CN112052165B - Method, system and storage medium for detecting target function debugged - Google Patents
Method, system and storage medium for detecting target function debugged Download PDFInfo
- Publication number
- CN112052165B CN112052165B CN202010847715.6A CN202010847715A CN112052165B CN 112052165 B CN112052165 B CN 112052165B CN 202010847715 A CN202010847715 A CN 202010847715A CN 112052165 B CN112052165 B CN 112052165B
- Authority
- CN
- China
- Prior art keywords
- objective function
- executable file
- debugged
- function
- running
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Prevention of errors by analysis, debugging or testing of software
- G06F11/362—Debugging of software
- G06F11/3644—Debugging of software by instrumenting at runtime
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Prevention of errors by analysis, debugging or testing of software
- G06F11/362—Debugging of software
- G06F11/366—Debugging of software using diagnostics
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention provides a method, a system and a storage medium for detecting that an objective function is debugged, wherein the method comprises the following steps: acquiring the initial position and byte number of an objective function in an executable file; CRC processing is carried out on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and whether the obtained frame values change or not is judged; if the change occurs, it is determined that the objective function is debugged. The CRC processing is respectively carried out on the objective function before and after the program is operated, whether the objective function is debugged or not can be visually reflected by comparing the changes of the frame values before and after the program is operated, so that the objective function can be protected, and the safety of the system operation is improved.
Description
Technical Field
The present invention relates to the field of software technologies, and in particular, to a method, a system, and a storage medium for detecting that an objective function is debugged.
Background
Debugging detection is usually required for a program to detect whether the current program can normally run, and when the current program cannot normally run, breakpoint debugging is required for some functions in the current program.
However, when breakpoint debugging is performed on a part of functions, the risk that the functions are debugged by other programs inevitably exists, so that the system loopholes of the current program are caused, and unsafe factors are brought to the running of the current program.
Accordingly, the prior art has drawbacks and needs to be improved and developed.
Disclosure of Invention
The invention aims to solve the technical problems that aiming at the defects in the prior art, a method, a system and a storage medium for detecting the debugged objective function are provided, and aims to solve the problems that when breakpoint debugging is carried out on the function in the prior art, the risk that the function is debugged by other programs exists and the safe operation of the system is endangered.
The technical scheme adopted for solving the technical problems is as follows:
A method of detecting that an objective function is debugged, comprising:
Acquiring the initial position and byte number of an objective function in an executable file;
CRC processing is carried out on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and whether the obtained frame values change or not is judged;
if the change occurs, it is determined that the objective function is debugged.
Further, the obtaining the starting position and the byte number of the objective function in the executable file specifically includes:
Acquiring a function starting address table in an executable file;
Decoding the acquired function starting address table to obtain the starting positions and the occupied byte numbers of all functions in the executable file;
and reading the initial position and the byte number corresponding to the objective function from the initial positions and the byte number occupied by all the functions.
Further, uleb codes are used for decoding the acquired function start address table.
Further, if the change occurs, determining that the objective function is debugged, and then the method includes:
Controlling the executable file to exit from running;
Or reporting the detected result of the debugged target function.
Further, performing CRC processing on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and determining whether the obtained frame values change specifically includes:
Before the executable file runs, CRC processing is carried out on data in an interval where an objective function is located, and a first frame value is obtained;
during the running of the executable file, performing CRC processing on the data in the interval where the objective function is located to obtain a second frame value;
it is determined whether the first frame value and the second frame value are equal.
Further, performing CRC processing on the objective function before and after the executable file is run, to obtain frame values before and after the executable file is run, and determining whether the obtained frame values change, and then further includes:
detecting whether a breakpoint mark exists in an interval where the objective function is located;
if the breakpoint mark exists and the obtained frame value changes, judging that the objective function is debugged.
Further, the detecting whether the breakpoint mark exists in the interval where the objective function exists, and then includes:
if the breakpoint mark does not exist, but the obtained frame value is changed, judging that the data content in the objective function is tampered.
Further, the method of the present invention is based on an IOS system.
The present invention also provides a system comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising a method for performing detecting that an objective function is debugged as described above.
The present invention also provides a storage medium storing a computer program executable for implementing the method of detecting that an objective function is debugged as described above.
The invention provides a method, a system and a storage medium for detecting that an objective function is debugged, wherein the method comprises the following steps: acquiring the initial position and byte number of an objective function in an executable file; CRC processing is carried out on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and whether the obtained frame values change or not is judged; if the change occurs, it is determined that the objective function is debugged. The CRC processing is respectively carried out on the objective function before and after the program is operated, whether the objective function is debugged or not can be visually reflected by comparing the changes of the frame values before and after the program is operated, so that the objective function can be protected, and the safety of the system operation is improved.
Drawings
FIG. 1 is a flow chart of a preferred embodiment of a method for detecting that an objective function is debugged in the present invention.
Fig. 2 is a flowchart of a specific embodiment of step S100 in fig. 1 according to the present invention.
Fig. 3 is a flowchart of a specific embodiment of step S200 in fig. 1 according to the present invention.
Fig. 4 is a flowchart of a preferred embodiment of the present invention when a breakpoint is detected after step S200 in fig. 1.
FIG. 5 is a flow chart of a preferred embodiment of the present invention when no breakpoint is detected after step S200 in FIG. 1.
FIG. 6 is a flowchart of an embodiment of the present invention for determining that the objective function is debugged after step S300 in FIG. 1.
Fig. 7 is a functional block diagram of a preferred embodiment of the system of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more clear and clear, the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.
Referring to fig. 1, fig. 1 is a flowchart of a method for detecting that an objective function is debugged in the present invention. As shown in fig. 1, a method for detecting that an objective function is debugged according to an embodiment of the present invention includes the following steps:
S100, acquiring the initial position and byte number of the objective function in the executable file.
Specifically, the current program is represented by an executable file, the executable file is composed of a plurality of functions, the functions are written by a code segment edited in the background, and the initial position of the objective function in the executable file is obtained, namely, the code part forming the objective function in the background code of the program is obtained.
S200, performing CRC processing on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and judging whether the obtained frame values change or not.
The CRC process is to perform cyclic redundancy check. The cyclic redundancy check (CyclicalRedundancyCheck), i.e., adding an FCS (FrameCheckSequence ) to each data block (called a frame). The FCS contains detailed information of the frame and is specially used for the transmitting/receiving device to compare whether the frame is correct or not. If the data is erroneous, it is sent again.
By comparing the changes of the frame values obtained before and during the running of the program, whether the objective function is debugged can be reflected, and in general, if the objective function is not debugged, the frame values before and during the running of the program are not changed.
S300, if the change occurs, judging that the objective function is debugged.
The state of the target function can be reminded to the user by judging that the target function is in the debugging state, so that subsequent anti-debugging processing or other error checking can be conveniently performed, and the safety of a program running environment is ensured.
Generally, the IOS anti-debugging technology is based on the whole program or the corresponding code segment of the program, but sometimes the program does not need to be debugged, for example, when the program is specific, some functions need to be debugged at break points, and some specific functions do not need to be debugged at break points, so that there is no unified standard for the whole program, and it cannot be judged whether to execute the anti-debugging means under the current situation, so that it is required to separately detect some specific functions to judge whether the specific functions are in a debugging state, so as to prevent whether the specific functions are debugged by an unauthorized third party, and further, a user can decide to execute the subsequent measures according to the state of the functions.
Therefore, the invention provides a scheme for detecting whether the objective function (namely the specific function) is in the debugging state, thereby helping a user to execute the subsequent corresponding measures according to the state of the objective function so as to ensure the safety of the program operation. The present invention is illustrated based on an IOS system to describe the solution of the present invention in detail.
In one embodiment, as shown in fig. 2, the step S100 specifically includes:
S110, acquiring a function starting address table in the executable file.
Specifically, according to a Load command, namely a Load Commands instruction, in an executable file corresponding to a program; obtaining a FUNCTION starting address table, namely LC_FUNCTION_ STARTS; and specifically obtaining the offset of the function starting address table in the executable file.
Wherein, a FUNCTION start address table is defined by lc_function_ STARTS, so that debugger and other programs can easily see whether an address is in the FUNCTION. The code segment corresponding to the objective function can be visually displayed by acquiring the function starting address table.
S120, decoding the acquired function starting address table to obtain the starting positions and the occupied byte numbers of all the functions in the executable file.
Further, uleb codes are used for decoding the acquired function start address table.
Specifically, the offset of the lc_function_ STARTS segment in the executable file obtained from the executable file is decoded as a uleb encoded value, so as to obtain the starting position and the number of bytes occupied of the FUNCTION in lc_function_ STARTS, and the starting position and the number of bytes occupied of all the FUNCTIONs are stored in the local data.
Wherein uleb codes are used to solve the problem of waste of the space occupied by the shaping values, and are commonly used in Dalvik virtual machines to represent 32-bit shaping values.
S130, reading the initial position and the byte number corresponding to the objective function from the initial positions and the occupied byte number of all functions.
Specifically, the number of bytes corresponding to the objective function indicates the size of the function and the length of the function.
In one embodiment, as shown in fig. 3, the step S200 specifically includes:
S210, performing CRC processing on data in a section where the objective function is located before the executable file runs, and obtaining a first frame value.
Specifically, data of a code segment corresponding to the objective function is read, CRC processing is carried out on the data, and a first frame value is obtained and recorded in local data.
S220, performing CRC processing on the data in the interval where the objective function is located during the running of the executable file to obtain a second frame value.
And during the running of the program, reading the data of the code segment where the corresponding objective function is located in the program memory, performing CRC processing on the data read in the memory, obtaining a second frame value and recording the second frame value.
S230, judging whether the first frame value and the second frame value are equal.
By comparing the obtained second frame value with the first frame value stored in the local data, it can be detected whether the objective function is debugged.
In a specific embodiment, as shown in fig. 4, after the step S200, the method further includes:
S410, detecting whether a breakpoint mark exists in the interval where the objective function is located.
S420, if a breakpoint mark exists and the obtained frame value changes, judging that the objective function is debugged.
Specifically, the function added with the debugging has a breakpoint, the breakpoint position is inserted with 'fedeffe 7' as a mark, and the position of the debugged function can be known by detecting the breakpoint.
In a specific embodiment, as shown in fig. 5, after the step S410, the method further includes:
s430, if the breakpoint mark does not exist, but the obtained frame value is changed, judging that the data content in the objective function is tampered.
Specifically, by comparing the first frame value and the second frame value corresponding to the objective function, it can be detected whether the code segment corresponding to the objective function is abnormal, and certainly, the abnormality is not limited to debugging of the objective function, but may be other abnormalities in the running process of the program, and if the abnormality exists, the content of the code segment corresponding to the objective function is tampered.
Of course, the processing procedure of tampering with the objective function is further included after the step S430, which may be implemented by terminating the program operation, detecting the objective function data content, etc., which will not be described in detail herein.
In one embodiment, as shown in fig. 6, after the step S300, the method includes:
s500, controlling the executable file to exit from running. Namely, the program exits from running, so that the target function can be effectively prevented from being dynamically debugged, and the safety of the running environment of the program is protected.
Of course, the step S500 may be replaced by the step S510:
S510, reporting the detected result of the debugged objective function. Specifically, the information can be directly reported and fed back to the user terminal, and warning and reminding can be performed through a connected warning device, and various specific modes are available and are not exemplified here.
The present invention also provides a system, as shown in fig. 7, wherein the system comprises a memory 20, and one or more programs, wherein the one or more programs are stored in the memory 20, and configured to be executed by the one or more processors 10, the one or more programs comprising a method for executing the detection of an object function being debugged as described above; as described in detail above.
The present invention also provides a storage medium storing a computer program executable for implementing the method of detecting that an objective function is debugged as described above; as described in detail above.
In summary, the method, system and storage medium for detecting that an objective function is debugged disclosed in the present invention, where the method includes: acquiring the initial position and byte number of an objective function in an executable file; CRC processing is carried out on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and whether the obtained frame values change or not is judged; if the change occurs, it is determined that the objective function is debugged. The CRC processing is respectively carried out on the objective function before and after the program is operated, whether the objective function is debugged or not can be visually reflected by comparing the changes of the frame values before and after the program is operated, so that the objective function can be protected, and the safety of the system operation is improved.
It is to be understood that the invention is not limited in its application to the examples described above, but is capable of modification and variation in light of the above teachings by those skilled in the art, and that all such modifications and variations are intended to be included within the scope of the appended claims.
Claims (6)
1. A method for detecting that an objective function is debugged, the method is based on an IOS system, the method is used for detecting whether the objective function is in a debugging state, and a user executes subsequent corresponding measures according to the debugging state of the objective function; characterized by comprising the following steps:
Acquiring the initial position and byte number of an objective function in an executable file;
CRC processing is carried out on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and whether the obtained frame values change or not is judged;
if the change occurs, judging that the objective function is debugged;
The method comprises the steps of performing CRC processing on an objective function before and after running an executable file to obtain frame values before and after running the executable file, and judging whether the obtained frame values change or not, and specifically comprises the following steps:
Before the executable file runs, CRC processing is carried out on data in an interval where an objective function is located, and a first frame value is obtained;
during the running of the executable file, performing CRC processing on the data in the interval where the objective function is located to obtain a second frame value;
Judging whether the first frame value is equal to the second frame value;
Performing CRC processing on the objective function before and after the running of the executable file to obtain frame values before and after the running of the executable file, and judging whether the obtained frame values change or not, wherein the method further comprises the following steps:
detecting whether a breakpoint mark exists in an interval where the objective function is located;
If the breakpoint mark exists and the obtained frame value changes, judging that the objective function is debugged;
if the breakpoint mark does not exist, but the obtained frame value is changed, judging that the data content in the objective function is tampered.
2. The method for detecting an object function being debugged according to claim 1, wherein the obtaining the starting position and the byte number of the object function in the executable file specifically comprises:
Acquiring a function starting address table in an executable file;
Decoding the acquired function starting address table to obtain the starting positions and the occupied byte numbers of all functions in the executable file;
and reading the initial position and the byte number corresponding to the objective function from the initial positions and the byte number occupied by all the functions.
3. The method for detecting the debugging of an objective function according to claim 2, wherein decoding the obtained function start address table uses uleb codes.
4. The method for detecting the debugging of the objective function according to claim 1, wherein if the change occurs, determining that the objective function is debugged, then comprises:
Controlling the executable file to exit from running;
Or reporting the detected result of the debugged target function.
5. A system for detecting that an objective function is debugged, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising a method for performing the detecting that an objective function is debugged according to any of claims 1-4.
6. A storage medium storing a computer program executable for implementing a method of detecting that an objective function is debugged according to any one of claims 1-4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010847715.6A CN112052165B (en) | 2020-08-21 | 2020-08-21 | Method, system and storage medium for detecting target function debugged |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010847715.6A CN112052165B (en) | 2020-08-21 | 2020-08-21 | Method, system and storage medium for detecting target function debugged |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112052165A CN112052165A (en) | 2020-12-08 |
| CN112052165B true CN112052165B (en) | 2024-04-26 |
Family
ID=73599628
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010847715.6A Active CN112052165B (en) | 2020-08-21 | 2020-08-21 | Method, system and storage medium for detecting target function debugged |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112052165B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112527677B (en) * | 2020-12-23 | 2021-09-24 | 北京深思数盾科技股份有限公司 | Application program protection method and electronic equipment |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103116714A (en) * | 2013-03-01 | 2013-05-22 | 中标软件有限公司 | Double-process protection method for executable files of Windows platform |
| CN104572425A (en) * | 2013-10-12 | 2015-04-29 | 上海海尔集成电路有限公司 | Program debugging method, device and system |
| US20170039131A1 (en) * | 2015-08-04 | 2017-02-09 | International Business Machines Corporation | Enhancing the debugger stack with recently reported errors under debug |
| CN108491736A (en) * | 2018-04-02 | 2018-09-04 | 北京顶象技术有限公司 | Distort monitoring method and device |
| CN109902488A (en) * | 2019-02-27 | 2019-06-18 | 北京智游网安科技有限公司 | APP tampering detection processing method, iOS device and storage medium |
| CN110321674A (en) * | 2019-07-12 | 2019-10-11 | 北京智游网安科技有限公司 | A kind of anti-tune method for testing, intelligent terminal and storage medium based on shell script |
-
2020
- 2020-08-21 CN CN202010847715.6A patent/CN112052165B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103116714A (en) * | 2013-03-01 | 2013-05-22 | 中标软件有限公司 | Double-process protection method for executable files of Windows platform |
| CN104572425A (en) * | 2013-10-12 | 2015-04-29 | 上海海尔集成电路有限公司 | Program debugging method, device and system |
| US20170039131A1 (en) * | 2015-08-04 | 2017-02-09 | International Business Machines Corporation | Enhancing the debugger stack with recently reported errors under debug |
| CN108491736A (en) * | 2018-04-02 | 2018-09-04 | 北京顶象技术有限公司 | Distort monitoring method and device |
| CN109902488A (en) * | 2019-02-27 | 2019-06-18 | 北京智游网安科技有限公司 | APP tampering detection processing method, iOS device and storage medium |
| CN110321674A (en) * | 2019-07-12 | 2019-10-11 | 北京智游网安科技有限公司 | A kind of anti-tune method for testing, intelligent terminal and storage medium based on shell script |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112052165A (en) | 2020-12-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108021791B (en) | Data protection method and device | |
| CN112634973A (en) | Data rereading method and system of storage medium, terminal device and storage medium | |
| CN110837429A (en) | Intelligent repairing method and device for online codes of web terminal | |
| CN112052165B (en) | Method, system and storage medium for detecting target function debugged | |
| CN108959915B (en) | Rootkit detection method, rootkit detection device and server | |
| CN119127309B (en) | Instruction processing system and instruction processing method | |
| CN112199642A (en) | Detection method for anti-debugging of android system, mobile terminal and storage medium | |
| CN112527660B (en) | Static detection method and device for codes | |
| CN113900914B (en) | Exception handling method, device, electronic device and computer storage medium | |
| CN107145422B (en) | A software fault alarm monitoring method | |
| WO2007086150A1 (en) | Memory destruction detection method and device | |
| CN115756935A (en) | Abnormal fault positioning method, device and equipment of embedded software system | |
| CN111625784B (en) | Anti-debugging method of application, related device and storage medium | |
| CN116155934A (en) | Method, device, electronic device and storage medium for smart contract calling ledger | |
| CN117055928B (en) | Method and device for detecting firmware errors of electronic speed regulator of target model airplane | |
| CN117930797A (en) | Method for executing a swiping operation in an electronic control unit, processor and vehicle | |
| CN105183552A (en) | System for positioning potential interruption safety hazard in operation system and application of system | |
| CN115391232B (en) | Program data stream diagnosis method, device and equipment | |
| CN119988179B (en) | Method and device for detecting bit shift of key function code segment of relay protection device | |
| CN116225784B (en) | Application program guide backup method, single chip microcomputer and computer readable storage medium | |
| CN116861406B (en) | A hybrid granularity dynamic trusted chain measurement method and system based on call sequence | |
| CN111552960B (en) | A dynamic measurement method and device for program integrity | |
| CN114416517B (en) | Protection and diagnosis method and device for embedded multi-core processor | |
| CN112181761B (en) | Program execution control method, program execution test device, code detection device, program execution equipment and medium | |
| CN118227486A (en) | Release version debugging method, release version debugging device, electronic device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |