Disclosure of Invention
The invention provides a method and a system for automatically obtaining evidence at a client, which solve the technical problems.
The technical scheme for solving the technical problems is as follows: a client side automatic forensics method comprises the following steps:
step 1, in the process of evidence obtaining of a client, when an operation prompt box pops up, a simulated click position is obtained;
and 2, clicking at the simulated click position by adopting a preset simulated click method so as to continue the evidence obtaining process of the client.
The invention has the beneficial effects that: the invention provides an automatic evidence obtaining method for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking, effectively remove or reduce the times and complexity of manual participation and greatly improve the evidence obtaining efficiency.
On the basis of the technical scheme, the invention can be further improved as follows.
Further, before step 1, a classification step is further included, specifically:
s1, acquiring all scenes needing simulated click in the client evidence obtaining process;
s2, testing clients of different models, judging whether the simulated click positions of the scenes remain unchanged in the clients of all models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and S3, establishing a corresponding relation table of all the first-class scenes and the corresponding simulated click positions.
The beneficial effect of adopting the further scheme is that: in a further technical scheme of the invention, the scenes needing to be clicked in the evidence obtaining process are classified, for example, in the scenes of application installation, short message reading, call record reading and the like, the simulated click position is changed, so that the simulated click position needs to be respectively obtained for a specific client. In some scenarios, for example, when backup is applied, the simulated click position is fixed and is all at the lower right corner of the screen, so that the simulated click position can be acquired in a simpler manner without repeatedly acquiring the simulated click position each time, and the evidence obtaining efficiency of the client is further improved.
Further, when the simulated click position is arranged at the lower right corner of the screen of the client, the coordinates of the simulated click position are (X-a, Y-b), wherein X is the screen length of the client, Y is the screen width of the client, the value range of a is 20-60 px, and the value range of b is 20-60 px.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, when the simulated click position is arranged at the lower right corner of the screen of the client, the screen resolution of the client is firstly obtained, namely the screen length and the screen width of the client are obtained, and the preset values are respectively subtracted from the screen length and the screen width, so that the accuracy of simulated click is ensured.
Further, the step 1 specifically comprises:
s101, in the process of evidence obtaining of a client, when an operation prompt box pops up, capturing a current screen image containing the operation prompt box;
s102, judging whether the current scene is a first type scene or not according to the current screen image, if so, executing S103, and if not, executing S104;
s103, inquiring the corresponding relation table to obtain a simulated click position corresponding to the current scene;
and S104, identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, the click simulation scene is simulated as required, and the corresponding method is selected to obtain the click simulation position, so that the client evidence obtaining efficiency is further improved, and the client evidence obtaining time is reduced.
Further, the step S104 specifically includes: recognizing the character of the current screen image by adopting a character recognition method, and setting the position of the preset character on the current screen image as a simulated click position when the recognized character comprises the preset character; and if the recognized character does not comprise the preset character, generating and displaying alarm information.
Further, the step S104 specifically includes:
establishing a picture comprising the preset characters, and establishing a picture library;
and respectively matching the pictures in the picture library with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, and if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, the simulated click position can be obtained by adopting a character recognition method or an image matching method, and the method is various and flexible.
In order to solve the technical problem of the invention, the invention also provides a client automatic evidence obtaining system, which comprises a position obtaining module and a clicking module,
the position acquisition module is used for acquiring a simulated click position when an operation prompt box pops up in the process of obtaining evidence by the client;
and the clicking module is used for clicking at the simulated clicking position by adopting a preset simulated clicking method so as to enable the evidence obtaining process of the client to be continued.
The invention has the beneficial effects that: the invention provides an automatic evidence obtaining system for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking, effectively remove or reduce the times and complexity of manual participation and greatly improve the evidence obtaining efficiency.
Further, still include the classification module, the classification module includes:
the scene acquisition unit is used for acquiring all scenes needing simulated clicking in the evidence obtaining process of the client;
the testing unit is used for testing the clients of different models, judging whether the simulated click positions of the scenes remain unchanged in all the clients of all the models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and the table building unit is used for building a corresponding relation table of all the first-class scenes and the corresponding simulated click positions.
Further, the position acquisition module includes:
the screen capture unit is used for capturing a current screen image containing an operation prompt box when the operation prompt box pops up in the process of obtaining evidence by the client;
the judging unit is used for judging whether the current scene is a first type scene or not according to the current screen image, if so, the inquiring unit is driven, and if not, the identifying unit is driven;
the query unit is used for querying the corresponding relation table and acquiring the simulated click position corresponding to the current scene;
and the identification unit is used for identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
Further, the recognition unit comprises a character recognition unit and/or an image recognition unit,
the character recognition unit is used for recognizing the character characters of the current screen image by adopting a character recognition method, and when the recognized character characters comprise the preset characters, setting the position of the preset characters on the current screen image as a simulated click position; if the recognized character does not comprise the preset character, generating and displaying alarm information;
the image recognition unit is used for respectively matching pictures in a picture library established in advance with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions; the pictures in the picture library comprise the preset characters.
Detailed Description
The principles and features of this invention are described below in conjunction with the following drawings, which are set forth by way of illustration only and are not intended to limit the scope of the invention.
Fig. 1 is a schematic flowchart of a method for automatically obtaining evidence at a client according to an embodiment of the present invention, as shown in fig. 1, including the following steps:
step 1, in the process of evidence obtaining of a client, when an operation prompt box pops up, a simulated click position is obtained;
and 2, clicking at the simulated click position by adopting a preset simulated click method so as to continue the evidence obtaining process of the client. The embodiment provides an automatic evidence obtaining method for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking when evidence is obtained for the client, such as a mobile phone, so that the times and complexity of manual participation are effectively removed or reduced, and the evidence obtaining efficiency is greatly improved.
In a preferred embodiment, before the step 1, a classification step is further included, specifically:
s1, acquiring all scenes needing simulated click in the client evidence obtaining process;
s2, testing clients of different models, judging whether the simulated click positions of the scenes remain unchanged in the clients of all models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and S3, establishing a corresponding relation table of all the first-class scenes and the corresponding simulated click positions. In this specific embodiment, after classifying the scenes, the step 1 of obtaining the simulated click position includes the following steps:
s101, in the process of evidence obtaining of a client, when an operation prompt box pops up, capturing a current screen image containing the operation prompt box;
s102, judging whether the current scene is a first type scene or not according to the current screen image, if so, executing S103, and if not, executing S104;
s103, inquiring the corresponding relation table to obtain a simulated click position corresponding to the current scene;
and S104, identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
In the embodiment, the corresponding method can be selected to obtain the simulated click position according to the scene of simulated click as required, so that the client-side evidence obtaining efficiency is further improved, and the client-side evidence obtaining time is reduced. Specifically, the scenes that need to be clicked in the forensics process are classified, for example, in the scenes of application installation, short message reading, call record reading, and the like, the simulated click position changes, so that the simulated click position needs to be acquired for a specific client, and the following description is given by using a specific embodiment. In some scenarios, for example, when backup is applied, the simulated click position is fixed and is all at the lower right corner of the screen, so that the simulated click position can be acquired in a simpler manner without repeatedly acquiring the simulated click position each time, and the evidence obtaining efficiency of the client is further improved. For example, in a certain embodiment, it is found through testing that interfaces for popping up backups of substantially all devices are consistent, and in this case, the backup button is fixed at the lower right corner of the screen, so that information such as resolution of the screen can be remotely acquired through an adb dumpsys instruction, in order to ensure the accuracy of clicking, 50px is subtracted from the length and width of the screen, and then the obtained length and width value is the coordinate position of the simulated clicking.
Preferably, when the simulated click position is not fixed, the simulated click position is obtained by a character recognition method, which specifically comprises the following steps: recognizing the character of the current screen image by adopting a character recognition method, and setting the position of the preset character on the current screen image as a simulated click position when the recognized character comprises the preset character; and if the recognized character does not comprise the preset character, generating and displaying alarm information. Specifically, when a dialog box pops up, a screen under the system is called by adb, the current screen image is intercepted, and then the current screen image is saved to a position such as sdcard, and then the current screen image is acquired to the local through adb pull. After the screen image is successfully acquired, preset characters, such as the position of an 'allow' button, are acquired through an OCR character recognition method. An OCR character recognition method comprises a free tesseract version with a google open source and a commercial platform, wherein a character library is established, comprises all Chinese characters or Chinese characters, and may further comprise an English character library in order to adapt to a part of English system. The characters in the word stock are compared with the characters on the pictures, so that the character content of the corresponding position can be obtained, and when the 'allowed' characters are detected, the position of the picture where the current characters are located is obtained. The resolution of the picture is consistent with that of the mobile phone screen, and when the pixel point coordinates of the picture where the permission exists are obtained, the pixel point coordinates are the simulated click position of the current screen.
Preferably, in another embodiment, when the simulated click position is not fixed, the simulated click position is obtained by using an image recognition method, specifically: establishing a picture comprising the preset characters, and establishing a picture library; and respectively matching the pictures in the picture library with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, and if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions. Specifically, the image recognition method is to create a picture library locally, and compare pictures in the picture library with captured screen images to determine whether a pop-up dialog box includes preset characters, such as prompt information such as "allow" and the like. If the confirmation is available, the position of the screen image where the 'allow' button is located can be obtained by calculating the matching position. In this embodiment, various algorithms, such as a SIFT algorithm, a deep learning algorithm, and the like, may be employed. After the simulated click position is obtained, the finger click operation can be realized at the simulated click position through a preset instruction, so that the function of simulating click is realized.
The above describes in detail the client automatic forensics method according to the embodiment of the present invention with reference to fig. 1, and the following describes the client automatic forensics system according to the embodiment of the present invention. Fig. 2 is a schematic structural block diagram of an automatic client forensics system according to an embodiment of the present invention, as shown in fig. 2, including a location obtaining module and a click module,
the position acquisition module is used for acquiring a simulated click position when an operation prompt box pops up in the process of obtaining evidence by the client;
and the clicking module is used for clicking at the simulated clicking position by adopting a preset simulated clicking method so as to enable the evidence obtaining process of the client to be continued. The embodiment provides an automatic evidence obtaining system for a client, when obtaining evidence for the client, such as a mobile phone, the system can realize automatic click at a simulated click position when user intervention or click is needed, effectively remove or reduce the number of times and complexity of manual participation, and greatly improve the evidence obtaining efficiency.
In a preferred embodiment, the client-side automatic forensics system further includes a classification module, as shown in fig. 3, the classification module includes:
the scene acquisition unit is used for acquiring all scenes needing simulated clicking in the evidence obtaining process of the client;
the testing unit is used for testing the clients of different models, judging whether the simulated click positions of the scenes remain unchanged in all the clients of all the models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and the table building unit is used for building a corresponding relation table of all the first-class scenes and the corresponding simulated click positions. In this embodiment, the position obtaining module of the client automatic forensics system includes:
the screen capture unit is used for capturing a current screen image containing an operation prompt box when the operation prompt box pops up in the process of obtaining evidence by the client;
the judging unit is used for judging whether the current scene is a first type scene or not according to the current screen image, if so, the inquiring unit is driven, and if not, the identifying unit is driven;
the query unit is used for querying the corresponding relation table and acquiring the simulated click position corresponding to the current scene;
and the identification unit is used for identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position. In the preferred embodiment, the corresponding method can be selected to obtain the simulated click position according to the scene of simulated click as required, so that the client-side evidence obtaining efficiency is further improved, and the client-side evidence obtaining time is reduced.
In a preferred embodiment, the recognition unit includes a character recognition unit and an image recognition unit, as shown in fig. 3, and in other embodiments, any one of the character recognition unit and the image recognition unit may be adopted. In this preferred embodiment, the text recognition unit is configured to recognize text characters of a current screen image by using a text recognition method, and when the recognized text characters include the preset characters, set the position of the preset characters on the current screen image as a simulated click position; if the recognized character does not comprise the preset character, generating and displaying alarm information; the image recognition unit is used for respectively matching pictures in a picture library established in advance with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions; the pictures in the picture library comprise the preset characters. In this embodiment, both the character recognition method and the image matching method are relatively mature technologies, so that the simulated click position can be quickly and accurately acquired, and the automatic evidence obtaining process of the client is completed.
In the description of the present invention, it is to be understood that the terms "first", "second" and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implying any number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.