systems with Android versions above 4.4 and below 5.0 or other systems, some Xposed plug-ins will set a bit at a fixed position of the flag value of the function to 1 when they hook a function; and For a function that has not been tampered with normally, this bit of the flag value is 0 (that is, the fixed character described above). Therefore, by detecting whether the fixed bit of the flag value of the function is 0, it can be known whether the function is hooked by the Xposed plugin. That is, if the fixed bit of the flag value of the measurement function is not 0, it can indicate that the function is hooked and the function is tampered with.

Optionally, when determining whether the objective function is hooked according to the flag value, the detection device may further perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, where the logical algorithm is Let the string and the jump address of the native function in the system be determined; when the result of the operation is a positive integer, determine that the target function is hooked. That is to say, the value processed by the flag can also be compared with a fixed character such as 0 when it has not been tampered with according to a preset logic algorithm. If the value after processing changes, it is not 0, such as a positive value. An integer indicates that the function is hooked.

For example, for systems with Android version 5.0 and above or other systems, if the result of a logical algorithm such as the logical expression EntryPointFromJni && AccessFlags & 0x10000000 is equal to a positive integer, the function can be tampered with; if the result of the logical expression is equal to 0 (that is, a fixed character) , It indicates that the function has not been tampered with. The EntryPointFromJni may refer to a jump address when a native function such as a native function is executed, and AccessFlags is the above-mentioned flag.

Further optionally, before determining whether the target function is hooked according to the flag value, the detection device may determine a system version currently used by the target terminal, and then select the target terminal to determine the target according to the flag value. Whether the function is hooked to improve the efficiency of hook detection. The correspondence between the system version and the way of hook detection can be preset. For example, in the above Android version 4.4 and below 5.0, the detection device can perform hook detection according to the comparison of the character at the preset position in the flag value with the preset fixed character; for example, in the above Android version in For systems of 5.0 and above, the detection device can perform a hook detection after performing a logical operation on the flag value according to a preset logic algorithm. Alternatively, optionally, the detection device may perform function hook detection through the two hook detection methods mentioned above, and when the conditions corresponding to any of the methods are met, the function may be determined to be hooked.

205. When it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function.

206: Determine the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and use the original function to replace the target function.

Specifically, for the description of the steps 205-206, please refer to the related description in the embodiment shown in FIG. 1 above, and details are not described herein.

207: Determine a target risk level of the target terminal, determine a control strategy corresponding to the target risk level according to a preset corresponding relationship between different risk levels and control strategies, and perform operations on the target terminal according to the determined control strategy. control.

In some optional embodiments, after obtaining the real information through the original function, the risk level of the function being tampered can be obtained by combining the risk control rules to identify, and then different control strategies can be adopted for different risk levels.

Optionally, after replacing the objective function with the original function, the detection device may also obtain device information corresponding to the original function and determine the priority of the device information, and then determine the objective function according to the priority of the device information The target risk level of the hook can determine the control strategy corresponding to the target risk level according to the preset corresponding relationship between different risk levels and control strategies, and control the operation of the target terminal according to the determined control strategy. . That is, the priority (importance level) of each piece of equipment information, the risk level corresponding to each priority, and the control strategy corresponding to each risk level can be preset. The higher the priority of the device information, the higher the risk level. Therefore, the detection device can determine the control strategy for the target terminal according to the priority of the tampered device information, which has high flexibility.

Optionally, the detection device can also count the number of hooked functions of the target terminal within a preset time range, and determine the target risk level of the target terminal according to the number, and then according to the preset different risk levels corresponding to the control strategy Relationship, determine a control strategy corresponding to the target risk level, and control the operation of the target terminal according to the determined control strategy. That is, the risk level may also be determined according to the number of hooked functions within a preset time range of the terminal. For example, the greater the number of hooked functions, the higher the risk level. Alternatively, optionally, the risk level may also be determined according to the number of times the function is hooked within a preset time range. For example, the more times the function is hooked within the preset time range, the higher the risk level, etc. . Therefore, the detection device can determine the control strategy for the target terminal according to the number of functions that are hooked or the number of times the functions are hooked, which has high flexibility.

For example, the risk level can be divided into low-risk, medium-risk, high-risk, or can be divided into first-level, second-level, third-level, and so on. There is no limitation on the classification and determination of risk levels in this application. The control strategy may include instructing the terminal to output a prompt, requiring the user to enter verification information (when the risk level is low, such as low-risk scenarios); instructing the terminal to prohibit users from using certain risk control scenarios (such as logging in, receiving APP benefits such as red envelopes, and redeeming benefits) Coupons, or transactions (such as consumption, transfers, etc.) under the access request operation (when the risk level is high, such as medium-risk scenarios); instruct the terminal to prohibit users from all request access operations (when the risk level is high, such as high-risk scenarios), etc. Wait, not list them here.

By tampering with device information, illegal elements mainly affect app service providers. For example, many "wool" attackers modify mobile phone information through the hook framework, so that only a small number of mobile phones can simulate many fake mobile phones, bypass the restrictions on the number of times the device can be obtained, and receive and resell a lot of activity benefits provided by service providers. For example, full discount coupons, call coupons, etc. In this way, the benefits originally used for publicity were received by a small number of attackers, but did not have the desired effect. Through the function hook detection scheme of this application, the hook behavior in the terminal can be discovered in time, and the real device information can be restored to reduce the impact of tampering behavior.

For example, for the GPS information of a hook terminal, a scene in which the terminal is located at a specific place. Assume that the driver uses a taxi app and fakes a ticket near a hotspot area (ie, hooks GPS to the hotspot area); or he is not actually driving, but swipes the counterfeit subsidy to obtain a subsidy; or forges the movement step information, Receive event rewards and more. Through the hook detection method of this application, it can be detected in time that the GPS function is hooked and the terminal GPS information is tampered with. After restoring the real GPS information, if it is found to be inconsistent, it can be barred from receiving rewards, or its rewards can be cancelled, or even promptly. Prohibits similar operations.

For another example, in the scenario of hook device ID, in order to prevent malicious users from registering for a large number of accounts and redeeming event benefits, some apps identify unique devices based on the device ID and restrict each mobile phone to participate in the event only once. By modifying the device ID information through a hook, you can forge other mobile phones without receiving a mobile phone change and receive benefits multiple times. Through the hook detection method of this application, the function of the device ID can be detected in time, the device ID has been tampered with, and the operation behavior can be prohibited in time after the real device ID is restored. For example, after a user logs in to an APP with an account to repeatedly receive activity benefits, the detection device recognizes that the device ID has been tampered with and obtains the real device ID, and then returns the real device ID and the login account to the server and communicates with the server. Existing data (including each device ID, login account, etc.) is compared to identify which accounts are actually running on the same device (for example, devices with the same device ID are the same device). Next, you can cancel the activity benefits received by these accounts, manually review the withdrawal request, or ban these accounts to control the operation of the device.

Another example is the scenario of hooking other environmental information. At present, many App risk control rules will take into account the current environment in which the App is running. For example, normal users will not run the APP through the Android emulator on the terminal, and it is usually a malicious user who uses the emulator, and thus prohibits running the APP in the emulator environment. The system will clearly indicate whether it is a real terminal or an emulator, so a malicious user may hook system information; or, because the Wi-Fi information seen on a normal terminal is different from what is seen in the emulator As a result, users may hook up Wi-Fi information. Through the above tampering methods, the APP operating environment can be tampered with into an emulator, making it difficult to distinguish between normal users and possible malicious users. Through the hook detection method of this application, it is possible to detect that the operating environment has been tampered with in a timely manner, and to restore the real operating environment in a timely manner, so that it can timely detect and prohibit its operating behaviors, such as prohibiting the APP from running, or prohibiting the APP from All access requests.

Further optionally, the detection device may also send the hooked function and the real original function to the server, or may return the return value of the original function and the return value of the tampered target function to the server in order to facilitate Help business risk control personnel detect equipment risks. Further, the detection device or the server may also associate and store information of the hooked function (return value) and the original function (return value), so that the hooked function can be quickly locked and retrieved quickly according to the association relationship. The correct original function can improve the efficiency of function reduction.

In the embodiment of the present application, the detection device may perform hook detection on the functions in the preset function list corresponding to the current device information by acquiring the current device information of the target terminal without having to hook all functions in the target terminal. Detection, which improves the efficiency of hook detection and saves equipment overhead. Furthermore, by obtaining the flag values of these functions, to determine whether each function is hooked according to the flag value, and when determining that the function is hooked, the real original function can be quickly determined and restored by obtaining the function pointer corresponding to the function. This will help to avoid false positives of hook behavior, improve the accuracy of hook detection, and improve terminal security by restoring real functions.

Please refer to FIG. 3, which is a schematic flowchart of another function hook detection method according to an embodiment of the present application. Specifically, as shown in FIG. 3, the function hook detection method may include the following steps:

301. Establish a function detection model based on functions that are hooked under different device information in statistical historical data.

Optionally, the device information may include one or more of device model, brand, system version, and risk control scenario information.

Specifically, the detection device may collect the hooked functions in the historical record in advance, and group according to the device information of the terminal corresponding to each hooked function, to determine the corresponding function grouping under different device information. Furthermore, different device information can be used as input, and functions in corresponding function groupings can be used as output, and a function detection model can be obtained by training. Therefore, a function detection model can be established by analyzing functions that are easily hooked by terminals of different models, different brands, different systems, and different wind control scenarios through big data, so that subsequent device information can be entered into the function detection model to obtain the required detection Objective function of hook detection.

302: Acquire current device information of the target terminal, and input the current device information into the function detection model to obtain an object function that needs to be detected by a hook.

After the function detection model is established, when a terminal is required to perform hook detection, the current device information of the terminal can be obtained, such as the model, brand, current system version, and current risk control scenario information of the terminal. The current device information is input into the function detection model to obtain an objective function in the terminal, which improves the efficiency of hook detection, is more targeted, and saves equipment overhead.

Optionally, in different detection scenarios, such as when the target terminal runs different types of APPs, different device information can be obtained according to different detection scenarios, and the target corresponding to the device information can be obtained according to the function detection model described above. Function to further improve the efficiency and reliability of hook detection.

For example, when it is detected that the target terminal is running an APP that requires wind control, the detection device can obtain the current wind control scene information of the target terminal, and can input the current wind control scene information into the function detection model to obtain the obtained The objective function corresponding to the current wind control scene information is used for hook detection. Wherein, the APP requiring risk control can be marked in advance, for example, by presetting an application list including each APP requiring risk control, and determining whether the APP is required by detecting whether the running APP is an APP in the application list. APP for risk control. Further, the current wind control scenario information may be information for a wind control scenario under the APP.

As another example, when it is detected that the target terminal runs a taxi app, the detection device can obtain the model and system version of the target terminal, and can input the model and the current system version into the function detection model to obtain the model and the current system version. Corresponding objective function for hook detection.

303. Obtain a flag value of the objective function.

304. Determine whether the objective function is hooked according to the flag value.

305. When it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function.

306: Determine an original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and use the original function to replace the target function.

307: Determine a target risk level of the target terminal, determine a control strategy corresponding to the target risk level according to a preset corresponding relationship between different risk levels and control strategies, and perform operations on the target terminal according to the determined control strategy. control.

Specifically, for the description of steps 304-307, refer to the related description of steps 204-207 in the embodiment shown in FIG. 2 above, and details are not described herein.

In the embodiment of the present application, the detection device may establish a function detection model by counting hooked functions corresponding to different device information in historical data, and further, when performing hook detection, it is possible to obtain the current device information of the target terminal and enter the function to detect After the corresponding output function is obtained after the model, a hook detection is performed on the output target function without having to perform a hook detection on all functions in the target terminal, which improves the efficiency of hook detection and saves equipment overhead. Furthermore, by obtaining the flag values of these functions, to determine whether each function is hooked according to the flag value, and when determining that the function is hooked, the real original function can be quickly determined and restored by obtaining the function pointer corresponding to the function. This will help to avoid false positives of hook behavior, improve the accuracy of hook detection, and improve terminal security by restoring real functions.

The foregoing method embodiments are examples of the function hook detection method of the present application. The description of each embodiment has its own emphasis. For a part that is not described in detail in an embodiment, reference may be made to related descriptions in other embodiments.

Please refer to FIG. 4, which is a schematic structural diagram of a detection device according to an embodiment of the present application. The detection device in the embodiment of the present application includes a unit for performing the foregoing function hook detection method. Specifically, the detection device 400 in this embodiment may include: an obtaining unit 401 and a processing unit 402. among them,

An obtaining unit 401, configured to obtain a flag value of an objective function in the target terminal, where the flag value is used to mark a state of the objective function;

A processing unit 402, configured to determine whether the objective function is hooked according to the flag value;

The obtaining unit 401 is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

The processing unit 402 is further configured to determine an original function corresponding to the objective function pointer according to a corresponding relationship between each function pointer and a function stored in advance, and replace the objective function with the original function.

Optionally, the obtaining unit 401 may obtain a flag value of an objective function in the target terminal when detecting that the Xposed plug-in is installed on the target terminal, and details are not described herein.

Optionally, the obtaining unit 401 is further configured to obtain current device information of the target terminal, where the current device information includes one or more of a model, a system version, and risk control scenario information of the target terminal. ;

The processing unit 402 is further configured to determine a function list corresponding to the current device information according to a preset corresponding relationship between different device information and a function list, and use a function in the function list corresponding to the current device information as a function. The objective function is described.

Each function list may include a function whose frequency of being hooked under the corresponding device information is greater than a preset frequency threshold and / or a function whose number of times of hooking is greater than a preset number of thresholds.

Optionally, the detection device further includes: a model establishing unit 403;

The model establishing unit 403 is configured to establish a function detection model according to functions that are hooked under different device information in the statistical historical data, and the device information includes one or more of a device model, a system version, and risk control scenario information. item;

The obtaining unit 401 is further configured to obtain current device information of the target terminal, and input the current device information into the function detection model to obtain the target function.

Optionally, the processing unit 402 is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the fixed value. The number of characters of the character is the same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.

Optionally, the processing unit 402 is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is based on a preset character string and a value in the system. The jump address when the native function is executed is determined; when the value of the operation result is a positive integer, it is determined that the target function is hooked.

Optionally, the processing unit 402 is further configured to obtain device information corresponding to the original function according to the original function, and determine a priority of the device information; and determine the target according to the priority of the device information. The target risk level of the function being hooked; according to the preset corresponding relationship between different risk levels and control strategies, determine a control strategy corresponding to the target risk level, and operate the target terminal according to the determined control strategy Take control.

Optionally, the processing unit 402 is further configured to count the number of hooked functions of the target terminal within a preset time range, and determine the target risk level of the target terminal according to the number; according to different presets, The corresponding relationship between the risk level and the control strategy determines a control strategy corresponding to the target risk level, and controls the operation of the target terminal according to the determined control strategy.

Specifically, the detection device may implement some or all steps in the function hook detection method in the embodiments shown in FIG. 1 to FIG. 3 by using the foregoing units. It should be understood that the embodiments of the present application are device embodiments corresponding to the method embodiments, and the description of the method embodiments is also applicable to the embodiments of the present application.

Please refer to FIG. 5, which is a schematic structural diagram of another detection device according to an embodiment of the present application. The detection device is used to perform the method described above. As shown in FIG. 5, the detection device 500 in this embodiment may include: one or more processors 501 and a memory 502. Optionally, the detection device may further include one or more user interfaces 503, and / or, one or more communication interfaces 504. The processor 501, the user interface 503, the communication interface 504, and the memory 502 may be connected through a bus 505, or may be connected through other methods. FIG. 5 illustrates the examples by using a bus method. The memory 502 is configured to store a computer program, where the computer program includes program instructions, and the processor 501 is configured to execute the program instructions stored in the memory 502.

The processor 501 may be used to call the program instructions to perform the following steps: when it is detected that the target terminal has an Xposed plug-in installed, obtain a flag value of the target function in the target terminal, and the flag value is used to mark the target Status of the function; determining whether the objective function is hooked according to the flag value; when determining that the objective function is hooked, obtaining an objective function pointer corresponding to the objective function from the memory of the objective function; according to a pre-store The corresponding relationship between each function pointer and the function determines the original function corresponding to the target function pointer, and replaces the target function with the original function.

Optionally, the processor 501 may also call the program instructions to perform the following steps: obtaining the current device information of the target terminal, where the current device information includes the model, system version, and risk control scenario information of the target terminal. One or more items; according to preset correspondence between different device information and function lists, a function list corresponding to the current device information is determined, where each function list includes the corresponding device information and is more frequently hooked than the Set the function of the frequency threshold and / or the function of being hooked more than the preset number of thresholds; and use the function in the function list corresponding to the current device information as the target function.

Optionally, the processor 501 may also call the program instructions to perform the following steps: According to a function that is hooked under different device information in the statistical historical data, a function detection model is established. The device information includes a device model, a system version, a Control one or more of the scene information; acquire current device information of the target terminal, and input the current device information into the function detection model to obtain the target function.

Optionally, when the processor 501 calls the program instruction to execute the determination of whether the objective function is hooked according to the flag value, the processor 501 specifically executes the following steps: the character at a preset position in the flag value and The preset fixed characters are compared, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character; when the comparison obtains that the character at the preset position is different from the fixed character, the determined The objective function is hooked.

Optionally, when the processor 501 invokes the program instruction to execute the determining whether the objective function is hooked according to the flag value, the processor 501 specifically performs the following steps: performing a logical operation on the flag value according to a preset logic algorithm To obtain an operation result value, wherein the logical algorithm is determined according to a preset character string and a jump address when a native function in the system is executed; when the operation result value is a positive integer, the objective function is determined Was hooked.

Optionally, the processor 501 may also call the program instructions to execute the replacement of the target function with the original function, and may further perform the following steps: obtaining device information corresponding to the original function according to the original function, And determine the priority of the device information; determine the target risk level of the target function being hooked according to the priority of the device information; determine the target risk with the target risk according to the preset corresponding relationship between different risk levels and control strategies A control strategy corresponding to the level, and controlling the operation of the target terminal according to the determined control strategy.

Optionally, the processor 501 may also call the program instructions to perform the following steps: Count the number of hooked functions of the target terminal within a preset time range, and determine the target risk level of the target terminal according to the number; A control strategy corresponding to the target risk level is determined according to a preset corresponding relationship between different risk levels and control strategies, and the operation of the target terminal is controlled according to the determined control strategy.

The processor 501 may be a central processing unit (CPU), and the processor may also be another general-purpose processor, digital signal processor (DSP), or application specific integrated circuit (Application Specific Integrated). Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The user interface 503 may include an input device and an output device, the input device may include a touch panel, a microphone, and the like, and the output device may include a display (LCD, etc.), a speaker, and the like.

The communication interface 504 may include a receiver and a transmitter for communicating with other devices.

The memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501. A part of the memory 502 may further include a non-volatile random access memory. For example, the memory 502 may further store the corresponding relationship between the function pointer and the function, and so on.

In specific implementation, the processor 501 and the like described in the embodiment of the present application may execute the implementation manners described in the method embodiments shown in FIG. 1 to FIG. 3 described above, and may also execute each of the methods described in FIG. 4 of the embodiment of the present application. The implementation of the unit is not repeated here.

An embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program described in the embodiments corresponding to FIG. 1 to FIG. 3 can be implemented. Some or all of the steps in the function hook detection method may also implement the function of the detection device in the embodiment shown in FIG. 4 or FIG. 5 of the application, and details are not described herein.

An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute part or all of the steps in the above method.

The computer-readable storage medium may be an internal storage unit of the detection device according to any of the foregoing embodiments, such as a hard disk or a memory of the detection device. The computer-readable storage medium may also be an external storage device of the detection device, such as a plug-in hard disk, a Smart Media Card (SMC), and a Secure Digital (SD) device. ) Cards, flash cards, etc.

In the present application, the term "and / or" is merely an association relationship describing an associated object, which means that there can be three kinds of relationships, for example, A and / or B can mean: A exists alone, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

In various embodiments of the present application, the size of the sequence numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not deal with the implementation process of the embodiments of the present application. Constitute any limitation.

The above description is only part of the implementation of this application, but the scope of protection of this application is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, and these modifications or replacements should be covered by the protection scope of this application.

Claims

A function hook detection method is characterized in that it includes:

When it is detected that the Xposed plug-in is installed on the target terminal, obtaining a flag value of an objective function in the target terminal, where the flag value is used to mark a state of the objective function;

Determining whether the objective function is hooked according to the flag value;

When it is determined that the objective function is hooked, obtaining an objective function pointer corresponding to the objective function from the memory of the objective function;

An original function corresponding to the target function pointer is determined according to a corresponding relationship between each function pointer and a function stored in advance, and the original function is used to replace the target function.
The method according to claim 1, further comprising:

Acquiring current device information of the target terminal, where the current device information includes one or more of a model, a system version, and a wind control scenario information of the target terminal;

The function list corresponding to the current device information is determined according to the correspondence between the preset device information and the function list, where each function list includes a function whose frequency of being hooked under the corresponding device information is greater than a preset frequency threshold and / Or a function whose number of hooks is greater than a preset number threshold;

The function in the function list corresponding to the current device information is used as the target function.
The method according to claim 1, further comprising:

Establish a function detection model according to the hooked function under different device information in the statistical historical data, where the device information includes one or more of the device model, system version, and risk control scenario information;

Acquiring the current device information of the target terminal, and entering the current device information into the function detection model to obtain the target function.
The method according to any one of claims 1-3, wherein the determining whether the objective function is hooked according to the flag value comprises:

Comparing a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character;

When the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
The method according to any one of claims 1-3, wherein the determining whether the objective function is hooked according to the flag value comprises:

Perform logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is determined according to a preset string and a jump address when a native function in the system is executed;

When the operation result value is a positive integer, it is determined that the objective function is hooked.
The method according to claim 1, wherein after replacing the objective function with the original function, the method further comprises:

Obtaining device information corresponding to the original function according to the original function, and determining a priority of the device information;

Determining the target risk level of the target function being hooked according to the priority of the device information;

A control strategy corresponding to the target risk level is determined according to a preset corresponding relationship between different risk levels and control strategies, and the operation of the target terminal is controlled according to the determined control strategy.
The method according to claim 1, further comprising:

Counting the number of hooked functions of the target terminal within a preset time range, and determining a target risk level of the target terminal according to the number;

A control strategy corresponding to the target risk level is determined according to a preset corresponding relationship between different risk levels and control strategies, and the operation of the target terminal is controlled according to the determined control strategy.
A detection device, comprising: an acquisition unit and a processing unit;

The acquiring unit is configured to acquire a flag value of an objective function in a target terminal, and the flag value is used to mark a state of the objective function;

The processing unit is configured to determine whether the objective function is hooked according to the flag value;

The obtaining unit is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

The processing unit is further configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and replace the target function with the original function.
The detection device according to claim 8, characterized in that:

The obtaining unit is further configured to obtain current device information of the target terminal, where the current device information includes one or more of a model, a system version, and risk control scenario information of the target terminal;

The processing unit is further configured to determine a function list corresponding to the current device information according to a preset correspondence between the device information and a function list, and use the function in the function list corresponding to the current device information as the target. function;

Each function list includes a function whose frequency of being hooked under the corresponding device information is greater than a preset frequency threshold and / or a function whose number of times of hooking is greater than a preset number of thresholds.
The detection device according to claim 8, further comprising: a model establishing unit;

The model establishing unit is configured to establish a function detection model according to a function that is hooked under different device information in the statistical historical data, and the device information includes one or more of a device model, a system version, and risk control scenario information. ;

The obtaining unit is further configured to obtain current device information of the target terminal, and input the current device information into the function detection model to obtain the target function.
The detection device according to any one of claims 8 to 10, wherein

The processing unit is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character When it is determined that the character at the preset position is different from the fixed character, determining that the objective function is hooked.
The detection device according to any one of claims 8 to 10, wherein

The processing unit is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is executed according to a preset string and a native function in the system. The jump address is determined; when the operation result value is a positive integer, it is determined that the objective function is hooked.
The detection device according to claim 8, characterized in that:

The processing unit is further configured to obtain device information corresponding to the original function according to the original function, and determine a priority of the device information; and determine a target of the target function to be hooked according to the priority of the device information. Risk level; determining a control strategy corresponding to the target risk level according to a preset corresponding relationship between different risk levels and control strategies, and controlling the operation of the target terminal according to the determined control strategy.
The detection device according to claim 8, characterized in that:

The processing unit is further configured to count the number of hooked functions of the target terminal within a preset time range, and determine the target risk level of the target terminal according to the number; according to preset different risk levels and control strategies Corresponding relationship, determine a control strategy corresponding to the target risk level, and control the operation of the target terminal according to the determined control strategy.
A detection device, comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured for When calling the program instruction, the following steps are performed:

When it is detected that the Xposed plug-in is installed on the target terminal, a flag value of an objective function in the target terminal is obtained, and the flag value is used to mark a state of the objective function; and whether the objective function is determined according to the flag value hook; when it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function; and determine the objective function according to the corresponding relationship between the function pointers and functions stored in advance Pointer to the original function, and replace the target function with the original function.
The detection device according to claim 15, wherein the processor further calls the program instructions to perform the following steps:

Acquire current device information of the target terminal, where the current device information includes one or more of the model, system version, and wind control scenario information of the target terminal; according to the preset correspondence between the device information and the function list To determine a function list corresponding to the current device information, where each function list includes a function whose frequency of being hooked under the corresponding device information is greater than a preset frequency threshold and / or a function whose number of hooks is greater than a preset number of thresholds Taking the function in the function list corresponding to the current device information as the target function.
The detection device according to claim 15, wherein the processor further calls the program instructions to perform the following steps:

Establish a function detection model based on the hooked functions under different device information in the statistical historical data, where the device information includes one or more of the device model, system version, and risk control scenario information; obtain the current target terminal's current Device information, and inputting the current device information into the function detection model to obtain the objective function.
The detection device according to any one of claims 15-17, wherein when the processor invokes the program instruction to execute the determining according to the flag value whether the objective function is hooked, specifically executes the following step:

Comparing the character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character; when the preset is obtained by comparison When the character at the position is different from the fixed character, it is determined that the objective function is hooked.
The detection device according to any one of claims 15-17, wherein when the processor invokes the program instruction to execute the determining according to the flag value whether the objective function is hooked, specifically executes the following step:

Perform logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is determined according to a preset string and a jump address when a native function in the system is executed; when When the operation result is a positive integer, it is determined that the objective function is hooked.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.