CN106997313B - Signal processing method and system of application program and terminal equipment - Google Patents
Signal processing method and system of application program and terminal equipmentDownload PDFInfo
- Publication number
- CN106997313B CN106997313BCN201710193570.0ACN201710193570ACN106997313BCN 106997313 BCN106997313 BCN 106997313BCN 201710193570 ACN201710193570 ACN 201710193570ACN 106997313 BCN106997313 BCN 106997313B
- Authority
- CN
- China
- Prior art keywords
- application module
- module
- information
- hook function
- application
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/54—Interprogram communication
- G06F9/542—Event management; Broadcasting; Multicasting; Notifications
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Multimedia (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
Description
Technical Field
The present invention relates to the field of information processing technologies, and in particular, to a method, a system, and a terminal device for processing a signal of an application.
Background
Some application modules (i.e. application programs) of the terminal devices may call some functions of system modules of the terminal devices to implement some special functions, which are hook functions, during the running process of the application modules (i.e. application programs), and meanwhile, the related performance of the application modules may be monitored through the process of calling the hook functions by the application modules. For example, an input/output (IO) function of a system module of the terminal device may be called by the application module, so as to monitor an IO performance of the application module. In order to call the hook function by the application module, the address information of the hook function is generally added to a Global Offset Table (GOT) of the application module, and the like.
The conventional method for modifying the GOT table can avoid the correlation with a hardware platform of the terminal device and has certain stability, but the method has limited application scenes and is not suitable for the calling of some hook functions, for example, a connection (connect) function is called by an application module, only a request of the application module for accessing the network through a Java layer can be monitored, but a request of the application module for accessing the network through a socket (socket) called by a Java Native Interface (JNI) mode cannot be monitored. In this case, it is necessary to implement the operation in the InlineHook manner, and specifically, the application module needs to modify the command header of the hook function to jump to the hook function, and it is difficult to achieve high stability in the InlineHook manner due to the complexity and the different hardware processing manners of the terminal devices of various manufacturers. Therefore, how to be compatible with various terminal devices and ensure the stability of the process that the terminal devices call hook functions in an InlineHook mode becomes a more important problem.
Disclosure of Invention
The embodiment of the invention provides a signal processing method, a signal processing system and terminal equipment of an application program, which realize that when an application module calls a hook function to be abnormal, a signal processing module sends related information of the abnormality of the application module to a data analysis system for analysis.
A first aspect of an embodiment of the present invention provides a signal processing method for an application, where the method is applied to a terminal device including an application module, a signal processing module, and a system module, and the method includes:
when the hook function of the system module is called to be abnormal by the application module, a first signal is sent to the system module;
if the first signal belongs to a preset signal set, the system module informs the signal processing module to acquire the related information of the abnormity of the application module;
and the signal processing module sends the relevant information to a data analysis system so that the data analysis system determines a blacklist according to the relevant information, wherein the blacklist comprises information that an application module in the terminal equipment does not call a hook function.
A second aspect of the embodiments of the present invention provides a signal processing method for an application program, including:
receiving related information sent by a plurality of terminal devices when hook functions of application modules calling system modules are abnormal, wherein the related information comprises: the name and version information of an application module included in the corresponding terminal equipment, the model of the terminal equipment and the name of a hook function;
counting the receiving times of the matched multiple groups of related information;
and if the receiving times are larger than a preset value, storing the name and version information of the application module, the model of the terminal equipment and the name of the hook function in the plurality of groups of related information as an information group of a blacklist.
A third aspect of the embodiments of the present invention provides a terminal device, including: a system module, at least one application module, and a signal processing module, wherein the application module comprises a hook unit and a signal emitting unit, wherein:
the hook unit is used for calling a hook function of the system module;
the signal sending unit is used for sending a first signal to the system module when the hook unit calls the hook function of the system module to be abnormal;
the system module is used for informing the signal processing module to acquire the related information of the abnormity of the application module if the first signal belongs to a preset signal set;
the signal processing module is configured to obtain relevant information about an abnormality of the application module, and send the relevant information to a data analysis system, so that the data analysis system determines a blacklist according to the relevant information, where the blacklist includes information that the application module does not call a hook function in the terminal device.
A fourth aspect of the embodiments of the present invention provides a data analysis system, including:
an information receiving unit, configured to receive relevant information sent by multiple terminal devices when a hook function of a system module called by an application module is abnormal, where the relevant information includes: the name and version information of an application module included in the corresponding terminal equipment, the model of the terminal equipment and the name of a hook function;
the statistical unit is used for counting the receiving times of the matched groups of related information;
and the blacklist storage unit is used for storing the name and version information of the application module, the model of the terminal equipment and the name of the hook function in the multiple groups of related information as an information group of the blacklist if the receiving times is greater than a preset value.
It can be seen that, in the method of this embodiment, when the hook function of the application module calling system module in the terminal device is abnormal, the system module notifies the signal processing module to obtain the information related to the abnormality of the application module, and sends the information to the data analysis system for analysis to obtain the blacklist. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided. Therefore, the method of the embodiment can be compatible with various terminal devices and application modules, and the stability of the application module calling the hook function is fundamentally ensured.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts.
Fig. 1 is a schematic diagram of a scenario to which a signal processing method of an application program according to an embodiment of the present invention is applied;
fig. 2 is a flowchart of a signal processing method of an application according to an embodiment of the present invention;
fig. 3 is a flowchart of a signal processing method of another application according to an embodiment of the present invention;
fig. 4 is a flowchart of a signal processing method of another application according to an embodiment of the present invention;
fig. 5 is a flowchart of a signal processing method of an application according to another embodiment of the present invention;
fig. 6 is a schematic diagram of a scenario to which a signal processing method of an application program is applied in an application embodiment of the present invention;
fig. 7 is a flowchart of a signal processing method of an application according to an embodiment of the present invention;
fig. 8 is a schematic structural diagram of a terminal device according to an embodiment of the present invention;
fig. 9 is a schematic structural diagram of another terminal device provided in the embodiment of the present invention;
FIG. 10 is a schematic structural diagram of a data analysis system according to an embodiment of the present invention;
fig. 11 is a schematic structural diagram of another terminal device according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
The invention provides a signal processing method of an application program, which is mainly applied to a scene shown in figure 1 and specifically comprises terminal equipment and a data analysis system, wherein the terminal equipment comprises: a system module, at least one application module and a signal processing module (one is illustrated in fig. 1). The application module is an application program in the terminal equipment; the system module is a module for maintaining the basic operation of the terminal device, for example, the system module may control the display of the display screen of the terminal device, and the system module may also control the execution of the application module, for example, start or stop the application module. In the embodiment of the invention, when the hook function of the system module is called by the application module to be abnormal, a first signal is sent to the system module, if the first signal belongs to a preset signal set, the system module informs the signal processing module to acquire the related information of the abnormal application module, and the signal processing module sends the related information to the data analysis system, so that the data analysis system determines the blacklist according to the related information. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided. Therefore, the method of the embodiment of the invention can be compatible with various terminal devices and application modules, and fundamentally ensures the stability of the application module calling the hook function.
An embodiment of the present invention provides a signal processing method for an application, which is a method executed by a terminal device shown in fig. 1, and a flowchart is shown in fig. 2, where the method includes:
It can be understood that the application module of the terminal device may call the hook function of the system module at a certain time when the application module is started or running, and specifically, the application module calls the hook function in an inlinehook manner.
Each time the application module is started, the application module modifies the instruction header of the hook function that the application module needs to call during running so as to jump to the corresponding hook function, and mainly adds the address information of the hook function into a parameter of a certain function of the application module in the instruction header of the certain hook function, for example, adds the address information of the hook function into a register for storing the address information of the my _ hook function of the application module.
For example: in the Thumb mode, an application module modifies an instruction header of a certain hook function into the following instruction, wherein a register pc is used for storing address information of a my _ hook function:
+0bx pc// jump to register pc
+2nop// instruction alignment
+4ldr pc, [ pc, # -4]// load address at +8 to register pc
+8< jump address of hook function >
Exceptions in the application module calling the hook function may include: the application module accesses the bus erroneously, and the application module is not aligned with the storage space (i.e. the memory) corresponding to the application module during the running, or the application module crosses the boundary to be out of the storage space corresponding to the application module during the running.
The application module then sends a first signal to the system module, for example: under the conditions that an application module accesses a bus wrongly or the application module is not aligned with a storage space (namely a memory) corresponding to the application module during running, the application module can send out a bus signal (SIGBUS); when the application module is out of the storage space corresponding to the application module during operation, the application module may send out a signal violation signal (SIGSEGV), and the like.
It should be noted that the hook function is a function run by the system module, and the system module may monitor some execution functions of the application module by calling the hook function through the application module. For example, the application module may call the process of reading (read), writing (write), opening (open), closing (close), creating (create), and the like IO functions to monitor the relevant IO performance of the application module.
It is understood that the preset signal set may be a signal set registered with the system module by the application module at each start-up, and the signal included in the signal set is a signal issued by the application module when the hook function calling the system module is abnormal, and not a signal issued by the application module under other conditions (such as a call of the system module, an interrupt condition, etc.), and may include signals of SIGBUS, SIGSEGV, etc. Specifically, the application module may call a sigaction function to register a signal set with the system module, where parameters of the function include identification information of each signal in the signal set, such as numbers for identifying each signal.
The information about the application module exception may include: the information of the application module, the terminal device and the hook function called by the application module may specifically be information of a name, a version and the like of the application module, for example, a Software Development Kit (SDK) number and the like of an application program; the information of the terminal device may be a model of the terminal device, a Universal Internet Number (UIN), or the like; the information of the application module calling the hook function is related codes of the application module calling the hook function, such as codes of head instructions of the hook function, codes of jumping to a new hook function, codes of jumping from the new hook function back to an original hook function, and the like.
Further, the information related to the occurrence of the abnormality of the application module may further include at least one of the following information: an Application Programming Interface (API) of an Application program of the system module, a Central Processing Unit (CPU) architecture of the terminal device, and the like.
It should be noted that, each time the application module is started, the application module may register address information of the signal processing module in the system module, specifically, the application module may call a command function to register the address information of the signal processing module in the system module, and parameters of the function include the address information of the signal processing module. Thus, when executingstep 103, the system module notifies the signal processing module to obtain the information about the occurrence of the abnormality in the application module according to the address information of the signal processing module.
It can be seen that, in the method of this embodiment, when the hook function of the application module calling system module in the terminal device is abnormal, the system module notifies the signal processing module to obtain the information related to the abnormality of the application module, and sends the information to the data analysis system for analysis to obtain the blacklist. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided. Therefore, the method of the embodiment can be compatible with various terminal devices and application modules, and the stability of the application module calling the hook function is fundamentally ensured.
It should be noted that, after the application module executes thestep 101, the system module generally terminates the application module. In an embodiment of the present invention, in order to make the application module not crash and operate normally when the system module calls the hook function abnormally. The followingstep 201 is executed before the application module executes theabove step 101, and after the signal processing function executes theabove step 104, the application module executes the followingstep 202, as shown in fig. 3, where:
Specifically, the application module may call a signal fixed jump (Sigsetjmp) function, and store the context run by the application module into a jump buffer (jmp _ buf).
It can be understood that, after the signal processing module sends the relevant information to the data analysis system, a signal long jump (Siglongjmp) function may be called to jump to the application module, and the application module executes the context stored in the jump cache.
Thus, throughsteps
In another specific embodiment, referring to fig. 4, before the application module calls the hook function, the followingsteps 301 to 304 may be performed:
Specifically, when the terminal device is loading the application module, the blacklist is obtained from the data analysis system.
Specifically, the application module matches the name and version information of the current application module, the model of the current terminal device, and the name of the hook function with the information of each information group in the blacklist, respectively, and hits the blacklist if the information is completely matched with the information in a certain information group; if there is not a perfect match with the information in any one of the sets of information, the blacklist is missed.
Instep 304, the application module performs an operation of the non-call hook function, i.e., an unhook operation.
Because the application module modifies the instruction header of the hook function to realize the purpose of jumping to the hook function when starting each time, the application module can restore the instruction header of the hook function when the unhook operation in the step is executed.
It should be noted that, the application module may perform theabove steps 301 to 304 before calling the hook function each time; theabove steps 301 to 304 may also be executed when the application module is started, and it is determined once whether the hook function that needs to be called by the application module needs to be called.
Another embodiment of the present invention provides a signal processing method for an application, which is a method executed by the data analysis system shown in fig. 1, and a flowchart is shown in fig. 5, where the method includes:
Specifically, the information related to the exception of the hook function called by the application module and sent by the terminal device to the data analysis system may specifically include: the method comprises the following steps that an application module, terminal equipment and the application module call hook function information, wherein the application module information can be information such as the name and the version of the application module, for example, an SDK number of an application program; the information of the terminal equipment can be the model of the terminal equipment, UIN number and the like; the information of the application module calling the hook function is related codes of the application module calling the hook function, such as codes of a head instruction of the hook function, codes of a new hook function, codes of a hook function and an application module. Further, the related information may also include information such as an API of the system module and a CPU architecture of the terminal device.
It can be understood that when the application module calls the hook function to be abnormal, the signal processing module of the terminal device sends the relevant information to the data analysis system, and the specific method for the terminal device to send the relevant information is described in the embodiments shown in fig. 2 to 4, which is not described herein again.
And step 402, counting the receiving times of the matched multiple groups of related information.
The data analysis system may count the receiving times in this step according to a preset period, where the matched multiple sets of related information refer to that information of application modules of each set of related information in the multiple sets of related information is matched, information of terminal devices is matched, and information of hook functions is matched.
For example: the related information 1 includes: the name 1 and the version 1 of the application module, the model 1 of the terminal equipment and the name 1 of the hook function; the related information 2 includes: the name 1 and the version 2 of the application module, the model 2 of the terminal equipment and the name 1 of the hook function; the related information 3 includes: the name 1 and the version 1 of the application module, the model 1 of the terminal equipment and the name 1 of the hook function. The related information 1 matches with the related information 3 and the related information 1 does not match with the related information 2.
Further, when a certain terminal device is loading an application module, the data analysis system sends the blacklist to the application module of the terminal device. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided. Therefore, the method of the embodiment can be compatible with various terminal devices and application modules, and the stability of the application module calling the hook function is fundamentally ensured.
The method according to the embodiment of the present invention is described below with a specific embodiment, and the method according to the embodiment of the present invention may be applied to a scenario shown in fig. 6, which is similar to the scenario shown in fig. 1, and in the different embodiment, the application module is specifically an instant messaging module. Fig. 7 shows a flowchart of the method of this embodiment, which includes:
And when the instant communication module is started, the instruction heads of all hook functions needing to be called are also modified, so that the hook functions are jumped to when the instant communication module runs. The method mainly comprises the step of adding an instruction into an instruction header of a hook function, so that address information of the hook function is added into a register for storing address information of a my _ hook function of an instant messaging module.
The related information includes: the name and version information of the instant messaging module, the model of the terminal equipment and the name of the hook function, and the information can also comprise the API of the system module, the CPU architecture of the terminal equipment and the like.
Instep 506, the instant messaging module performs the operation of the non-call hook function, i.e., the operation of the unhook.
Instep 507, the instant messaging module calls the Sigsetjmp function to store the context running in the instant messaging module into the skip buffer, and then the instant messaging module executesstep 509. The instant messaging module calls the Sigsetjmp function for the first time, and the return value of the Sigsetjmp function is 0 because the Siglongjmp function is not called before.
Instep 510, the instant messaging module calls a hook function to implement a specific function.
Since the address information of each hook function is added to the register for storing the address information of the my _ hook function when the instant communication module is started, the instant communication module can directly jump to execute the my _ hook function when calling the hook function.
Further, in this embodiment, after receiving the information about the occurrence of the abnormality of the application module sent by the signal processing module of each terminal device, the data analysis system may form a blacklist according to the flowchart shown in fig. 5 to control whether each terminal device calls the hook function, which is not described herein again.
An embodiment of the present invention further provides a terminal device, a schematic structural diagram of which is shown in fig. 8, and the terminal device may specifically include: asystem module 10, at least oneapplication module 11, and a signal processing module 12 (illustrated as an example in fig. 8), wherein theapplication module 11 includes ahook unit 110 and asignal emitting unit 111, wherein:
the hookingunit 110 is configured to call a hooking function of thesystem module 10;
thesignal sending unit 111 is configured to send a first signal to thesystem module 10 when thehook unit 110 calls a hook function of the system module to be abnormal;
thesystem module 10 is configured to notify thesignal processing module 12 to obtain information about an abnormality occurring in theapplication module 11 if the first signal sent by thesignal sending unit 111 belongs to a preset signal set;
thesignal processing module 12 is configured to obtain relevant information about an abnormality occurring in theapplication module 11, and send the relevant information to a data analysis system, so that the data analysis system determines a blacklist according to the relevant information, where the blacklist includes information that the application module does not call a hook function in the terminal device.
Here, the relevant information acquired by thesignal processing module 12 includes: the application module, the terminal equipment and the application module call the information of the hook function.
It can be seen that, in the terminal device of this embodiment, when thehook unit 110 of theapplication module 11 calls the hook function of thesystem module 10 to cause an exception, thesystem module 10 notifies thesignal processing module 12 to obtain the relevant information of the exception occurring in theapplication module 11 and sends the information to the data analysis system for analysis to obtain the blacklist. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided.
Referring to fig. 9, in a specific embodiment, in addition to the terminal device having the structure shown in fig. 8, theapplication module 11 may further include acontext unit 112, an execution unit 113, ablacklist unit 114, afirst registration unit 115, and asecond registration unit 116, where:
acontext unit 112, configured to store a context executed by the execution unit 113 of theapplication module 11 before thehook unit 110 invokes the hook function;
an operation unit 113, configured to operate the context stored by thecontext unit 112 after thesignal processing module 12 sends the relevant information to a data analysis system.
Specifically, thecontext unit 112 is specifically configured to invoke a signal fixed jump Sigsetjmp function, and store the context run by theapplication module 11 into a jump cache; thesignal processing module 12 is specifically configured to call a signal long jump Siglongjmp function to jump to theapplication module 11 after the relevant information is sent to the data analysis system; the context stored in the jump cache is executed by the execution unit 113 of theapplication module 11.
Ablacklist unit 114, configured to obtain a blacklist determined by the data analysis system, where the blacklist includes a plurality of information groups, where each information group includes: the name and version information of the application module, the model of the terminal equipment and the name of the hook function; determining whether the information of the current application module, the terminal device and the hook function hits the blacklist, and if not, informing thehook unit 10 to call the hook function of the system module; if so, thehook unit 10 is notified to perform an operation that does not call the hook function.
Because thehook unit 110 modifies the instruction header of the hook function when theapplication module 11 is started, the purpose of subsequently calling the hook function by thehook unit 110 of theapplication module 11 is achieved; when the operation of not calling the hook function is executed, the instruction head of the hook function is restored.
Afirst registration unit 115, configured to register the preset signal set with thesystem module 10 when theapplication module 11 is started, where the signal included in the signal set is a signal sent by the application module when a hook function calling the system module is abnormal.
Asecond registration unit 116, configured to register address information of the signal processing module to thesystem module 10 when theapplication module 11 is started; in this way, thesystem module 10 notifies thesignal processing module 12 to obtain the information about the occurrence of the abnormality of the application module according to the address information of the signal processing module running registered by thesecond registration unit 116.
An embodiment of the present invention further provides a data analysis system, a schematic structural diagram of which is shown in fig. 10, and the data analysis system may specifically include:
aninformation receiving unit 20, configured to receive relevant information sent by multiple terminal devices when a hook function of an application module calling system module is abnormal, where the relevant information includes: the name and version information of an application module included in the corresponding terminal equipment, the model of the terminal equipment and the name of a hook function;
acounting unit 21, configured to count the receiving times of the matched multiple sets of relevant information according to the relevant information received by theinformation receiving unit 20; the matched multiple groups of related information means that the names of the application modules in the multiple groups of related information are matched with the version information, the types of the terminal devices are matched, and the names of the hook functions are matched.
Ablacklist storage unit 22, configured to store, if the number of times of reception counted by thecounting unit 21 is greater than a preset value, the name and version information of the application module, the model of the terminal device, and the name of the hook function in the multiple sets of related information received by theinformation receiving unit 20 as an information set of a blacklist.
Further, the data analysis system may further include a sending unit 23 (see the portion shown by the dashed line box in fig. 10) configured to send the blacklist stored in theblacklist storage unit 22 to the application module of a certain terminal device when the certain terminal device is loading the application module. Therefore, whether the hook functions need to be called by the application module of the terminal equipment can be controlled through the blacklist, and if the hook functions are easy to be abnormal when some application module on certain type of terminal equipment calls some hook functions, the application module on the type of terminal equipment can be controlled through the blacklist not to call the hook functions, so that the abnormal situation of the application module is avoided. Therefore, the data analysis system of the embodiment can be compatible with various terminal devices and application modules, and the stability of the application module calling the hook function is fundamentally ensured.
The present invention further provides a terminal device, a schematic structural diagram of which is shown in fig. 11, where the terminal device may generate a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 30 (e.g., one or more processors) and amemory 31, and one or more storage media 32 (e.g., one or more mass storage devices) for storingapplications 321 ordata 322. Thememory 31 and the storage medium 32 may be, among other things, transient storage or persistent storage. The program stored in the storage medium 32 may include one or more modules (not shown), each of which may include a series of instruction operations for the terminal device. Still further, thecentral processor 30 may be configured to communicate with the storage medium 32 to execute a series of instruction operations in the storage medium 32 on the terminal device.
Specifically, theapplication 321 stored in the storage medium 32 includes a signal processing program of the application, and the program may include thesystem module 10, thesignal processing module 12, and thehook unit 110, thesignal sending unit 111, thecontext unit 112, the running unit 113, theblacklist unit 114, thefirst registration unit 115, and thesecond registration unit 116 in the terminal device, which is not described herein again. Further, thecentral processor 30 may be configured to communicate with the storage medium 32, and execute a series of operations corresponding to the signal processing program of the application program stored in the storage medium 32 on the terminal device.
The terminal equipment may also include one ormore power supplies 33, one or more wired or wireless network interfaces 34, one or more input-output interfaces 35, and/or one ormore operating systems 323, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and the like.
The steps executed by the terminal device in the above-described method embodiment may be based on the structure of the terminal device shown in fig. 11.
An embodiment of the present invention further provides a server, a schematic structural diagram of which is similar to the structure of the terminal device shown in fig. 11, except that in the server of this embodiment, the application program stored in the storage medium includes a signal processing program of the application program, and the program may include theinformation receiving unit 20, thestatistical unit 21, theblacklist storage unit 22 and the sendingunit 23 in the data analysis system, which is not described herein again. Further, thecentral processor 30 may be configured to communicate with the storage medium 32, and execute a series of operations corresponding to the signal processing program of the application program stored in the storage medium 32 on the server.
An embodiment of the present invention further provides a signal processing system of an application, a schematic structural diagram of which may be shown in fig. 1, and which includes a data analysis system and at least one terminal device, where a structure of the terminal device may be as shown in any one of fig. 8, fig. 9, or fig. 11, and a structure of the data analysis system may be as shown in fig. 10, and details thereof are not repeated here.
Those skilled in the art will appreciate that all or part of the steps in the methods of the above embodiments may be implemented by associated hardware instructed by a program, which may be stored in a computer-readable storage medium, and the storage medium may include: read Only Memory (ROM), Random Access Memory (RAM), magnetic or optical disks, and the like.
The signal processing method, system and terminal device of the application program provided by the embodiment of the present invention are described in detail above, and a specific example is applied in the present document to explain the principle and the implementation of the present invention, and the description of the above embodiment is only used to help understanding the method and the core idea of the present invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.
Claims (16)
1. A signal processing method of an application program, which is applied to a terminal device including an application module, a signal processing module and a system module, the method comprising:
when the hook function of the system module is called to be abnormal by the application module, a first signal is sent to the system module; the exception of the application module calling the hook function comprises at least one of the following exceptions: the application module accesses bus errors, the application module is not aligned with the corresponding storage space during running, and the application module crosses the boundary to the corresponding storage space during running;
if the first signal belongs to a preset signal set, the system module informs the signal processing module to acquire the related information of the abnormity of the application module;
the signal processing module sends the relevant information to a data analysis system so that the data analysis system determines a blacklist according to the relevant information, the blacklist comprises information that an application module does not call a hook function in terminal equipment, the blacklist comprises a plurality of information groups, and each information group comprises the name and version information of the application module, the model of the terminal equipment and the name of the hook function;
controlling some application modules on certain types of terminal equipment not to call some hook functions through the blacklist;
before the application module calls the hook function, the method further comprises:
the application module acquires a blacklist determined by the data analysis system;
the application module determines whether the information of the current application module, the terminal equipment and the hook function hits the blacklist, and if not, the application module calls the hook function of the system module.
2. The method of claim 1, further comprising:
before the application module calls a hook function, the application module stores the context of the operation of the application module;
after the signal processing module sends the relevant information to a data analysis system, the method further comprises: the application module runs the stored context.
3. The method of claim 2,
the application module stores the context of the application module, and specifically includes: the application module calls a signal fixed jump Sigsetjmp function and stores the context operated by the application module into a jump cache;
after the signal processing module sends the relevant information to the data analysis system, the application module runs the stored context, which specifically includes: after the signal processing module sends the relevant information to a data analysis system, a signal long jump Siglongjmp function is called to jump to the application module, and the application module runs the context stored in the jump cache.
4. The method of claim 1, wherein the method further comprises:
and the application module determines that the information of the current application module, the terminal equipment and the hook function hits the blacklist, and the application module executes the operation of non-calling the hook function.
5. The method of claim 4, wherein the method further comprises:
when the application module is started, modifying the instruction head of the hook function;
the executing, by the application module, an operation of not calling the hook function specifically includes: and restoring the instruction head of the hook function.
6. The method of any of claims 1 to 5, wherein prior to the application module issuing the first signal to the system module, the method further comprises:
and when the application module is started, registering the preset signal set to the system module, wherein the signal included in the signal set is a signal sent by the application module when a hook function of the system module is called to be abnormal.
7. The method of any of claims 1 to 5, wherein prior to the application module issuing the first signal to the system module, the method further comprises:
when the application module is started, registering the address information of the signal processing module to the system module;
the system module notifies the signal processing module to acquire information related to the occurrence of the abnormality of the application module, and the method specifically includes: and the system module informs the signal processing module of acquiring the related information of the abnormity of the application module according to the address information of the signal processing module.
8. A method for signal processing of an application, the method comprising:
receiving related information sent by a plurality of terminal devices when hook functions of application modules calling system modules are abnormal, wherein the related information comprises: the name and version information of an application module included in the corresponding terminal equipment, the model of the terminal equipment and the name of a hook function; the exception of the application module calling the hook function comprises at least one of the following exceptions: the application module accesses bus errors, the application module is not aligned with the corresponding storage space during running, and the application module crosses the boundary to the corresponding storage space during running;
counting the receiving times of the matched multiple groups of related information;
if the receiving times are larger than a preset value, storing the name and version information of the application module, the model of the terminal equipment and the name of the hook function in the plurality of groups of related information as an information group of a blacklist; controlling some application modules on certain types of terminal equipment not to call some hook functions through the blacklist;
and when a certain terminal device loads the application module, sending the blacklist to the application module of the certain terminal device, so that the application module calls a hook function of a system module of the terminal device when determining that the information of the current application module, the terminal device and the hook function is not in the blacklist.
9. A terminal device, comprising: a system module, at least one application module, and a signal processing module, wherein the application module comprises a hook unit and a signal emitting unit, wherein:
the hook unit is used for calling a hook function of the system module;
the signal sending unit is used for sending a first signal to the system module when the hook unit calls the hook function of the system module to be abnormal; the exception of the application module calling the hook function comprises at least one of the following exceptions: the application module accesses bus errors, the application module is not aligned with the corresponding storage space during running, and the application module crosses the boundary to the corresponding storage space during running;
the system module is used for informing the signal processing module to acquire the related information of the abnormity of the application module if the first signal belongs to a preset signal set;
the signal processing module is configured to obtain relevant information about an abnormality of the application module, and send the relevant information to a data analysis system, so that the data analysis system determines a blacklist according to the relevant information, where the blacklist includes information that the application module does not call a hook function in a terminal device, and the blacklist includes a plurality of information sets, and each information set includes a name and version information of the application module, a model of the terminal device, and a name of the hook function; controlling some application modules on certain types of terminal equipment not to call some hook functions through the blacklist;
the application module further comprises: the blacklist unit is used for acquiring a blacklist determined by the data analysis system; and determining whether the information of the current application module, the terminal equipment and the hook function hits the blacklist, and if not, informing the hook unit to call the hook function of the system module.
10. The terminal device of claim 9, wherein the application module further comprises:
the context unit is used for storing the context of the operation of the application module before the hook unit calls the hook function;
and the running unit is used for running the stored context after the related information is sent to the data analysis system.
11. The terminal device of claim 10,
the context unit is specifically configured to call a signal fixed jump Sigsetjmp function, and store the context operated by the application module into a jump cache;
the signal processing module is specifically configured to call a signal long jump Siglongjmp function to jump to the application module after the relevant information is sent to the data analysis system;
the running unit is specifically configured to run the context stored in the jump cache.
12. The terminal device of claim 9,
and the blacklist unit is further configured to notify the hook unit to execute an operation of not calling the hook function when determining that the information of the current application module, the terminal device, and the hook function hits the blacklist.
13. The terminal device of claim 12,
the hook unit is also used for modifying an instruction head of the hook function when the application module is started;
the hook unit is specifically configured to restore an instruction header of the hook function when an operation that does not call the hook function is executed.
14. A data analysis system, comprising:
an information receiving unit, configured to receive relevant information sent by multiple terminal devices when a hook function of a system module called by an application module is abnormal, where the relevant information includes: the name and version information of an application module included in the corresponding terminal equipment, the model of the terminal equipment and the name of a hook function; the exception of the application module calling the hook function comprises at least one of the following exceptions: the application module accesses bus errors, the application module is not aligned with the corresponding storage space during running, and the application module crosses the boundary to the corresponding storage space during running;
the statistical unit is used for counting the receiving times of the matched groups of related information;
a blacklist storage unit, configured to store, as an information group of a blacklist, name and version information of an application module, a model of a terminal device, and a name of a hook function in the multiple sets of relevant information if the number of times of reception is greater than a preset value, and control some application modules on a certain type of terminal device not to call some hook functions through the blacklist;
and the sending unit is used for sending the blacklist stored by the blacklist storage unit to the application module of a certain terminal device when the application module is loaded by the certain terminal device, so that the application module calls the hook function of the system module of the terminal device when determining that the information of the current application module, the terminal device and the hook function does not hit the blacklist.
15. A computer-readable storage medium storing a plurality of instructions adapted to be loaded by a processor and to perform a signal processing method of an application program according to any one of claims 1 to 8.
16. A terminal device comprising a processor and a storage medium, the processor configured to implement instructions;
the storage medium is used for storing a plurality of instructions for loading and executing the signal processing method of the application program according to any one of claims 1 to 7 by the processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710193570.0ACN106997313B (en) | 2017-03-28 | 2017-03-28 | Signal processing method and system of application program and terminal equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710193570.0ACN106997313B (en) | 2017-03-28 | 2017-03-28 | Signal processing method and system of application program and terminal equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106997313A CN106997313A (en) | 2017-08-01 |
| CN106997313Btrue CN106997313B (en) | 2022-04-05 |
Family
ID=59431720
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710193570.0AActiveCN106997313B (en) | 2017-03-28 | 2017-03-28 | Signal processing method and system of application program and terminal equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106997313B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110083471A (en)* | 2018-01-25 | 2019-08-02 | 北京京东尚科信息技术有限公司 | A kind of method and apparatus preventing application crash |
| CN109145590B (en)* | 2018-07-27 | 2023-04-07 | 平安科技（深圳）有限公司 | Function hook detection method, detection equipment and computer readable medium |
| CN110221961B (en)* | 2019-04-26 | 2024-05-28 | 平安科技（深圳）有限公司 | Global hook automatic repair method, device, equipment and storage medium |
| CN111209225B (en)* | 2020-01-03 | 2022-04-22 | 北京字节跳动网络技术有限公司 | Method, device, medium and electronic equipment for acquiring real address |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1492320A (en)* | 2002-10-25 | 2004-04-28 | 华为技术有限公司 | Windows program exception capture and location method |
| CN103984898A (en)* | 2014-05-29 | 2014-08-13 | 北京神州绿盟信息安全科技股份有限公司 | Detection method and detection device for attack in spray pattern |
| CN106127034A (en)* | 2016-06-17 | 2016-11-16 | 北京金山安全软件有限公司 | Method and device for preventing system from being closed maliciously and electronic equipment |
| CN106528316A (en)* | 2016-11-10 | 2017-03-22 | 霍尔果斯霹雳互动网络科技有限公司 | Anti-crash method and system of online game server |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040083202A1 (en)* | 2002-08-30 | 2004-04-29 | Arkivio, Inc. | Techniques to control recalls in storage management applications |
- 2017
- 2017-03-28CNCN201710193570.0Apatent/CN106997313B/enactiveActive
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1492320A (en)* | 2002-10-25 | 2004-04-28 | 华为技术有限公司 | Windows program exception capture and location method |
| CN103984898A (en)* | 2014-05-29 | 2014-08-13 | 北京神州绿盟信息安全科技股份有限公司 | Detection method and detection device for attack in spray pattern |
| CN106127034A (en)* | 2016-06-17 | 2016-11-16 | 北京金山安全软件有限公司 | Method and device for preventing system from being closed maliciously and electronic equipment |
| CN106528316A (en)* | 2016-11-10 | 2017-03-22 | 霍尔果斯霹雳互动网络科技有限公司 | Anti-crash method and system of online game server |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106997313A (en) | 2017-08-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108399132B (en) | Scheduling test method, device and storage medium | |
| CN105843741B (en) | Information processing method and device for application program | |
| CN111800490B (en) | Method, device and terminal equipment for acquiring network behavior data | |
| CN106997313B (en) | Signal processing method and system of application program and terminal equipment | |
| US8225142B2 (en) | Method and system for tracepoint-based fault diagnosis and recovery | |
| CN109788068B (en) | Heartbeat state information reporting method, device and equipment and computer storage medium | |
| US12260222B2 (en) | Exception handling method and related apparatus | |
| CN104915263A (en) | Process fault processing method and device based on container technology | |
| CN112099800A (en) | Code data processing method and device and server | |
| CN108563472B (en) | Method and device for loading service plug-in based on multi-open application | |
| US7721331B1 (en) | Methods and apparatus for performing a pre-processing activity | |
| CN109408265B (en) | IOS abnormal operation protection method and device, terminal equipment and storage medium | |
| CN107967192B (en) | A system crash processing method and device for an intelligent terminal | |
| US8171345B2 (en) | Disablement of an exception generating operation of a client system | |
| CN113282363A (en) | Method and device for optimizing hybrid APP | |
| US11630714B2 (en) | Automated crash recovery | |
| CN113791824B (en) | Peripheral driver loading method, system and medium of terminal equipment | |
| CN117518916A (en) | Process monitoring methods, devices, electronic equipment and storage media | |
| CN116719671A (en) | Debugging method of kernel unloading service and related equipment thereof | |
| CN112558975B (en) | Method and device for switching codes of components, electronic equipment and readable storage medium | |
| CN111414270B (en) | Exception handling method and device | |
| CN114328117A (en) | Log capture method and device, electronic equipment and storage medium | |
| CN114816482A (en) | Upgrading method, device, computer equipment and storage medium for block storage service | |
| CN114363221A (en) | Heartbeat detection method based on micro-service system, storage medium, electronic device and system | |
| CN118734369A (en) | A data detection method, device, computer equipment, medium, and product |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |