WO2021248310A1 - 服务调用信息的获取方法、装置和服务的漏洞测试方法 - Google Patents

服务调用信息的获取方法、装置和服务的漏洞测试方法 Download PDF

Info

Publication number
WO2021248310A1
WO2021248310A1 PCT/CN2020/095111 CN2020095111W WO2021248310A1 WO 2021248310 A1 WO2021248310 A1 WO 2021248310A1 CN 2020095111 W CN2020095111 W CN 2020095111W WO 2021248310 A1 WO2021248310 A1 WO 2021248310A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
class
target
information
call
Prior art date
Application number
PCT/CN2020/095111
Other languages
English (en)
French (fr)
Inventor
郭子亮
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080098251.1A priority Critical patent/CN115244516A/zh
Priority to PCT/CN2020/095111 priority patent/WO2021248310A1/zh
Publication of WO2021248310A1 publication Critical patent/WO2021248310A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software

Definitions

  • the technical field of service testing of this application in particular, relates to a method, device, mobile terminal, and computer-readable storage medium for obtaining service invocation information, and a method, device, system, mobile terminal, and computer-readable storage medium for service vulnerability testing.
  • the application program can call the service interface of the operating system during the running process to use the system service provided by the operating system.
  • the service call information of the service interface can be used to test system services to view the response of these services.
  • the traditional method of determining service invocation information is mainly to find the service invocation information provided by the system service by manually reversing the operating system framework files.
  • the embodiments of the present application provide a method, device, mobile terminal, and computer-readable storage medium for obtaining service invocation information, and a service vulnerability testing method, device, system, mobile terminal, and computer-readable storage medium, which can effectively improve service invocation information The efficiency of acquisition.
  • a method for obtaining service invocation information including:
  • a device for acquiring service invocation information including:
  • the service identification acquisition module is used to acquire the service identification of the target service to be invoked when the service invocation information acquisition instruction is received;
  • the class reflection module is used to perform class reflection analysis using the service identifier as a reflection object
  • the class determination module is configured to obtain the first target class corresponding to the target service according to the result of the class reflection analysis
  • the call information reflection module is configured to perform call information reflection analysis using the first target class as a reflection object when the first target class matches the reference class;
  • the calling information determining module is configured to obtain the service calling information corresponding to the target service according to the result of the reflection analysis of the calling information.
  • a mobile terminal includes a memory and a processor, and a computer program is stored in the memory.
  • the processor executes the operation of the method for obtaining service invocation information.
  • a computer-readable storage medium has a computer program stored thereon, and when the computer program is executed by a processor, the operation of the method for obtaining service call information is realized.
  • the foregoing method, device, mobile terminal, and computer-readable storage medium for obtaining service invocation information obtain the service identifier of the target service to be invoked; obtain the first target class corresponding to the target service according to the class reflection analysis result of the service identifier; When the target class matches the reference class, the service call information corresponding to the target service is obtained according to the call information reflection analysis result of the first target class. Without the operating system source code, there is no need to obtain call information through manual reverse analysis. , Can automatically and quickly obtain service invocation information through stepwise reflection analysis.
  • a service vulnerability testing method including:
  • the service invocation information of the target service to be invoked is determined according to the result of the invocation information reflection analysis; the invocation information reflection analysis is that when the first target class matches the reference class, the first target Class as a reflection object for reflection analysis; the first target class is obtained by class reflection analysis using the service identifier of the target service as a reflection object;
  • a service vulnerability testing device including:
  • the call information acquisition module is used to obtain the service call information of the target service to be called; the service call information is determined according to the result of the call information reflection analysis; the call information reflection analysis is when the first target class matches the reference class , Performing reflection analysis using the first target class as a reflection object; the first target class is obtained by performing class reflection analysis using the service identifier of the target service as the reflection object;
  • An invocation instruction sending module configured to send an invocation instruction to the service interface of the target service according to the service invocation information
  • a response information receiving module configured to receive the first call response information returned by the service interface according to the call instruction
  • the test result determination module is configured to perform vulnerability test analysis according to the first call response information, and obtain the vulnerability test result of the target service.
  • a mobile terminal includes a memory and a processor, and a computer program is stored in the memory.
  • the processor executes the operation of the vulnerability testing method of the service.
  • a computer-readable storage medium has a computer program stored thereon, and when the computer program is executed by a processor, the operation of the vulnerability testing method of the service is realized.
  • the vulnerability testing method, device, mobile terminal and computer-readable storage medium of the above-mentioned service obtain service invocation information automatically obtained through stepwise reflection analysis, call the service interface of the target service according to the service invocation information, and according to the response returned by the service interface
  • the information obtains the vulnerability test result of the target service, without manual reverse analysis of the call information, which can effectively improve the efficiency of the vulnerability test.
  • a service vulnerability testing system including: the control end and the proxy end of the network connection;
  • the control terminal is configured to send a service invocation information acquisition instruction to the agent terminal;
  • the proxy terminal is used to obtain the service identification of the target service to be invoked when receiving the service invocation information acquisition instruction; use the service identification as a reflection object to perform class reflection analysis; and obtain the result of the class reflection analysis
  • the first target class corresponding to the target service when the first target class matches the reference class, the first target class is used as a reflection object for invocation information reflection analysis; the result of the invocation information reflection analysis is obtained Service invocation information corresponding to the target service;
  • the control terminal is further configured to receive the service invocation information returned by the agent; send a calling instruction to the service interface of the target service according to the service invocation information; receive the service interface to return according to the invocation instruction According to the first call response information, the vulnerability test analysis is performed to obtain the vulnerability test result of the target service.
  • the agent terminal analyzes the service call information automatically obtained through stepwise reflection under the trigger of the control terminal.
  • the control terminal calls the service interface of the target service according to the service call information, and obtains the target according to the response information returned by the service interface.
  • the service vulnerability test results do not require manual reverse analysis of the call information, which can effectively improve the efficiency of the vulnerability test.
  • Fig. 1 is a flowchart of a method for acquiring service invocation information in an embodiment
  • Figure 2 is a flowchart of a method for acquiring service invocation information in another embodiment
  • Figure 3 is an application scenario diagram of a service vulnerability testing method in an embodiment
  • Figure 4 is a flowchart of a service vulnerability testing method in an embodiment
  • Figure 5 is a structural block diagram of an apparatus for acquiring service invocation information in an embodiment
  • Figure 6 is a structural block diagram of a service vulnerability testing device in an embodiment
  • Figure 7 is a structural block diagram of a service vulnerability testing system in an embodiment
  • FIG. 8 is a schematic diagram of the internal structure of a mobile terminal in an embodiment
  • Fig. 9 is a schematic diagram of the internal structure of a server in another embodiment.
  • a method for obtaining service invocation information is provided.
  • the method is applied to a terminal as an example.
  • the method can also be applied to a server. It can be applied to a system including a terminal and a server, and is realized through the interaction between the terminal and the server.
  • the terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices, and the server can be implemented by an independent server or a server cluster composed of multiple servers.
  • the method can also be applied to applications or plug-ins configured on the terminal.
  • a method for acquiring service invocation information includes operation S101 to operation S105.
  • the specific instructions are as follows:
  • Operation S101 when receiving the service invocation information acquisition instruction, acquire the service identifier of the target service to be invoked.
  • services can be called system services, which refer to programs, routines, or processes that perform specified system functions in order to support other programs.
  • the system may refer to the operating system configured on the terminal, and may be an operating system such as Android (Android), Windows, and IOS.
  • Android Android
  • Windows Windows
  • IOS IOS
  • an application needs to use a certain service (or test a certain service)
  • it can call the interface corresponding to the service to apply the functions provided by the service.
  • an Android system service may be a service component running in a system service process in a terminal device configured with an Android system, and may be called by a normal app through a Binder.
  • Service call information refers to information that can call a service interface, and may include interface number, call number (may be referred to as call number for short), call parameters, and so on.
  • a service may contain multiple methods. Therefore, when a specific method in the service is to be invoked, the service invocation information may also include the method name, invocation parameters, and so on.
  • the service call information acquisition instruction refers to an instruction that triggers the start of execution of the service call information acquisition program.
  • the terminal receives the service call information acquisition instruction, it starts to execute the service identification acquisition program and the subsequent reflection analysis program.
  • the target service is the service to be invoked for this service invocation information acquisition method, that is, after the service invocation information acquisition method is executed, the target service can be invoked based on the acquired service invocation information.
  • the target service can refer to all or part of the services in the operating system.
  • the service call information acquisition instruction may include service selection information used to indicate the service selected by the user.
  • the target service may refer to the system service corresponding to the service selection information. If the service call information does not contain service selection information, the target service can be determined according to preset rules, for example: all system services are determined as target services, or they can be selected from system services through a certain algorithm The target service can also be randomly determined from the system service.
  • the Android system there are two types of Android system services, one is in the Java layer system services, the writing language is Java, and the Java layer system services are often customized by the manufacturer without open source code; the other is in the native layer system Service, used to start the upper-layer service or provide the basic operating environment for the upper-layer system service, such as ServiceManager, the writing language is generally c/c++.
  • the embodiment of the present invention can obtain service invocation information of the Java layer system service, so as to perform a vulnerability test on the Java layer system service.
  • Service identification refers to the information that identifies the target service, which can be represented by the service name (ServiceName), service number, service function realization code, and so on. Further, the process of obtaining the service identification of the target service may be to perform an identification query from the service identification database, and use the queried identification as the service identification of the target service; the service identification may also be determined by methods such as reflection.
  • Operation S102 Use the service identifier as a reflection object to perform class reflection analysis.
  • reflection is a mechanism provided by the Java programming language to obtain the bytecode of any class at runtime (Runtime) other than the compile time (Compile Time), and can reflect information such as interfaces, variables, and methods.
  • Untime runtime
  • Compile Time compile time
  • the method in the service can be called through the information obtained by reflection.
  • operation S102 is to use the service identifier as the reflection object to perform reflection analysis on the information provided by the ServiceManager. Since the result of the reflection analysis is the class of the service managed by the ServiceManager, the embodiment of the present invention refers to the reflection analysis as class reflection. analyze.
  • ServiceManager is a special type of system service, it starts before other system services, and can provide external service registration and service retrieval functions.
  • the embodiment of the present invention performs stepwise reflection analysis based on ServiceManager, and can obtain service invocation information.
  • Operation S103 Obtain a first target class corresponding to the target service according to the result of the class reflection analysis.
  • class is the basis of object-oriented programming (OOP, Object-Oriented Programming) to achieve information encapsulation.
  • OOP object-oriented programming
  • a class is a user-defined reference data type, also known as a class type. Instances of classes are called objects.
  • the first target class is obtained according to the result of class reflection analysis.
  • the results of this type of reflection analysis may contain information related to the first target class, for example: the class name, type, and other related parameters of the first target class.
  • Operation S104 When the first target class matches the reference class, use the first target class as a reflection object to perform call information reflection analysis.
  • the reference class may be a predetermined class related to the operation of the application program, for example, a class corresponding to a Java layer system service.
  • the reference class can be a class named AAA.BBB.CCC.Stub or AAA.BBB.CCC.Stub.Proxy.
  • AAA.BBB.CCC can be replaced according to the actual situation.
  • it is mainly to check whether the suffix of the first target class name is .Stub, .Proxy, .Stub.Proxy, etc., if so, then The first target class is considered to match the reference class.
  • the method further includes: determining the class identifier corresponding to the first target class according to the result of the class reflection analysis When the class identifier matches the preset reference class identifier, it is determined that the first target class matches the reference class.
  • the class identification refers to the information that can identify the class.
  • the information that can uniquely represent the first target class can be determined from the result of class reflection analysis, and this information can be used as the class identification of the first target class.
  • the reference class identifier refers to a predetermined class identifier used to select the first target class that meets the preset type. It can refer to the aforementioned .Stub, .Proxy, .Stub.Proxy, etc., or it can include .Stub , .Proxy, .Stub.Proxy, etc.
  • the step of determining the class identifier corresponding to the first target class according to the result of the class reflection analysis includes: obtaining the class name of the first target class according to the result of the class reflection analysis ; Determine the class identifier according to the class name of the first target class.
  • first target classes when there are multiple target services, there may be multiple first target classes.
  • these first target classes and reference classes can be separately performed (the reference classes compared by different target classes can be the same or different). Compare, and then perform subsequent reflection analysis processing on the first target category that meets the conditions.
  • Operation S105 Obtain service invocation information corresponding to the target service according to the result of the invocation information reflection analysis.
  • the first target class matches the reference class
  • the first target class is the class to be searched, and further reflection analysis on it can obtain the method name, call number, call parameter and other service call information related to the target service. . Therefore, the embodiment of the present invention refers to this reflection analysis as calling information reflection analysis.
  • the foregoing method for obtaining service invocation information obtains the service ID of the target service to be called; obtains the first target class corresponding to the target service according to the class reflection analysis result of the service ID; when the first target class matches the reference class, according to the first target class
  • the invocation information reflection analysis result of a target class obtains the service invocation information corresponding to the target service.
  • the step of obtaining the service identification of the target service to be invoked when the service invocation information acquisition instruction is received includes: when the service invocation information acquisition instruction is received, listing the services in the service manager The interface performs call reflection analysis to trigger the service listing interface to return system service information; the system service information is the information of the service managed by the service manager; obtain the system service information returned by the service listing interface; from The service name of the target service is acquired from the system service information as the service identifier.
  • the service manager may be a service that can manage the services of the operating system, and may be the aforementioned ServiceManager.
  • the service listing interface can refer to an interface with a service information listing (also called enumeration) function, and can be the listServices interface in the java system.
  • the terminal obtains the service name of the target service by calling the listServices interface in the ServiceManager.
  • the operating system manages services through the service manager. Therefore, the services managed by the service manager can refer to the services corresponding to the operating system. Further, the system service information may include service name, service description information (information describing the functions implemented by the service), and the like.
  • the listServices interface in ServiceManager can be called, and the system service information can be listed by the listServices interface.
  • the terminal can identify the symbol, location, etc. of the listed system service information, and obtain the service name ServiceName (also known as the system service name or service name) based on the identified symbol, location, and other information, for example: put the brackets []
  • the preceding information is determined as the service name, or the information in the first field of the system service information is determined as the service name.
  • system service information enumerated through the listServices interface can be:
  • run XX.ssfuzzer.getservicesinfo is the call instruction to the listServices interface.
  • the listServices interface responds to the call instruction and outputs a system service list.
  • the system service list contains ten system service information numbered from 0 to 9. Among them, the information in brackets [] is the service description information, and the information before [] is the service name.
  • the terminal device may first identify the location of [], and determine the information in front of [] as the service name.
  • the above embodiment obtains system service information by calling the service enumeration interface, and then determines the service identifier according to the system service information.
  • the determination process is simple and can be realized by a simple calling code, which can effectively improve the efficiency of calling service information.
  • the number of the first target class may be one, two or even more.
  • reflection analysis can be performed on these first target classes in a synchronous or asynchronous manner, respectively, and the service invocation information corresponding to these first target classes can be obtained as corresponding target services.
  • Service call information can be obtained as corresponding target services.
  • the step of using the first target class as a reflection object to perform invocation information reflection analysis includes: using the class name of the first target class as a reflection object The object performs call number reflection analysis to obtain the call number (TransactionCode) of the target service; obtain the class name of the second target class; the second target class is the inner class of the first target class; when the second target class When the class name of the target class matches the preset reference class name, the class name of the second target class is used as the reflection object to perform the call parameter reflection analysis to obtain the call parameters; according to the call number and the call parameters The call information reflects the result of the analysis.
  • the object performs call number reflection analysis to obtain the call number (TransactionCode) of the target service
  • obtain the class name of the second target class is the inner class of the first target class
  • the class name of the second target class is used as the reflection object to perform the call parameter reflection analysis to obtain the call parameters; according to the call number and the call parameters
  • the call information reflects the result of the analysis.
  • the reference class name can be a specific type of class name, for example, a class name that contains method names and call parameters in java. Specifically, it can be a class name whose suffix includes .Proxy.
  • the step of using the class name of the second target class as a reflection object to perform call parameter reflection analysis to obtain the call parameters includes: using the class name of the second target class as a reflection object The object performs method name reflection analysis and parameter value reflection analysis respectively to obtain the method name and parameter value of the target service; according to the method name (Method) and the parameter value (Arguments), the call parameter is obtained.
  • the corresponding method name and parameter value can be obtained after the reflection analysis.
  • the step of using the class name of the first target class as a reflection object to perform call number reflection analysis to obtain the call number of the target service includes: The class name of the class is used as a reflection object to perform call number reflection analysis; the member variable value corresponding to the reference number identifier is determined from the result of the call number reflection analysis, as the call number of the target service.
  • the reference number identifier is an identifier that distinguishes the call number, and can be TRANSACTION_.
  • the integer value in the determined member variable value can be determined as the call number of the target service.
  • setHandoverConfig(14) means that the system service qti.ims.ext has a setHandoverConfig system service interface, and its call number is 14.
  • the process of determining call number 14 can be as follows:
  • the corresponding call information is obtained by reflection analysis on the class names of the first target class and the second target class.
  • the determination process is simple, and detailed information such as call number, method name, call parameter, etc. can be obtained at the same time, according to these information Can accurately implement the call to the service interface.
  • the interface call function can be constructed by only one or part of the call number, method name, and call parameters, only one or part of the foregoing embodiments may be executed.
  • the procedure for obtaining service invocation information can be triggered by entering a command line in the terminal.
  • the command line may include service selection information (also called command line parameters) of the service to be invoked, so as to obtain the service invocation information of the selected target service in a targeted manner.
  • service selection information also called command line parameters
  • the service invocation information can be obtained according to the situation. For example, the service invocation information of all services in the operating system can be obtained.
  • the step of obtaining the service identification of the target service to be invoked when the service invocation information acquisition instruction is received includes: when the service invocation information acquisition instruction carries service selection information, downloading from the operating system
  • the reference service corresponding to the service selection information is determined among services; the service identifier of the reference service is determined as the service identifier of the target service.
  • the step of obtaining the service identification of the target service to be invoked when the service invocation information acquisition instruction is received includes: when the service invocation information acquisition instruction does not carry service selection information, The service identifier of each service of the operating system is determined as the service identifier of the target service.
  • FIG. 2 it is a flowchart of a method for acquiring service invocation information in an embodiment.
  • the plug-in configured on the terminal which can be called an agent
  • the terminal which can be called an agent
  • S201 Communicate with the ServiceManager, obtain the ServiceManger object by reflection, call the listServices interface therein, and obtain the ServiceName of all system services.
  • ServiceName For a specific ServiceName, judge whether the ServiceName class has an internal class named ⁇ ServiceName>.Stub through reflection. If it exists, it means that this system service is a Java layer system service, the process continues, and S203 is executed. If it does not exist, it means that this system service is a Native system service, and no more attempts to enumerate the calling method and its parameters.
  • S205 Output service invocation information according to the invocation number, interface invocation method and invocation parameters.
  • the method for obtaining service invocation information provided by the foregoing embodiment is based on the principles and characteristics of the Android Binder system service implementation.
  • the method of calling the listService interface in the ServiceManager through reflection is used to obtain the system service name (ServiceName); the system service name is used to determine whether it exists by reflection.
  • the Stub class corresponding to the service name If it exists, it means that a Java layer system service has been found; then again through reflection, the values of all integer member variables starting with "TRANSACTION_" under the Stub class are obtained. These values are the interface call numbers of the system service. (TransactionCode); Finally, all the method names and method parameters under the Proxy class are obtained through reflection again.
  • These method names and method parameters are the interface calling method (Method) and its parameters (Arguments).
  • the call information does not need to be obtained by manual reverse analysis, and the call information of the service can be automatically and quickly obtained through stepwise reflection analysis.
  • FIG 3 is a schematic diagram of an application environment of a service vulnerability testing method in an embodiment.
  • the application environment includes a control terminal 301 and an agent terminal 302, both of which can perform network communication.
  • the control terminal 301 sends trigger information to the agent terminal 301 to control the agent terminal 302 to obtain the service invocation information, and then the control terminal 301 calls the service interface, and performs a vulnerability test according to the invocation response information returned by the service interface, and obtains the vulnerability test result.
  • both the control terminal 301 and the agent terminal 302 can be implemented by a terminal device or a server.
  • the terminal device can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices.
  • the server can be implemented by an independent server or a server cluster composed of multiple servers.
  • the agent terminal 301 may be the terminal in the foregoing embodiment, or may be an application or a plug-in configured in the terminal in the foregoing embodiment, so as to implement the method for obtaining service invocation information.
  • a service vulnerability testing method is provided. This embodiment uses this method to apply to the control terminal in Figure 4 (which can be a specific terminal device or an application, etc.) ) Give an example.
  • a service vulnerability testing method includes operation S401 to operation S404.
  • Operation S401 Obtain service invocation information of the target service to be invoked; the service invocation information is determined according to the result of the invocation information reflection analysis; the invocation information reflection analysis is that when the first target class matches the reference class, the The first target class is a reflection analysis performed as a reflection object; the first target class is obtained by class reflection analysis using the service identifier of the target service as a reflection object.
  • the control terminal may send a service invocation information acquisition instruction to the agent terminal to trigger the agent terminal to acquire the service invocation information of the target service, and return the acquired service invocation information to the control terminal.
  • the implementation manner of obtaining the service invocation information of the target service by the agent can refer to the foregoing embodiment of the method for obtaining service invocation information, which will not be repeated here.
  • service invocation information can also be obtained from a pre-built database.
  • the service invocation information in the database may be stored in the database after the agent generates the service invocation information.
  • Operation S402 Send an invocation instruction to the service interface of the target service according to the service invocation information.
  • the service invocation information contains related information for invoking the service interface, so the invocation instruction can be sent to the service interface according to the service invocation information.
  • the call instruction can trigger the target service to complete the corresponding execution program when receiving the call instruction through the service interface, and generate the first call response message.
  • the target service may not be able to respond to the call instruction when it is restarted/a process is killed.
  • the call response information can be: the target service is not responding, the target service process failure is related to the service running status information.
  • Operation S403 receiving the first call response information returned by the service interface according to the call instruction.
  • the first call response information returned by the target service of the control terminal interface through the service interface may include response information of the target service to the call instruction, service interface/operation status of the target service, and the like.
  • Operation S404 Perform a vulnerability test analysis according to the first call response information, and obtain a vulnerability test result of the target service.
  • the first call response information contains the response of the target service/service interface to the call instruction
  • a vulnerability test analysis can be performed to determine whether the target service stores a vulnerability, and obtain the vulnerability test result.
  • the step of performing a vulnerability test analysis based on the first call response information to obtain a vulnerability test result of the target service includes: obtaining system operation status information; according to the first call response information and Vulnerability test analysis is performed on the system operating status information, and a vulnerability test result of the target service is obtained.
  • ServiceManager maintains a list of all system services in the Android system.
  • Ordinary App can call the system service interface in the ServiceManager to use the system services provided by the Android system to implement the security test of the system services.
  • these system service interfaces are also the attack surface exposed by the Android system.
  • the attack surface of the system service interface can be used to test high-privileged system service processes, observe the response of high-privileged system service processes, and find vulnerabilities.
  • system service interface implementation source code the job is easier, because knowing the method name and method parameters of the system service implementation, you can directly write a program to call the system service interface; however, there is only one tested OEM (Original Equipment Manufactuce) In the case of mobile phones and no system services to achieve source code, there are many difficulties.
  • One of the methods is to manually reverse the Android system framework in the mobile phone and use the method of manually searching for the Android system service interface.
  • Android 9.0 you need to extract the services.vdex file in the mobile phone to the computer, and then the vdex file Convert it to a cdex file, then convert the cdex file to a dex file, and then use a reverse tool such as JEB or JD-GUI to open it, and perform the reverse analysis of the services.odex and other binary files implemented in the mobile phone. It completely depends on the analyst’s experience.
  • the system service realizes the characteristics of the code, and then relies on the experience of the analyst to find the realization of the system service.
  • the vulnerability testing method of the above service automatically obtains the system service name, call number, interface call method and parameters of the Android mobile phone Java layer system service without the system service implementation source code, which can free the manual work of reverse analysts. It can effectively improve the efficiency of vulnerability testing and lay the foundation for subsequent fuzz testing.
  • the operating system can be adjusted according to the vulnerability test results to ensure the normal operation of the operating system.
  • the system may be restarted/a process may be killed. These can be used to determine whether there is a vulnerability, but if it is still not possible to determine the presence of a vulnerability, you can combine other vulnerability test data. Complete the vulnerability test process of the target service. In this case, calling the system interface can help find the vulnerability.
  • the service invocation information includes service name, invocation number, method name, and parameter value; the step of sending an invocation instruction to the service interface of the target service according to the service invocation information includes: obtaining the first One input data; generate an interface call function according to the service name, the call number, the method name, and the parameter value; send a call carrying the first input data to the service interface according to the interface call function Instructions to enable the service interface to generate and return the first call response information according to the first input data.
  • the input data can be sent to the target service in the process of invoking the service interface, so that the target service performs a response operation on the input data, and the result of the operation can be used as the first invocation response message.
  • An example of the process of generating an interface call function is as follows: Suppose the call method name is setHandoverConfig, its call number is 14, and the call parameters include three: the first and second parameters are of type int, and the third parameter is a name called org.codeaurora The interface of .ims.internal.IQtiImsExtListener. According to the above information, the following interface calling functions can be generated:
  • the above embodiment combines the service call information to generate the interface call function, and then sends the call instruction to the service interface to perform vulnerability test analysis based on the call response information returned by the service interface.
  • the implementation process is simple, and the acquisition of service call information does not require manual reverse engineering Analysis, the entire process of vulnerability testing and analysis is highly efficient.
  • the input data can be processed out of order, the system service interface can be called repeatedly, and then whether there are loopholes can be judged according to the response of the system and the performance of the system.
  • the step of performing vulnerability test analysis according to the first call response information to obtain the vulnerability test result of the target service includes: obtaining second input data; Input data obtained by out-of-order processing; sending a call instruction carrying the second input data to the service interface according to the interface calling function, so that the service interface generates and returns the second input data according to the second input data 2.
  • Call response information receive the second call response information returned by the service interface; perform vulnerability test analysis according to the first call response information and the second call response information to obtain the vulnerability test result of the target service.
  • test results have high accuracy.
  • FIG. 5 is a structural block diagram of an apparatus 500 for acquiring service invocation information in an embodiment.
  • an apparatus for obtaining service invocation information includes a service identification obtaining module 501, a class reflection module 502, a class determination module 503, a call information reflection module 504, and a call information determination module 505. in:
  • the service identification acquiring module 501 is configured to acquire the service identification of the target service to be invoked when a service invocation information acquisition instruction is received.
  • the class reflection module 502 is configured to perform class reflection analysis using the service identifier as a reflection object.
  • the class determination module 503 is configured to obtain the first target class corresponding to the target service according to the result of the class reflection analysis.
  • the call information reflection module 504 is configured to perform call information reflection analysis using the first target class as a reflection object when the first target class matches the reference class.
  • the calling information determining module 505 is configured to obtain service calling information corresponding to the target service according to the result of the reflection analysis of the calling information.
  • the above-mentioned acquiring device for service invocation information acquires the service identifier of the target service to be invoked; obtains the first target class corresponding to the target service according to the class reflection analysis result of the service identifier; when the first target class matches the reference class, according to the first target class
  • the invocation information reflection analysis result of a target class obtains the service invocation information corresponding to the target service.
  • the device further includes: a class identification determination module, configured to determine the class identification corresponding to the first target class according to the result of the class reflection analysis; a matching determination module, configured to identify the class When the identifier matches the preset reference class identifier, it is determined that the first target class matches the reference class.
  • the service identification acquisition module includes: a call reflection sub-module, which is used to perform call reflection analysis on the service enumeration interface in the service manager when the service call information acquisition instruction is received, so as to trigger the service enumeration
  • the interface returns system service information;
  • the system service information is the information of the service managed by the service manager;
  • the service information acquisition submodule is used to acquire the system service information returned by the service listing interface;
  • the service name acquisition submodule Used to obtain the service name of the target service from the system service information as the service identifier.
  • the class identification determining module includes: a first class name obtaining submodule, configured to obtain the class name of the first target class according to the result of the class reflection analysis; a class identification obtaining submodule, configured to The class identifier is determined according to the class name of the first target class.
  • the call information reflection module includes: a number reflection sub-module, configured to use the class name of the first target class as a reflection object to perform call number reflection analysis to obtain the call number of the target service; second The class name obtaining submodule is used to obtain the class name of the second target class; the second target class is an internal class of the first target class; the parameter reflection submodule is used to be the class of the second target class When the name matches the preset reference class name, the class name of the second target class is used as the reflection object to perform the call parameter reflection analysis to obtain the call parameters; the reflection result determines the sub-module, which is used to determine the sub-module according to the call number and the The calling parameter obtains the result of the reflection analysis of the calling information.
  • a number reflection sub-module configured to use the class name of the first target class as a reflection object to perform call number reflection analysis to obtain the call number of the target service
  • second The class name obtaining submodule is used to obtain the class name of the second target class
  • the second target class is
  • the parameter reflection submodule includes: a first reflection unit, configured to use the class name of the second target class as a reflection object to perform method name reflection analysis and parameter value reflection analysis, respectively, to obtain the target service The method name and parameter value of the method; the calling parameter obtaining unit is used to obtain the calling parameter according to the method name and the parameter value.
  • the number reflection sub-module includes: a second reflection unit, used to use the class name of the first target class as a reflection object to perform call number reflection analysis; a call number acquisition unit, used to reflect from the call number As a result of the analysis, the member variable value corresponding to the reference number identifier is determined as the calling number of the target service.
  • the service identification acquisition module includes: a service determination sub-module, which is used to determine from the service of the operating system when the service selection information is carried in the service invocation information acquisition instruction.
  • the reference service corresponding to the information; a service identification determination sub-module for determining the service identification of the reference service as the service identification of the target service.
  • the service identification acquisition module is further configured to determine the service identification of each service of the operating system as the service identification of the target service when the service selection information is not carried in the service invocation information acquisition instruction.
  • Fig. 6 is a structural block diagram of a service vulnerability testing device 600 in an embodiment.
  • a service vulnerability testing device includes a calling information acquisition module 601, a calling instruction sending module 602, a response information receiving module 603, and a test result determining module 604. in:
  • the invocation information acquisition module 601 is used to acquire the service invocation information of the target service to be invoked; the service invocation information is determined according to the result of the invocation information reflection analysis; the invocation information reflection analysis is when the first target class matches the reference class When the first target class is used as a reflection object for reflection analysis; the first target class is obtained by class reflection analysis using the service identifier of the target service as the reflection object.
  • the calling instruction sending module 602 is configured to send a calling instruction to the service interface of the target service according to the service calling information.
  • the response information receiving module 603 is configured to receive the first call response information returned by the service interface according to the call instruction.
  • the test result determination module 604 is configured to perform vulnerability test analysis according to the first call response information, and obtain the vulnerability test result of the target service.
  • the vulnerability testing device of the above service obtains the service call information automatically obtained through stepwise reflection analysis, calls the service interface of the target service according to the service call information, and obtains the vulnerability test result of the target service according to the response information returned by the service interface.
  • Manual reverse analysis of the call information can effectively improve the efficiency of vulnerability testing.
  • the service invocation information includes service name, invocation number, method name, and parameter value; the step of sending an invocation instruction to the service interface of the target service according to the service invocation information includes: obtaining the first One input data; generate an interface call function according to the service name, the call number, the method name, and the parameter value; send a call carrying the first input data to the service interface according to the interface call function Instructions to enable the service interface to generate and return the first call response information according to the first input data.
  • the step of performing vulnerability test analysis according to the first call response information to obtain the vulnerability test result of the target service includes: obtaining second input data; Data obtained by out-of-order processing of the first input data; sending a call instruction carrying the second input data to the service interface according to the interface calling function, so that the service interface generates the data according to the second input data And return the second call response information; receive the second call response information returned by the service interface; perform vulnerability test analysis according to the first call response information and the second call response information to obtain the vulnerability test of the target service result.
  • the step of performing a vulnerability test analysis based on the first call response information to obtain a vulnerability test result of the target service includes: obtaining system operation status information; according to the first call response information and Vulnerability test analysis is performed on the system operating status information, and a vulnerability test result of the target service is obtained.
  • the division of the modules in the above-mentioned service invocation information acquisition device is only for illustration. In other embodiments, the service invocation information acquisition device can be divided into different modules as needed to complete the above-mentioned service invocation information acquisition device. All or part of the function.
  • the service vulnerability testing device is the same, so I won’t repeat it here.
  • a service vulnerability testing system is provided, and the structure diagram of the system can be parameterized in Figure 3.
  • the system includes a control terminal and an agent terminal connected to the network. in:
  • the control terminal is used to send a service invocation information acquisition instruction to the agent terminal.
  • the proxy terminal is used to obtain the service identification of the target service to be invoked when receiving the service invocation information acquisition instruction; use the service identification as a reflection object to perform class reflection analysis; and obtain the result of the class reflection analysis
  • the first target class corresponding to the target service when the first target class matches the reference class, the first target class is used as a reflection object for invocation information reflection analysis; the result of the invocation information reflection analysis is obtained Service invocation information corresponding to the target service.
  • the control terminal is further configured to receive the service invocation information returned by the agent; send a calling instruction to the service interface of the target service according to the service invocation information; receive the service interface to return according to the invocation instruction According to the first call response information, the vulnerability test analysis is performed to obtain the vulnerability test result of the target service.
  • the agent terminal analyzes the service call information automatically obtained through stepwise reflection under the trigger of the control terminal.
  • the control terminal calls the service interface of the target service according to the service call information, and obtains the target according to the response information returned by the service interface.
  • the service vulnerability test results do not require manual reverse analysis of the call information, which can effectively improve the efficiency of the vulnerability test.
  • the framework of the service vulnerability test system may be a Drozer-based test framework, implemented by two test plug-ins, the control terminal and the agent terminal. These two test plug-ins can be configured in different terminal devices respectively.
  • the agent terminal is configured in a terminal device, and the terminal device runs a service manager; the agent terminal is further configured to communicate through cross-process communication when receiving the service invocation information acquisition instruction The tool communicates with the service manager to obtain the service identifier of the target service.
  • the cross-process communication tool may refer to a tool that can implement IPC (Inter-Process Communication, inter-process communication). Further, the cross-process communication tool may refer to Binder and the like. Furthermore, the client process (Client) where the agent is located communicates with the server process (Server) that provides the service through the Binder.
  • IPC Inter-Process Communication, inter-process communication
  • the service vulnerability testing system can be implemented by the console 701 and the agent 702 in FIG. 7.
  • the Console is configured on the PC side
  • the Agent is configured on the mobile phone side
  • the Console and Agent can communicate through the adb protocol.
  • Agent and Service Manager (service manager) communicate through IPC.
  • the IPC method is described from the user mode 703 (normal App generally runs in the user mode).
  • kernel mode (704 in Figure 7)
  • the user mode runs on top of the kernel mode.
  • Figure 7 mainly reflects the IPC communication between the user mode agent and ServiceManger, which is actually carried out through the kernel mode Binder driver.
  • the Console can provide users with the function of enumerating system service interfaces through the command line, that is, the user can obtain the enumeration information of the system service by entering the command line on the PC side, and then can know its Service call information.
  • the Agent can be equivalent to an ordinary Android App. It communicates with the ServiceManager process through the Binder-based IPC, obtains all system service interface names through the listServices interface provided by the ServiceManager, and then obtains a specific System service interface call method number (TransactionCode) and interface call method name (Method) and its parameters (Arguments).
  • TransactionCode System service interface call method number
  • Method Method name
  • Arguments its parameters
  • the vulnerability testing device and the various modules in the system of the above-mentioned services can be implemented in whole or in part by software, hardware, and combinations thereof.
  • the foregoing modules may be embedded in the form of hardware or independent of the processor in the computer device, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the foregoing modules.
  • each module in the service invocation information acquisition device and the service vulnerability testing device provided in the embodiments of the present application may be in the form of a computer program.
  • the computer program can be run on a mobile terminal or a server.
  • the program module composed of the computer program can be stored in the memory of the mobile terminal or the server.
  • the embodiment of the present application also provides a mobile terminal.
  • the mobile terminal includes a memory and a processor, and a computer program is stored in the memory.
  • the processor causes the processor to perform operations of the method for obtaining service invocation information.
  • the embodiment of the present application also provides a computer-readable storage medium.
  • a computer-readable storage medium has a computer program stored thereon, and when the computer program is executed by a processor, the operation of the method for obtaining service call information is realized.
  • the embodiment of the present application also provides a mobile terminal.
  • the mobile terminal includes a memory and a processor, and a computer program is stored in the memory.
  • the processor executes the operation of the vulnerability testing method of the service.
  • the embodiment of the present application also provides a computer-readable storage medium.
  • Fig. 8 is a schematic diagram of the internal structure of a mobile terminal in an embodiment.
  • the mobile terminal includes a processor, a memory, and a network interface connected through a system bus.
  • the processor is used to provide computing and control capabilities to support the operation of the entire mobile terminal.
  • the memory is used to store data, programs, etc., and at least one computer program is stored in the memory, and the computer program can be executed by the processor to implement the wireless network communication method suitable for mobile terminals provided in the embodiments of the present application.
  • the memory may include a non-volatile storage medium and internal memory.
  • the non-volatile storage medium stores an operating system and a computer program.
  • the computer program may be executed by the processor to implement a method for obtaining service invocation information provided by the following embodiments.
  • the internal memory provides a cached operating environment for the operating system computer program in the non-volatile storage medium.
  • the network interface can be an Ethernet card or a wireless network card, etc., for communicating with external mobile terminals.
  • the mobile terminal can be a mobile phone, a tablet computer, or a personal digital assistant or a wearable device.
  • Fig. 9 is a schematic diagram of the internal structure of a mobile terminal in another embodiment.
  • the mobile terminal includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus.
  • the processor of the mobile terminal is used to provide computing and control capabilities.
  • the memory of the mobile terminal includes a non-volatile storage medium and an internal memory.
  • the non-volatile storage medium stores an operating system and a computer program.
  • the internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium.
  • the communication interface of the mobile terminal is used to communicate with an external terminal in a wired or wireless manner.
  • the wireless manner can be implemented through WIFI, operator network, NFC (Near Field Communication) or other technologies.
  • the computer program is executed by the processor to realize a service vulnerability testing method.
  • the display screen of the mobile terminal may be a liquid crystal display screen or an electronic ink display screen, and the input device of the mobile terminal may be a touch layer covered on the display screen, or a button, trackball or touch pad set on the shell of the mobile terminal , It can also be an external keyboard, touchpad, or mouse.
  • a computer program product containing instructions that, when running on a computer, causes the computer to execute a method for obtaining service invocation information.
  • a computer program product containing instructions that, when it runs on a computer, enables the computer to execute a service vulnerability testing method.
  • Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM), which acts as external cache memory.
  • RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous Link (Synchlink) DRAM
  • Rambus direct RAM
  • DRAM direct memory bus dynamic RAM
  • RDRAM memory bus dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种服务调用信息的获取方法、装置和服务的漏洞测试方法，所述服务调用信息的获取方法包括：获取待调用的目标服务的服务标识；对服务标识进行类反射分析；根据类反射分析的结果得到目标服务对应的第一目标类；当第一目标类与参考类相匹配时，对第一目标类进行调用信息反射分析，得到与目标服务对应的服务调用信息。

Description

服务调用信息的获取方法、装置和服务的漏洞测试方法 技术领域
本申请服务测试技术领域，特别是涉及一种服务调用信息的获取方法、装置、移动终端和计算机可读存储介质，服务的漏洞测试方法、装置、系统、移动终端和计算机可读存储介质。
背景技术
应用程序在运行过程中可以调用操作系统的服务接口，以使用该操作系统提供的系统服务。利用服务接口的服务调用信息可以对系统服务进行测试，以查看这些服务的响应情况。
在没有操作系统源码的情况下，传统方法确定服务调用信息的方法主要是：通过手工逆向操作系统框架文件来寻找系统服务所提供的服务调用信息。
然而，这种方法需要技术人员人工对操作系统框架文件进行逆向分析，效率较低。
发明内容
本申请实施例提供一种服务调用信息的获取方法、装置、移动终端和计算机可读存储介质，服务的漏洞测试方法、装置、系统、移动终端和计算机可读存储介质，可以有效提高服务调用信息的获取效率。
一种服务调用信息的获取方法，包括：
当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；
将所述服务标识作为反射对象进行类反射分析；
根据所述类反射分析的结果得到所述目标服务对应的第一目标类；
当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；
根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
一种服务调用信息的获取装置，包括：
服务标识获取模块，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；
类反射模块，用于将所述服务标识作为反射对象进行类反射分析；
类确定模块，用于根据所述类反射分析的结果得到所述目标服务对应的第一目标类；
调用信息反射模块，用于当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；
调用信息确定模块，用于根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
一种移动终端，包括存储器及处理器，所述存储器中储存有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行所述的服务调用信息的获取方法的操作。
一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现所述的服务调用信息的获取方法的操作。
上述服务调用信息的获取方法、装置、移动终端和计算机可读存储介质，获取待调用的目标服务的服务标识；根据服务标识的类反射分析结果得到目标服务对应的第一目标类；当第一目标类与参考类相匹配时，根据第一目标类的调用信息反射分析结果得到与目标服务对应的服务调用信息，在没有操作系统源码的情况下，不需要通过人工逆向分析的方法获取调用信息，能通过逐步反射分析自动快速获取服务的调用信息。
一种服务的漏洞测试方法，包括：
获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结 果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到；
根据所述服务调用信息向所述目标服务的服务接口发送调用指令；
接收所述服务接口根据所述调用指令返回的第一调用响应信息；
根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
一种服务的漏洞测试装置，包括：
调用信息获取模块，用于获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到；
调用指令发送模块，用于根据所述服务调用信息向所述目标服务的服务接口发送调用指令；
响应信息接收模块，用于接收所述服务接口根据所述调用指令返回的第一调用响应信息；
测试结果确定模块，用于根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
一种移动终端，包括存储器及处理器，所述存储器中储存有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行所述的服务的漏洞测试方法的操作。
一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现所述的服务的漏洞测试方法的操作。
上述服务的漏洞测试方法、装置、移动终端和计算机可读存储介质，获取通过逐步反射分析自动获取到的服务调用信息，根据该服务调用信息调用目标服务的服务接口，并根据服务接口返回的响应信息得到目标服务的漏洞测试结果，不需要人工进行调用信息的逆向分析，能有效提高漏洞测试的效率。
一种服务的漏洞测试系统，包括：网络连接的控制端和代理端；
所述控制端，用于向所述代理端发送服务调用信息获取指令；
所述代理端，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；将所述服务标识作为反射对象进行类反射分析；根据所述类反射分析的结果得到所述目标服务对应的第一目标类；当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息；
所述控制端，还用于接收所述代理端返回的所述服务调用信息；根据所述服务调用信息向所述目标服务的服务接口发送调用指令；接收所述服务接口根据所述调用指令返回的第一调用响应信息；根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
上述服务的漏洞测试系统，代理端在控制端的触发下通过逐步反射分析自动获取到的服务调用信息，控制端根据该服务调用信息调用目标服务的服务接口，并根据服务接口返回的响应信息得到目标服务的漏洞测试结果，不需要人工进行调用信息的逆向分析，能有效提高漏洞测试的效率。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为一个实施例中服务调用信息的获取方法的流程图；
图2为另一个实施例中服务调用信息的获取方法的流程图；
图3为一个实施例中服务的漏洞测试方法的应用场景图；
图4为一个实施例中服务的漏洞测试方法的流程图；
图5为一个实施例中服务调用信息的获取装置的结构框图；
图6为一个实施例中服务的漏洞测试装置的结构框图；
图7为一个实施例中服务的漏洞测试系统的结构框图；
图8为一个实施例中移动终端的内部结构示意图；
图9为另一个实施例中服务器的内部结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
在一个实施例中，如图1所示，提供了一种服务调用信息的获取方法，本实施例以该方法应用于终端进行举例说明，可以理解的是，该方法也可以应用于服务器，还可以应用于包括终端和服务器的系统，并通过终端和服务器的交互实现。其中，其中，终端可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器可以用独立的服务器或者是多个服务器组成的服务器集群来实现。在某些实施例中，该方法也可以应用于配置在终端上的应用程序或插件。
如图1所示，一种服务调用信息的获取方法，包括操作S101至操作S105。具体说明如下：
操作S101：当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识。
其中，服务可以称为系统服务(system services)，指执行指定系统功能的程序、例程或进程，以便支持其他程序。其中，系统可以指终端上所配置的操作系统，可以是Android(安卓)、Windows、IOS等操作系统。应用程序在需要使用某个服务(或者对某个服务进行测试)时，可以调用该服务对应的接口，以应用该服务提供的功能。进一步的，Android系统服务可以是配置有Android系统的终端设备中运行在系统服务进程的服务组件，可被普通app通过Binder进行调用。
服务调用信息指的是能够对服务接口进行调用的信息，可以包括接口编号、调用编号(可以简称为调用号)、调用参数等。另外，一个服务可能包含有多个方法，因此，要调用服务中具体的方法时，该服务调用信息还可以包括方法名称、调用参数等。
进一步的，服务调用信息获取指令指的是触发服务调用信息获取程序开始执行的指令。终端在接收到服务调用信息获取指令时开始执行服务标识的获取程序以及后续进行反射分析的程序。
目标服务为本次服务调用信息获取方法所针对的待调用服务，即，在执行完本次服务调用信息获取方法后，可以基于所获取的服务调用信息调用该目标服务。目标服务可以指操作系统中的全部或部分服务。进一步的，服务调用信息获取指令中可以包含有用于表示用户所选择服务的服务选定信息，此时，目标服务可以指与该服务选定信息对应的系统服务。如果服务调用信息中并未包含服务选定信息，则可以按照预设的规则确定目标服务，例如：将所有的系统服务都确定为目标服务，也可以是通过一定的算法从系统服务中选择出目标服务，还可以是随机从系统服务中确定目标服务。
另外，对于Android系统，Android系统服务有两种，一种是在Java层系统服务，编写语言为Java，Java层系统服务往往是厂商定制的，没有开放源代码；另外一种是在native层系统服务，用于启动上层服务或者向上层系统服务提供基础运行环境，例如ServiceManager，编写语言一般为c/c++。本发明实施例可以获取Java层系统服务的服务调用信息，以便对Java层系统服务进行漏洞测试。
服务标识指的是对目标服务进行标识的信息，可以通过服务名称(ServiceName)、服务 编号、服务的功能实现代码等来表示。进一步的，目标服务的服务标识获取过程可以是从服务标识数据库中进行标识查询，将所查询的标识作为该目标服务的服务标识；也可以通过反射等方法来确定服务标识。
操作S102：将所述服务标识作为反射对象进行类反射分析。
其中，反射是Java编程语言提供的一种在编译期(Compile Time)之外的运行期(Runtime)获得任何一个类的字节码的机制，可以反射得到接口、变量、方法等信息。可以通过反射得到的信息对服务中的方法进行调用。
进一步的，操作S102是将服务标识作为反射对象对ServiceManager所提供的的信息进行反射分析，由于该反射分析的结果为ServiceManager所管理服务的类，因此本发明实施例将该反射分析称为类反射分析。
其中，ServiceManager是一类特殊的系统服务，它先于其他系统服务启动，可以对外提供服务注册和服务检索功能。本发明实施例基于ServiceManager进行逐步反射分析，能得到服务调用信息。
操作S103：根据所述类反射分析的结果得到所述目标服务对应的第一目标类。
其中，类(Class)是面向对象程序设计(OOP，Object-Oriented Programming)实现信息封装的基础。类是一种用户定义的引用数据类型，也称类类型。类的实例称为对象。
本步骤根据类反射分析的结果得到第一目标类。该类反射分析的结果中可以包含与第一目标类相关的信息，例如：第一目标类的类名、种类以及相关的其他参数。
操作S104：当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析。
其中，参考类可以是预先确定的与应用程序运行相关的类，例如，Java层系统服务对应的类。具体的，参考类可以类名为AAA.BBB.CCC.Stub或者AAA.BBB.CCC.Stub.Proxy的类。其中，AAA.BBB.CCC可以根据实际情况进行替换，在进行类的匹配判断时，主要查看第一目标类类名的后缀是否为.Stub、.Proxy、.Stub.Proxy等，如果是，则认为第一目标类与参考类相匹配。
进一步的，在一个实施例中，在所述将所述服务标识作为反射对象进行类反射分析的步骤之后，还包括：根据所述类反射分析的结果确定所述第一目标类对应的类标识；当所述类标识与预设的参考类标识相匹配时，判定所述第一目标类与所述参考类相匹配。
其中，类标识指的是能够对类进行标识的信息，可以从类反射分析的结果中确定出能够对第一目标类进行唯一表示的信息，该信息就可以作为第一目标类类的类标识。另外，参考类标识指的是预先确定的用于挑选出符合预设类型的第一目标类的类标识，可以指前述.Stub、.Proxy、.Stub.Proxy等，也可以是包含有.Stub、.Proxy、.Stub.Proxy等的类名。
在一个实施例中，所述根据所述类反射分析的结果确定所述第一目标类对应的类标识的步骤，包括：根据所述类反射分析的结果获取所述第一目标类的类名；根据所述第一目标类的类名确定所述类标识。
进一步的，对服务标识进行类反射分析的结果为类名，如果第一目标类的类名中包含有.Stub、.Proxy、.Stub.Proxy等后缀，则可以判定第一目标类与参考类相匹配。更进一步的，若第一目标类满足以下条件：name！＝null&&name.equals(serviceClass+".Stub")，则可以认为第一目标类与参考类相匹配。
另外，当目标服务为多个时，第一目标类也可能为多个，此时可以分别将这些第一目标类与参考类(不同目标类所比对的参考类可以相同也可以不同)进行比对，进而对符合条件的第一目标类进行后续的反射分析处理。
操作S105：根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
在第一目标类与参考类相匹配时，该第一目标类就是所要查找的类，进一步对其进行反射分析就能获取到与目标服务相关的方法名称、调用编号、调用参数等服务调用信息。因此， 本发明实施例将本次反射分析称为调用信息反射分析。
上述服务调用信息的获取方法，获取待调用的目标服务的服务标识；根据服务标识的类反射分析结果得到目标服务对应的第一目标类；当第一目标类与参考类相匹配时，根据第一目标类的调用信息反射分析结果得到与目标服务对应的服务调用信息，在没有操作系统源码的情况下，不需要通过人工逆向分析的方法获取调用信息，能通过逐步反射分析自动快速获取特定服务(例如“Java层系统服务”)的调用信息。可以解放逆向分析人员的手工工作，自动化的生成系统服务接口相关信息，为后续的模糊测试(如：对服务的漏洞测试)打下基础。
在一个实施例中，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：当接收到服务调用信息获取指令时，对服务管理器中的服务列举接口进行调用反射分析，以触发所述服务列举接口返回系统服务信息；所述系统服务信息为所述服务管理器所管理服务的信息；获取所述服务列举接口返回的所述系统服务信息；从所述系统服务信息中获取所述目标服务的服务名称，作为所述服务标识。
其中，服务管理器可以为能够对操作系统的服务进行管理的服务，可以是前述ServiceManager。服务列举接口可以指具有服务信息列举(也可以称为枚举)功能的接口，可以为java系统中的listServices接口。本实施例中，终端通过调用ServiceManager中的listServices接口来获取目标服务的服务名称。
操作系统通过服务管理器对服务进行管理，因此，服务管理器所管理服务可以指操作系统所对应的服务。进一步的，系统服务信息可以包括服务名称、服务描述信息(对服务所实现的功能进行描述的信息)等。
具体的，可以调用ServiceManager中的listServices接口，由listServices接口列举系统服务信息。之后终端可以所列举的系统服务信息进行符号、位置等的识别，根据所识别的符号、位置等信息获取服务名称ServiceName(也可以称为系统服务名或服务名)，例如：将中括号[]前面的信息确定为服务名称，或者将系统服务信息中首字段中的信息确定为服务名称。
进一步的，通过listServices接口枚举的系统服务信息可以为：
run XX.ssfuzzer.getservicesinfo
0:sip[android.net.sip.ISipService]
1:dpmservice[Unkown Service！]
2:com.qualcomm.location.izat.IzatService[com.qti.izat.IIzatService]
3:secure_element[Unkown Service！]
4:oiface[com.oppo.oiface.IOIfaceService]
5:neoservice[Unkown Service！]
6:omedia[com.oppo.omedia.IOMediaService]
7:qti.ims.ext[org.codeaurora.ims.internal.IQtiImsExt]
8:carrier_config[com.android.internal.telephony.ICarrierConfigLoader]
9:phone[com.android.internal.telephony.ITelephony]
其中，run XX.ssfuzzer.getservicesinfo是对listServices接口的调用指令。listServices接口响应该调用指令后输出系统服务列表，该系统服务列表中包含有编号从0至9的十个系统服务信息。其中，中括号[]中的信息为服务描述信息，[]前面的信息即为服务名称。以7:qti.ims.ext[org.codeaurora.ims.internal.IQtiImsExt]为例，“7”表示该服务在系统服务列表中的编号，“qti.ims.ext”表示服务名称，“org.codeaurora.ims.internal.IQtiImsExt”表示服务描述信息。
进一步的，终端设备在确定服务名称时，可以先识别[]的位置，将[]前面的信息确定为服务名称。
上述实施例通过调用服务列举接口来获取系统服务信息，进而根据系统服务信息确定服务标识，其确定过程简单，通过一个简单的调用代码即可实现，能有效提高调用服务信息的获取效率。
在一个实施例中，第一目标类的数量可以为一个、两个甚至多个。在第一目标类的数量为两个或多个时，可以通过同步或异步的方式分别对这些第一目标类进行反射分析，分别得到这些第一目标类对应的服务调用信息，作为对应目标服务的服务调用信息。
以第一目标类为一个为例，在一个实施例中，所述将所述第一目标类作为反射对象进行调用信息反射分析的步骤，包括：将所述第一目标类的类名作为反射对象进行调用编号反射分析，得到所述目标服务的调用编号(TransactionCode)；获取第二目标类的类名；所述第二目标类为所述第一目标类的内部类；当所述第二目标类的类名与预设的参考类名相匹配时，将所述第二目标类的类名作为反射对象进行调用参数反射分析，得到调用参数；根据所述调用编号和所述调用参数得到所述调用信息反射分析的结果。
其中，参考类名可以为特定类型的类名，例如java中包含有方法名称和调用参数的类名。具体的，可以为后缀包含.Proxy的类名。
进一步的，在一个实施例中，所述将所述第二目标类的类名作为反射对象进行调用参数反射分析，得到调用参数的步骤，包括：将所述第二目标类的类名作为反射对象分别进行方法名称反射分析和参数值反射分析，得到所述目标服务的方法名称和参数值；根据所述方法名称(Method)和所述参数值(Arguments)，得到所述调用参数。
在某些实施例中，也可以是将第二目标类的类名作为反射对象进行一次反射分析，根据java的编写规则，反射分析之后就能得到对应的方法名称和参数值。
更进一步的，在一个实施例中，所述将所述第一目标类的类名作为反射对象进行调用编号反射分析，得到所述目标服务的调用编号的步骤，包括：将所述第一目标类的类名作为反射对象进行调用编号反射分析；从调用编号反射分析的结果中确定与参考编号标识对应的成员变量值，作为所述目标服务的调用编号。
其中，参考编号标识为对调用编号进行区别的标识，可以是TRANSACTION_。
进一步的，可以将所确定的成员变量值中的整型值确定为目标服务的调用编号。
上述实施例的具体实现过程可以为：
执行qti.ims.ext[org.codeaurora.ims.internal.IQtiImsExt]这一调用编号反射分析语句。，可以得到如下的调用编号反射分析结果：
Java Method:
setHandoverConfig(14)[u'int',u'int',u'interface org.codeaurora.ims.internal.IQtiImsExtListener']
getCallForwardUncondTimer(2)[u'int',u'int',u'int',u'interface org.codeau-rora.ims.internal.IQtiImsExtListener']
setRcsAppConfig(16)[u'int',u'int']
每个Java Method中小括号里面的数字就是一个个的以TRANSACTION_开头的成员变量的值。举个例子setHandoverConfig(14)，意味着qti.ims.ext这个系统服务有一个setHandoverConfig的系统服务接口，它的调用号为14。调用号14的确定过程可以如下：
1.调用ServiceManager.getService(“qti.ims.ext”)得到<ServiceName>；
2.判断<ServiceName>.Stub是否存在；
3.若存在，则获取<ServiceName>.Stub所有以“TANSACTION_”开头的成员变量；
4.发现有一个成员变量为TRANSACTION_setHandoverConfig，其值为14。
可见，调用编号反射分析结果中会隐含有“TANSACTION_”的开头，其对应的整型数值就可以确定为调用号。
上述实施例，通过对第一目标类和第二目标类的类名进行反射分析，得到对应的调用信息，确定过程简单，同时能得到调用编号、方法名称、调用参数等细节信息，根据这些信息能准确实现对服务接口的调用。
在某些实施例中，如果仅通过调用编号、方法名称、调用参数中的一个或部分就能构建接口调用函数，则可以仅执行上述实施例中的其中一个或部分。
在一个实施例中，可以通过在终端中输入命令行的方式来触发服务调用信息的获取程序。该命令行中可以包含有所要调用服务的服务选定信息(也可以称为命令行参数)，以针对性地获取所选定的目标服务的服务调用信息。当然，命令行中也可以没有服务选定信息，此时可以根据情况进行服务调用信息的获取，例如：可以获取操作系统中所有服务的服务调用信息。
进一步的，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：当所述服务调用信息获取指令中携带有服务选定信息时，从操作系统的服务中确定与所述服务选定信息对应的参考服务；将所述参考服务的服务标识确定为所述目标服务的服务标识。
在另一个实施例中，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：当所述服务调用信息获取指令中未携带服务选定信息时，将操作系统的各个服务的服务标识确定为所述目标服务的服务标识。
进一步的，在不提供命令行参数的情况下，默认枚举出所有系统服务。在提供命令行参数的情况下，可以针对性枚举系统服务，例如：可以通过命令行参数“-a qti.ims.ext”枚举qti.ims.ext这个系统服务，运行“run XX.ssfuzzer.getservicesinfo-a qti.ims.ext”就会将qti.ims.ext这个系统服务作为目标服务，进而枚举该系统服务的系统服务信息，并根据进一步的反射分析获取该系统服务的服务调用信息。其中，“-a”为触发枚举程序的代码符号，也可以通过其他的符号实现。
如图2所示，为一个实施例中服务调用信息的获取方法的流程图。以应用于终端上配置的插件(可以称为代理端)为例进行说明，包括以下步骤：
S201、与ServiceManager通信，反射获取ServiceManger对象，调用其中的listServices接口，获取所有系统服务名ServiceName。
S202、针对某一具体的ServiceName，通过反射判断ServiceName这个类是否存在名为<ServiceName>.Stub的内部类。如果存在，则说明这个系统服务为Java层系统服务，流程继续，执行S203。如果不存在，说明这个系统服务为Native系统服务，不再尝试枚举调用方法及其参数。
S203、反射获取<ServiceName>.Stub中以“TRANSACTION_”开头的成员变量值，该值就为这个系统服务接口的调用编号。
S204、反射获取<ServiceName>.Stub.Proxy下面的所有方法名称和调用参数，得到系统服务的接口调用方法及其调用参数。
S205、根据调用编号、接口调用方法及其调用参数输出服务调用信息。
上述实施例提供的服务调用信息的获取方法，根据Android Binder系统服务实现原理和特征，通过反射调用ServiceManager中的listService接口的方法，获取系统服务名称(ServiceName)；通过系统服务名称，反射判断是否存在与服务名称对应的Stub类，若存在则说明找到一个Java层系统服务；然后再次通过反射获取Stub类下以"TRANSACTION_"开头的所有整型成员变量的值，这些值就是系统服务的接口调用编号(TransactionCode)；最后再次通过反射获取Proxy类下的所有方法名和方法参数，这些方法名和方法参数就是接口调用方法(Method)及其参数(Arguments)。上述实施例在没有操作系统源码的情况下，不需要通过人工逆向分析的方法获取调用信息，能通过逐步反射分析自动快速获取服务的调用信息。
图3为一个实施例中服务的漏洞测试方法的应用环境示意图。如图3所示，该应用环境包括控制端301和代理端302，两者可以进行网络通信。控制端301向代理端301发送触发信息，以控制代理端302获取服务调用信息，之后控制端301调用服务接口，并根据服务接口返回的调用响应信息进行漏洞测试，得到漏洞测试结果。其中，控制端301和代理端302均可以通过终端设备或者服务器实现。进一步的，终端设备可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器可以用独立的服务器或者是多个服务器组成的服务器集群来实现。其中，代理端301可以为前述实施例中的终端，也可以是配置在前述实施例的终端中应用程序或者插件，以实现服务调用信息的获取方法。
在一个实施例中，如图4所示，提供了一种服务的漏洞测试方法，本实施例以该方法应用于图4中的控制端(可以是具体的终端设备，也可以是应用程序等)进行举例说明。如图4所示，一种服务的漏洞测试方法，包括操作S401至操作S404。
操作S401：获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到。
控制端可以向代理端发送服务调用信息获取指令，以触发代理端获取目标服务的服务调用信息，并将获取的服务调用信息返回给控制端。
其中，代理端获取目标服务的服务调用信息的实现方式可以参见前述服务调用信息的获取方法的实施例，在此不再赘述。
在某些实施例中，也可以从预构建的数据库中获取服务调用信息。该数据库中的服务调用信息可以是代理端生成服务调用信息后存储至数据库。
操作S402：根据所述服务调用信息向所述目标服务的服务接口发送调用指令。
服务调用信息中包含有调用服务接口的相关信息，因此，根据服务调用信息就可以向服务接口发送调用指令。该调用指令能够触发目标服务在通过服务接口接收到调用指令时，完成对应的执行程序，并生成第一调用响应信息。当然，目标服务在重启/某个进程被杀死等情况下，可能无法对调用指令进行响应，此时的调用响应信息就可以是：目标服务未响应、目标服务进程故障与服务运行状态相关的信息。
操作S403：接收所述服务接口根据所述调用指令返回的第一调用响应信息。
控制端接口目标服务通过服务接口返回的第一调用响应信息。该第一调用响应信息中可以包含目标服务对调用指令的响应信息、服务接口/目标服务的运行状态等。
操作S404：根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
由于第一调用响应信息中包含有目标服务/服务接口对调用指令的响应情况，因此可以进行漏洞测试分析，进而确定出目标服务是否存储漏洞，得到漏洞测试结果。
进一步的，也可以是根据第一调用响应信息对服务中的进程进行漏洞测试分析，以确定各个系统服务进程的漏洞测试结果。
在一个实施例中，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：获取系统运行状态信息；根据所述第一调用响应信息和所述系统运行状态信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
ServiceManager维护了一个在Android系统中所有系统服务的列表，普通App可以调用ServiceManager中的系统服务接口，以使用Android系统提供的系统服务，进而实现对系统服务的安全测试。从安全测试人员的角度，这些系统服务接口也是Android系统所暴露的攻击面，利用系统服务接口攻击面可以测试高权限的系统服务进程，观察高权限系统服务进程的响应情况，进而发现漏洞。在有系统服务接口实现源码的情况下，该工作较为容易，因为知道系统服务实现的方法名和方法参数，可以直接编写程序去调用系统服务接口；然而，在只有一个被测OEM(Original Equipment Manufactuce)手机、没有系统服务实现源码的情况下，困难重重。其中一种方法是手工逆向手机中的Android系统框架，使用手工寻找Android系统服务接口的方法，在Android 9.0的条件下，则需要将手机中的services.vdex文件提取到电脑端，然后将vdex文件转换为cdex文件，再将cdex文件转化为dex文件，然后使用JEB或者JD-GUI等逆向工具打开，对手机里面实现的services.odex等二进制文件逆行逆向分析，完全依赖于分析人员的经验，寻找系统服务实现代码的特征，然后凭借分析人员的经验，去寻找系统服务的实现。
上述服务的漏洞测试方法，在没有系统服务实现源代码的情况下，自动获取Android手机Java层系统服务的系统服务名、调用编号、接口调用方法及其参数，可以解放逆向分析人 员的手工工作，能有效提高漏洞测试的效率，为后续的模糊测试打下基础。同时，通过漏洞安全测试，能根据漏洞测试结果对操作系统进行调整，以保证操作系统的正常运行。
进一步的，调用系统服务接口后可以根据响应情况、系统表现来判断是否存在漏洞。例如，在调用系统服务接口的过程中，系统可能重启/某个进程可能被杀死，这些可以成为判断是否存在漏洞的特征，但如果还是没法确定存在漏洞，则可以结合其他漏洞测试数据来完成对目标服务的漏洞测试过程，在这种情况下，调用系统接口可以帮助发现漏洞。
在一个实施例中，所述服务调用信息包括服务名称、调用编号、方法名称和参数值；所述根据所述服务调用信息向所述目标服务的服务接口发送调用指令的步骤，包括：获取第一输入数据；根据所述服务名称、所述调用编号、所述方法名称、所述参数值生成接口调用函数；根据所述接口调用函数向所述服务接口发送携带所述第一输入数据的调用指令，以使所述服务接口根据所述第一输入数据生成并返回所述第一调用响应信息。
可以在调用服务接口的过程中向目标服务发送输入数据，以使目标服务对输入数据进行响应运算，运算得到的结果就可以作为第一调用响应信息。
生成接口调用函数的过程可以举例如下：假设调用方法名称为setHandoverConfig，其调用编号为14，调用参数包括三个：第一、二个参数为int类型，第三个参数为一个名为org.codeaurora.ims.internal.IQtiImsExtListener的interface。根据上述信息可以生成如下的接口调用函数：
setHandoverConfig(int,int,org.codeaurora.ims.internal.IQtiImsExtListener)
上述实施例结合服务调用信息生成接口调用函数，进而向服务接口发送调用指令，以根据服务接口返回的调用响应信息进行漏洞测试分析，其实现过程简单，且服务调用信息的获取不需要人工进行逆向分析，整个漏洞测试分析的过程具有较高的效率。
在一个实施例中，还可以把输入数据乱序处理，反复去调用系统服务接口，然后根据系统响应情况、系统表现来判断是否存在漏洞。具体的，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：获取第二输入数据；所述第二输入数据为对所述第一输入数据进行乱序处理得到的数据；根据所述接口调用函数向所述服务接口发送携带所述第二输入数据的调用指令，以使所述服务接口根据所述第二输入数据生成并返回第二调用响应信息；接收所述服务接口返回的第二调用响应信息；根据所述第一调用响应信息和所述第二调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
进一步的，可以对第一输入数据进行多次乱序处理，将这些乱序处理得到的输入数据输入到目标服务中，以获取目标服务对输入数据的响应情况，进而得到漏洞测试结果，这样得到的测试结果具有较高的准确性。
应该理解的是，虽然上述流程图中的各个操作按照箭头的指示依次显示，但是这些操作并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些操作的执行并没有严格的顺序限制，这些操作可以以其它的顺序执行。而且，上述流程图中的至少一部分操作可以包括多个子操作或者多个阶段，这些子操作或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子操作或者阶段的执行顺序也不必然是依次进行，而是可以与其它操作或者其它操作的子操作或者阶段的至少一部分轮流或者交替地执行。
图5为一个实施例中服务调用信息的获取装置500的结构框图。如图5所示，一种服务调用信息的获取装置，包括服务标识获取模块501、类反射模块502、类确定模块503、调用信息反射模块504和调用信息确定模块505。其中：
服务标识获取模块501，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识。
类反射模块502，用于将所述服务标识作为反射对象进行类反射分析。
类确定模块503，用于根据所述类反射分析的结果得到所述目标服务对应的第一目标类。
调用信息反射模块504，用于当所述第一目标类与参考类相匹配时，将所述第一目标类 作为反射对象进行调用信息反射分析。
调用信息确定模块505，用于根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
上述服务调用信息的获取装置，获取待调用的目标服务的服务标识；根据服务标识的类反射分析结果得到目标服务对应的第一目标类；当第一目标类与参考类相匹配时，根据第一目标类的调用信息反射分析结果得到与目标服务对应的服务调用信息，在没有操作系统源码的情况下，不需要通过人工逆向分析的方法获取调用信息，能通过逐步反射分析自动快速获取服务的调用信息。
在一个实施例中，所述装置，还包括：类标识确定模块，用于根据所述类反射分析的结果确定所述第一目标类对应的类标识；匹配判定模块，用于当所述类标识与预设的参考类标识相匹配时，判定所述第一目标类与所述参考类相匹配。
在一个实施例中，服务标识获取模块，包括：调用反射子模块，用于当接收到服务调用信息获取指令时，对服务管理器中的服务列举接口进行调用反射分析，以触发所述服务列举接口返回系统服务信息；所述系统服务信息为所述服务管理器所管理服务的信息；服务信息获取子模块，用于获取所述服务列举接口返回的所述系统服务信息；服务名称获取子模块，用于从所述系统服务信息中获取所述目标服务的服务名称，作为所述服务标识。
在一个实施例中，类标识确定模块，包括：第一类名获取子模块，用于根据所述类反射分析的结果获取所述第一目标类的类名；类标识获取子模块，用于根据所述第一目标类的类名确定所述类标识。
在一个实施例中，调用信息反射模块，包括：编号反射子模块，用于将所述第一目标类的类名作为反射对象进行调用编号反射分析，得到所述目标服务的调用编号；第二类名获取子模块，用于获取第二目标类的类名；所述第二目标类为所述第一目标类的内部类；参数反射子模块，用于当所述第二目标类的类名与预设的参考类名相匹配时，将所述第二目标类的类名作为反射对象进行调用参数反射分析，得到调用参数；反射结果确定子模块，用于根据所述调用编号和所述调用参数得到所述调用信息反射分析的结果。
在一个实施例中，参数反射子模块，包括：第一反射单元，用于将所述第二目标类的类名作为反射对象分别进行方法名称反射分析和参数值反射分析，得到所述目标服务的方法名称和参数值；调用参数获取单元，用于根据所述方法名称和所述参数值，得到所述调用参数。
在一个实施例中，编号反射子模块，包括：第二反射单元，用于将所述第一目标类的类名作为反射对象进行调用编号反射分析；调用编号获取单元，用于从调用编号反射分析的结果中确定与参考编号标识对应的成员变量值，作为所述目标服务的调用编号。
在一个实施例中，服务标识获取模块，包括：服务确定子模块，用于当所述服务调用信息获取指令中携带有服务选定信息时，从操作系统的服务中确定与所述服务选定信息对应的参考服务；服务标识确定子模块，用于将所述参考服务的服务标识确定为所述目标服务的服务标识。
在一个实施例中，服务标识获取模块，还用于当所述服务调用信息获取指令中未携带服务选定信息时，将操作系统的各个服务的服务标识确定为所述目标服务的服务标识。
图6为一个实施例中服务的漏洞测试装置600的结构框图。如图6所示，一种服务的漏洞测试装置，包括调用信息获取模块601、调用指令发送模块602、响应信息接收模块603和测试结果确定模块604。其中：
调用信息获取模块601，用于获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到。
调用指令发送模块602，用于根据所述服务调用信息向所述目标服务的服务接口发送调用指令。
响应信息接收模块603，用于接收所述服务接口根据所述调用指令返回的第一调用响应信息。
测试结果确定模块604，用于根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
上述服务的漏洞测试装置，获取通过逐步反射分析自动获取到的服务调用信息，根据该服务调用信息调用目标服务的服务接口，并根据服务接口返回的响应信息得到目标服务的漏洞测试结果，不需要人工进行调用信息的逆向分析，能有效提高漏洞测试的效率。
在一个实施例中，所述服务调用信息包括服务名称、调用编号、方法名称和参数值；所述根据所述服务调用信息向所述目标服务的服务接口发送调用指令的步骤，包括：获取第一输入数据；根据所述服务名称、所述调用编号、所述方法名称、所述参数值生成接口调用函数；根据所述接口调用函数向所述服务接口发送携带所述第一输入数据的调用指令，以使所述服务接口根据所述第一输入数据生成并返回所述第一调用响应信息。
在一个实施例中，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：获取第二输入数据；所述第二输入数据为对所述第一输入数据进行乱序处理得到的数据；根据所述接口调用函数向所述服务接口发送携带所述第二输入数据的调用指令，以使所述服务接口根据所述第二输入数据生成并返回第二调用响应信息；接收所述服务接口返回的第二调用响应信息；根据所述第一调用响应信息和所述第二调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
在一个实施例中，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：获取系统运行状态信息；根据所述第一调用响应信息和所述系统运行状态信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
上述服务调用信息的获取装置中各个模块的划分仅用于举例说明，在其他实施例中，可将服务调用信息的获取装置按照需要划分为不同的模块，以完成上述服务调用信息的获取装置的全部或部分功能。服务的漏洞测试装置同理，在此不再赘述。
在一个实施例中，提供一种服务的漏洞测试系统，该系统的结构图可以参数图3。该系统包括网络连接的控制端和代理端。其中：
所述控制端，用于向所述代理端发送服务调用信息获取指令。
所述代理端，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；将所述服务标识作为反射对象进行类反射分析；根据所述类反射分析的结果得到所述目标服务对应的第一目标类；当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
所述控制端，还用于接收所述代理端返回的所述服务调用信息；根据所述服务调用信息向所述目标服务的服务接口发送调用指令；接收所述服务接口根据所述调用指令返回的第一调用响应信息；根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
上述服务的漏洞测试系统，代理端在控制端的触发下通过逐步反射分析自动获取到的服务调用信息，控制端根据该服务调用信息调用目标服务的服务接口，并根据服务接口返回的响应信息得到目标服务的漏洞测试结果，不需要人工进行调用信息的逆向分析，能有效提高漏洞测试的效率。
在一个实施例中，服务的漏洞测试系统的框架可以是基于Drozer的测试框架，通过控制端和代理端这两个测试插件实现。这两个测试插件可以分别配置在不同的终端设备中。
在一个实施例中，所述代理端配置于终端设备中，所述终端设备运行有服务管理器；所述代理端，还用于当接收到所述服务调用信息获取指令时，通过跨进程通信工具与服务管理器通信，以获取所述目标服务的所述服务标识。
其中，跨进程通信工具可以指能够实现IPC(Inter-Process Communication，进程间通信) 的工具。进一步的，跨进程通信工具可以指Binder等。更进一步的，可以是代理端所在的客户端进程(Client)通过Binder与提供服务的服务端进程(Server)进行通信。
进一步的，服务的漏洞测试系统可以通过图7中的控制端(Console)701和代理端(Agent)702实现。其中Console配置在PC侧，Agent配置在手机侧，Console和Agent可以通过adb协议进行通信。Agent与Service Manager(服务管理器)通过IPC的方式进行通信。IPC这个方式是从用户模式703(普通App一般运行在用户模式)进行描述的。许多不可见的重要代码运行在内核模式(如图7中的704)，实现内存管理、文件管理、进程管理等重要功能。用户模式运行在内核模式之上，图7主要体现了用户模式agent与ServiceManger之间的IPC通信，实际上是通过内核模式的Binder驱动进行的。
进一步的，在PC侧，Console可通过命令行提供给用户获取枚举系统服务接口的功能，即用户通过在PC侧输入命令行的方式就可以得到系统服务的枚举信息，进而就能知晓其服务调用信息。
对PC侧而言，Agent可以相当于是一个普通的Android App，它通过基于Binder的IPC与ServiceManager进程进行通信，通过ServiceManager提供的listServices接口，获取所有系统服务接口名称，然后通过反射调用获取某一具体系统服务的接口调用方法编号(TransactionCode)和接口调用方法名(Method)及其参数(Arguments)。
关于服务的漏洞测试装置、系统中获取服务调用信息的具体限定可以参见上文中对于服务调用信息的获取方法的限定，在此不再赘述。上述服务的漏洞测试装置、系统中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
本申请实施例中提供的服务调用信息的获取装置、服务的漏洞测试装置中的各个模块的实现可为计算机程序的形式。该计算机程序可在移动终端或服务器上运行。该计算机程序构成的程序模块可存储在移动终端或服务器的存储器上。该计算机程序被处理器执行时，实现本申请实施例中所描述方法的操作。
本申请实施例还提供一种移动终端。该移动终端包括存储器及处理器，该存储器中储存有计算机程序，该计算机程序被该处理器执行时，使得该处理器执行该服务调用信息的获取方法的操作。
本申请实施例还提供一种计算机可读存储介质。一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现该服务调用信息的获取方法的操作。
本申请实施例还提供一种移动终端。该移动终端包括存储器及处理器，该存储器中储存有计算机程序，该计算机程序被该处理器执行时，使得该处理器执行该服务的漏洞测试方法的操作。
本申请实施例还提供一种计算机可读存储介质。一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现该服务的漏洞测试方法的操作。
图8为一个实施例中移动终端的内部结构示意图。如图8所示，该移动终端包括通过系统总线连接的处理器、存储器和网络接口。其中，该处理器用于提供计算和控制能力，支撑整个移动终端的运行。存储器用于存储数据、程序等，存储器上存储至少一个计算机程序，该计算机程序可被处理器执行，以实现本申请实施例中提供的适用于移动终端的无线网络通信方法。存储器可包括非易失性存储介质及内存储器。非易失性存储介质存储有操作系统和计算机程序。该计算机程序可被处理器所执行，以用于实现以下各个实施例所提供的一种服务调用信息的获取方法。内存储器为非易失性存储介质中的操作系统计算机程序提供高速缓存的运行环境。网络接口可以是以太网卡或无线网卡等，用于与外部的移动终端进行通信。该移动终端可以是手机、平板电脑或者个人数字助理或穿戴式设备等。
图9为另一个实施例中移动终端的内部结构示意图。如图9所示，该移动终端包括通过系统总线连接的处理器、存储器、通信接口、显示屏和输入装置。其中，该移动终端的处理 器用于提供计算和控制能力。该移动终端的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统和计算机程序。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该移动终端的通信接口用于与外部的终端进行有线或无线方式的通信，无线方式可通过WIFI、运营商网络、NFC(近场通信)或其他技术实现。该计算机程序被处理器执行时以实现一种服务的漏洞测试方法。该移动终端的显示屏可以是液晶显示屏或者电子墨水显示屏，该移动终端的输入装置可以是显示屏上覆盖的触摸层，也可以是移动终端外壳上设置的按键、轨迹球或触控板，还可以是外接的键盘、触控板或鼠标等。
一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行服务调用信息的获取方法。
一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行服务的漏洞测试方法。
本申请所使用的对存储器、存储、数据库或其它介质的任何引用可包括非易失性和/或易失性存储器。合适的非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)，它用作外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDR SDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对本申请专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (21)

  1. 一种服务调用信息的获取方法，其特征在于，包括：
    当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；
    将所述服务标识作为反射对象进行类反射分析；
    根据所述类反射分析的结果得到所述目标服务对应的第一目标类；
    当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；
    根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
  2. 根据权利要求1所述的方法，其特征在于，在所述将所述服务标识作为反射对象进行类反射分析的步骤之后，还包括：
    根据所述类反射分析的结果确定所述第一目标类对应的类标识；
    当所述类标识与预设的参考类标识相匹配时，判定所述第一目标类与所述参考类相匹配。
  3. 根据权利要求2所述的方法，其特征在于，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：
    当接收到服务调用信息获取指令时，对服务管理器中的服务列举接口进行调用反射分析，以触发所述服务列举接口返回系统服务信息；所述系统服务信息为所述服务管理器所管理服务的信息；
    获取所述服务列举接口返回的所述系统服务信息；
    从所述系统服务信息中获取所述目标服务的服务名称，作为所述服务标识。
  4. 根据权利要求2所述的方法，其特征在于，所述根据所述类反射分析的结果确定所述第一目标类对应的类标识的步骤，包括：
    根据所述类反射分析的结果获取所述第一目标类的类名；
    根据所述第一目标类的类名确定所述类标识。
  5. 根据权利要求4所述的方法，其特征在于，所述将所述第一目标类作为反射对象进行调用信息反射分析的步骤，包括：
    将所述第一目标类的类名作为反射对象进行调用编号反射分析，得到所述目标服务的调用编号；
    获取第二目标类的类名；所述第二目标类为所述第一目标类的内部类；
    当所述第二目标类的类名与预设的参考类名相匹配时，将所述第二目标类的类名作为反射对象进行调用参数反射分析，得到调用参数；
    根据所述调用编号和所述调用参数得到所述调用信息反射分析的结果。
  6. 根据权利要求5所述的方法，其特征在于，所述将所述第二目标类的类名作为反射对象进行调用参数反射分析，得到调用参数的步骤，包括：
    将所述第二目标类的类名作为反射对象分别进行方法名称反射分析和参数值反射分析，得到所述目标服务的方法名称和参数值；
    根据所述方法名称和所述参数值，得到所述调用参数。
  7. 根据权利要求5所述的方法，其特征在于，所述将所述第一目标类的类名作为反射对象进行调用编号反射分析，得到所述目标服务的调用编号的步骤，包括：
    将所述第一目标类的类名作为反射对象进行调用编号反射分析；
    从调用编号反射分析的结果中确定与参考编号标识对应的成员变量值，作为所述目标服务的调用编号。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：
    当所述服务调用信息获取指令中携带有服务选定信息时，从操作系统的服务中确定与所述服务选定信息对应的参考服务；
    将所述参考服务的服务标识确定为所述目标服务的服务标识。
  9. 根据权利要求1至7任一项所述的方法，其特征在于，所述当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识的步骤，包括：
    当所述服务调用信息获取指令中未携带服务选定信息时，将操作系统的各个服务的服务标识确定为所述目标服务的服务标识。
  10. 一种服务的漏洞测试方法，其特征在于，包括：
    获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到；
    根据所述服务调用信息向所述目标服务的服务接口发送调用指令；
    接收所述服务接口根据所述调用指令返回的第一调用响应信息；
    根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
  11. 根据权利要求10所述的方法，其特征在于，所述服务调用信息包括服务名称、调用编号、方法名称和参数值；
    所述根据所述服务调用信息向所述目标服务的服务接口发送调用指令的步骤，包括：
    获取第一输入数据；
    根据所述服务名称、所述调用编号、所述方法名称、所述参数值生成接口调用函数；
    根据所述接口调用函数向所述服务接口发送携带所述第一输入数据的调用指令，以使所述服务接口根据所述第一输入数据生成并返回所述第一调用响应信息。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：
    获取第二输入数据；所述第二输入数据为对所述第一输入数据进行乱序处理得到的数据；
    根据所述接口调用函数向所述服务接口发送携带所述第二输入数据的调用指令，以使所述服务接口根据所述第二输入数据生成并返回第二调用响应信息；
    接收所述服务接口返回的第二调用响应信息；
    根据所述第一调用响应信息和所述第二调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
  13. 根据权利要求10至12任一项所述的方法，其特征在于，所述根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果的步骤，包括：
    获取系统运行状态信息；
    根据所述第一调用响应信息和所述系统运行状态信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
  14. 一种服务调用信息的获取装置，其特征在于，包括：
    服务标识获取模块，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；
    类反射模块，用于将所述服务标识作为反射对象进行类反射分析；
    类确定模块，用于根据所述类反射分析的结果得到所述目标服务对应的第一目标类；
    调用信息反射模块，用于当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；
    调用信息确定模块，用于根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息。
  15. 一种服务的漏洞测试装置，其特征在于，包括：
    调用信息获取模块，用于获取待调用的目标服务的服务调用信息；所述服务调用信息根据调用信息反射分析的结果确定；所述调用信息反射分析为当第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行的反射分析；所述第一目标类为将所述目标服务的服务标识作为反射对象进行类反射分析得到；
    调用指令发送模块，用于根据所述服务调用信息向所述目标服务的服务接口发送调用指令；
    响应信息接收模块，用于接收所述服务接口根据所述调用指令返回的第一调用响应信息；
    测试结果确定模块，用于根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
  16. 一种服务的漏洞测试系统，其特征在于，包括：网络连接的控制端和代理端；
    所述控制端，用于向所述代理端发送服务调用信息获取指令；
    所述代理端，用于当接收到服务调用信息获取指令时，获取待调用的目标服务的服务标识；将所述服务标识作为反射对象进行类反射分析；根据所述类反射分析的结果得到所述目标服务对应的第一目标类；当所述第一目标类与参考类相匹配时，将所述第一目标类作为反射对象进行调用信息反射分析；根据所述调用信息反射分析的结果得到与所述目标服务对应的服务调用信息；
    所述控制端，还用于接收所述代理端返回的所述服务调用信息；根据所述服务调用信息向所述目标服务的服务接口发送调用指令；接收所述服务接口根据所述调用指令返回的第一调用响应信息；根据所述第一调用响应信息进行漏洞测试分析，得到所述目标服务的漏洞测试结果。
  17. 根据权利要求16所述的系统，其特征在于，所述代理端配置于终端设备中，所述终端设备运行有服务管理器；
    所述代理端，还用于当接收到所述服务调用信息获取指令时，通过跨进程通信工具与服务管理器通信，以获取所述目标服务的所述服务标识。
  18. 一种移动终端，包括存储器及处理器，所述存储器中储存有计算机程序，其特征在于，所述计算机程序被所述处理器执行时，使得所述处理器执行如权利要求1至9中任一项所述的方法的步骤。
  19. 一种移动终端，包括存储器及处理器，所述存储器中储存有计算机程序，其特征在于，所述计算机程序被所述处理器执行时，使得所述处理器执行如权利要求10至13中任一项所述的方法的步骤。
  20. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至9中任一项所述的方法的步骤。
  21. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求10至13中任一项所述的方法的步骤。
PCT/CN2020/095111 2020-06-09 2020-06-09 服务调用信息的获取方法、装置和服务的漏洞测试方法 WO2021248310A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080098251.1A CN115244516A (zh) 2020-06-09 2020-06-09 服务调用信息的获取方法、装置和服务的漏洞测试方法
PCT/CN2020/095111 WO2021248310A1 (zh) 2020-06-09 2020-06-09 服务调用信息的获取方法、装置和服务的漏洞测试方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/095111 WO2021248310A1 (zh) 2020-06-09 2020-06-09 服务调用信息的获取方法、装置和服务的漏洞测试方法

Publications (1)

Publication Number Publication Date
WO2021248310A1 true WO2021248310A1 (zh) 2021-12-16

Family

ID=78846616

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/095111 WO2021248310A1 (zh) 2020-06-09 2020-06-09 服务调用信息的获取方法、装置和服务的漏洞测试方法

Country Status (2)

Country Link
CN (1) CN115244516A (zh)
WO (1) WO2021248310A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117033171A (zh) * 2023-06-28 2023-11-10 清华大学 触发软件漏洞的输入数据的复现方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108268371A (zh) * 2016-12-30 2018-07-10 南京理工大学 面向Android应用的智能模糊测试方法
CN108920218A (zh) * 2018-05-23 2018-11-30 北京五八信息技术有限公司 一种反射调用方法、装置、终端及计算机可读存储介质
US20190146900A1 (en) * 2017-11-15 2019-05-16 Lenovo (Singapore) Pte. Ltd. Method and system for context based testing of software application vulnerabilities
CN109901937A (zh) * 2019-01-18 2019-06-18 平安普惠企业管理有限公司 隐藏api的反射调用方法、装置、计算机设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108268371A (zh) * 2016-12-30 2018-07-10 南京理工大学 面向Android应用的智能模糊测试方法
US20190146900A1 (en) * 2017-11-15 2019-05-16 Lenovo (Singapore) Pte. Ltd. Method and system for context based testing of software application vulnerabilities
CN108920218A (zh) * 2018-05-23 2018-11-30 北京五八信息技术有限公司 一种反射调用方法、装置、终端及计算机可读存储介质
CN109901937A (zh) * 2019-01-18 2019-06-18 平安普惠企业管理有限公司 隐藏api的反射调用方法、装置、计算机设备及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZOU ZHEN , ZHOU AN-MIN: "Research on Mining Vulnerability in Android System Services", MODERN COMPUTER, 5 May 2019 (2019-05-05), pages 90 - 95, XP055878839, ISSN: 1007-1423, DOI: 10.3969/j.issn.1007-1423.2019.13.019 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117033171A (zh) * 2023-06-28 2023-11-10 清华大学 触发软件漏洞的输入数据的复现方法、装置、设备及介质
CN117033171B (zh) * 2023-06-28 2024-03-26 清华大学 触发软件漏洞的输入数据的复现方法、装置、设备及介质

Also Published As

Publication number Publication date
CN115244516A (zh) 2022-10-25

Similar Documents

Publication Publication Date Title
CN109460527B (zh) 产品数据配置方法、装置、计算机设备和存储介质
WO2016192556A1 (zh) 接口调用方法、装置及终端
CN109635019B (zh) 请求处理方法、装置、设备及存储介质
CN107360261B (zh) 一种http请求处理方法、装置及电子设备
CN109308263B (zh) 一种小程序测试方法、装置及设备
CN111209122B (zh) 接口调用方法、装置、电子设备及存储介质
CN112019609B (zh) 基于物联网的设备监控方法、装置、设备及计算机介质
US20120210306A1 (en) System and Method for Application Testing
CN111638983A (zh) 接口调用方法、接口调用装置及终端设备
CN112148699A (zh) 日志管理方法、装置、设备及介质
WO2021248310A1 (zh) 服务调用信息的获取方法、装置和服务的漏洞测试方法
CN112181423A (zh) 基于配置文件的项目构建方法、装置、计算机设备及介质
CN113608742A (zh) 检测方法、代码包处理方法、运行控制方法及计算设备
WO2023208012A1 (zh) 程序处理、运行方法、装置、终端、智能卡及存储介质
CN110442636B (zh) 一种数据的读写方法、装置及数据读写设备
CN110516172B (zh) 资源调用方法、装置、计算机设备和存储介质
CN112732513A (zh) 内存监控方法、装置、计算机可读存储介质和计算机设备
CN111124627A (zh) 应用程序的调起者确定方法、装置、终端及存储介质
CN112988132B (zh) 数据接口的自动生成方法、装置、计算机设备及存储介质
CN111177624B (zh) 网站前后端通讯方法、装置、计算机设备和存储介质
CN114077458A (zh) 应用程序内业务模块启动方法、装置、设备和存储介质
WO2020192134A1 (zh) 基于Spring MVC的异常处理方法、装置、计算机设备和存储介质
CN113221098A (zh) 针对接口调用请求的处理方法及装置
CN111045724A (zh) 调用链信息的查询方法、装置和可读存储介质
CN107122164B (zh) 函数地址获取及应用其的方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20939708

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 19/05/2023)