Summary of the invention
The purpose of the embodiment of the invention is to provide a kind of detection method of software modification, is intended to solve prior art the modification of software source code is detected, and can not truly reflect modification and the lower problem of detection efficiency that software is made.
The embodiment of the invention is achieved in that a kind of detection method of software modification, and described method comprises the steps:
From first symbol table information of revising the back executable file, obtain title, size and the position of each symbol that this first symbol table information comprises;
Obtain title, size and the position of each symbol that this second symbol table information comprises in second symbol table information before revise the executable file;
Title, size and the position of each symbol that first symbol table information is comprised and title, size and the position of each symbol that second symbol table information comprises compare, and detect symbol and revise information;
Described symbol comprises variable and function, and described executable file is for can carry out the link formatted file.
Another purpose of the embodiment of the invention is to provide a kind of pick-up unit of software modification, and described device comprises:
The first symbol table information acquiring unit is used for the title, size and the position that obtain each symbol that this first symbol table information comprises from first symbol table information of revising the back executable file;
The second symbol table information acquiring unit is used for obtaining second symbol table information of executable file before revise title, size and the position of each symbol that this second symbol table information comprises;
Detecting unit is used for title, size and the position of each symbol that first symbol table information is comprised and title, size and the position of each symbol that second symbol table information comprises and compares, and detects symbol and revises information;
Described symbol comprises variable and function, and described executable file is for can carry out the link formatted file.
Another purpose of the embodiment of the invention is to provide a kind of electronic equipment that comprises above-mentioned software modification pick-up unit.
In embodiments of the present invention, analyze comparison by the executable file that directly compiling, link back is generated, can truly reflect the modification that software is made, prevent from really not to be reflected in the software that is provided after the modification because of the source code that compiling, the variety of issue of link process appearance cause software to be revised.And, do not need executable file is carried out dis-assembling, do not need to use text relatively, weak point consuming time, efficient height.
Embodiment
In order to make purpose of the present invention, technical scheme and advantage clearer,, the present invention is further elaborated below in conjunction with drawings and Examples.Should be appreciated that specific embodiment described herein only in order to explanation the present invention, and be not used in qualification the present invention.
The embodiment of the invention is directly analyzed comparison to the executable file that compiling, link back generate, can truly reflect the modification that software is made, prevent from really not to be reflected in the software that is provided after the modification because of the source code that the variety of issue that compiles, link process occurs causes software to be revised; And do not need executable file is carried out dis-assembling, do not need to use text relatively, weak point consuming time, efficient height.
For technical solutions according to the invention are described, describe below by specific embodiment.
Embodiment one:
Fig. 1 shows the realization flow of the software modification detection method that first embodiment of the invention provides, and details are as follows:
In step S101, from first symbol table information of revising the back executable file, obtain title, size and the position of each symbol that this first symbol table information comprises.
In the present embodiment, by the executable file after the analysis modify, obtain and revise all symbol table informations in the executable file of back.Wherein, described executable file is including, but not limited to carrying out link formatted file (ELF); Described symbol is function and variable, and described symbol table information comprises title, position (address) and the size etc. of function and variable.
Below be an example that obtains the ELF symbol table information, but be not limited to this example:
typedef?struct
{
UINT32 st_name; // symbolic name
UINT32 st_value; // symbolic address
UINT32 st_size; // symbol size
UINT8 st_info; // sign pattern
UINT8 st_other; Other information of // symbol
UINT16 st_shndx; The pointer of // related symbol
}ELF_SYMBOL_HDR;
In step S102, obtain title, size and the position of each symbol that this second symbol table information comprises in second symbol table information before revise the executable file.
In the present embodiment, specifically as mentioned above, do not repeat them here.
In step S103, title, size and the position of each symbol that first symbol table information is comprised and title, size and the position of each symbol that second symbol table information comprises compare, and detect symbol and revise information.
In the present embodiment, the detailed process of symbol modification information detection is shown in Fig. 2,3,4.
Fig. 2 shows the testing process of symbol increase and decrease in the software modification detection method that first embodiment of the invention provides:
In step S201, travel through each symbol that described first symbol table information comprises, whether the designation of judging each symbol that described first symbol table information comprises is present in second symbol table information, when described designation is not present in second symbol table information, then described symbol is exported described newly-increased symbolic information for newly-increased symbol;
In step S202, travel through each symbol that described second symbol table information comprises, whether the designation of judging each symbol that described second symbol table information comprises is present in first symbol table information, when described designation is not present in first symbol table information, then described symbol is a delete mark in first symbol table information, exports described delete mark information.
In the present embodiment, the symbolic information of the increase of output or deletion comprises designation, size and address etc.
Fig. 3 shows the testing process of symbol size in the software modification detection method that first embodiment of the invention provides:
In step S301, travel through each symbol that described first symbol table information comprises.
In the present embodiment, described symbol also is present in second symbol table information.
In step S302, the size of this symbol in the described symbol size and second symbol table information is compared.
In the present embodiment,, the size of this symbol in the described symbol size and second symbol table information is compared, when described symbol size changes, export the information of described symbol according to the symbol size of obtaining in the symbol table information.
In step S303, the symbolic information that the output size changes.
In the present embodiment, the big or small altered symbolic information of output comprises designation, size and address etc.
Fig. 4 shows the testing process of operational code and operand in the software modification detection method that first embodiment of the invention provides:
In step S401,, obtain the operational code and the operand of described symbol according to the position of symbol in the symbol table information;
In the present embodiment, operational code refers to operational order, is generally machine language program, determines the operation of wanting computing machine to finish by this operational order; Operand refers to participate in the data of operation and the element address at place thereof.
In step S402, travel through each symbol in described first symbol table information;
In the present embodiment, described symbol also is present in second symbol table information.
In step S403, the operational code and/or the operand of this symbol in the operational code of described symbol and/or the operand and second symbol table information compared;
In step S404, the symbolic information that output function sign indicating number and/or operand change.
As a preferred embodiment of the present invention, position according to symbol in the symbol table information, obtain the operational code and the operand of described symbol, by before relatively revising and amended operational code and operand come the modification that reflects that more accurately, really software is made.The difference of executable file before and after relatively revising can be judged by increase, deletion or the change of symbol in the executable file symbol table information.Because described symbol comprises variable and function,, only need to judge that executable file is revised the size of front and back variable and whether the value of variable changes for the modification of variable.But for the modification of function, owing to there be calling mutually between function, so the modification of certain function may cause its address of unmodified function to change, and the content that the change of address also can cause this function with revise the different of preceding software.Therefore, judgement for the function modification, after having judged that executable file is revised the size of front and back function, also need position according to symbol in the symbol table information, obtain the operational code and the operand of described symbol, by operational code and/or the operand before and after relatively executable file is revised, judge whether described function is modified, wherein, the modification of described function comprises the modification of the modification of this function operational code and this function call function (corresponding operand), and the modification of call function can be judged by whether this pairing function name in call function address relatively is identical.When the operational code of described symbol and/or operand change, illustrate that this function is modified, export this function information, described information comprises function name, size and address etc.
The embodiment of the invention not only compares executable file symbol table information before and after revising, also obtain the operational code and the operand title of symbol by this symbol table information, according to operational code and operand title to recently reflecting the modification that software is made more accurately, really, whether met expection effective foundation be provided by the software developer makes an amendment software.
Embodiment two:
Fig. 5 shows the structure of the software modification pick-up unit that second embodiment of the invention provides, and for convenience of explanation, only shows the part relevant with the embodiment of the invention.
This software modification pick-up unit can be used for various needs and carry out the electronic equipment that software modification detects, can be to run on the unit that software unit, hardware cell or software and hardware in these electronic equipments combine, also can be used as independently, suspension member be integrated in these electronic equipments.
This software modification pick-up unit comprises the first symbol table information acquiring unit 51, the second symbol table information acquiring unit 52 and detecting unit 53.Wherein, the concrete function of each unit is as follows:
The first symbol table information acquiring unit 51 obtains title, size and the position of each symbol that this first symbol table information comprises from first symbol table information of revising the back executable file.
In the present embodiment, by the executable file after the analysis modify, obtain and revise all symbol table informations in the executable file of back.Wherein, described executable file is including, but not limited to carrying out link formatted file (ELF); Described symbol is function and variable, and described symbol table information comprises title, position (address) and the size etc. of function and variable.
The second symbol table information acquiring unit 52 obtains title, size and the position of each symbol that this second symbol table information comprises before revise in second symbol table information the executable file.
Title, size and the position of each symbol that detecting unit 53 comprises first symbol table information and title, size and the position of each symbol that second symbol table information comprises compare, and detect symbol and revise information.Wherein, detecting unit 53 comprises newly-increased symbolic information detection module 531, delete mark information detection module 532, spider module 533, first comparison module 534, first output module 535, operational code and operand acquisition module 536, second comparison module 537 and second output module 538 again, and the concrete function of each module is as follows:
Newly-increased symbolic information detection module 531, be used to travel through each symbol that described first symbol table information comprises, whether the designation of judging each symbol that described first symbol table information comprises is present in second symbol table information, when described designation is not present in second symbol table information, then described symbol is exported described newly-increased symbolic information for newly-increased symbol;
Delete mark information detection module 532, be used to travel through each symbol that described second symbol table information comprises, whether the designation of judging each symbol that described second symbol table information comprises is present in first symbol table information, when described designation is not present in first symbol table information, then described symbol is a delete mark in first symbol table information, exports described delete mark information.
Spider module 533 is used to travel through each symbol that described first symbol table information comprises;
First comparison module 534 is used for the size of described symbol size and second this symbol of symbol table information is compared;
First output module 535 is used to export the symbolic information that size changes.
Operational code and operand acquisition module 536 are used for the position according to the symbol table information symbol, obtain the operational code and the operand of described symbol; And, compare by the operational code and/or the operand of second comparison module 537 simultaneously this symbol in the operational code of described symbol and/or the operand and second symbol table information by each symbol in described first symbol table information of spider module 533 traversal;
Second output module 538 is used for the symbolic information that output function sign indicating number and/or operand change.
In the present embodiment, whether the modification information of being done by each output module output software is met expection effective foundation is provided by the software developer makes an amendment software.
The embodiment of the invention is directly analyzed comparison to the executable file that compiling, link back generate, can truly reflect the modification that software is made, prevent from really not to be reflected in the software that is provided after the modification because of the source code that the variety of issue that compiles, link process occurs causes software to be revised; And do not need executable file is carried out dis-assembling, do not need to use text relatively, weak point consuming time, efficient height.In addition, the embodiment of the invention not only compares executable file symbol table information before and after revising, also obtain the operational code and the operand title of symbol by this symbol table information, according to operational code and operand title to recently reflecting the modification that software is made more accurately, really, whether met expection effective foundation be provided by the software developer makes an amendment software.
The above only is preferred embodiment of the present invention, not in order to restriction the present invention, all any modifications of being done within the spirit and principles in the present invention, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.