Interception method and device applied to dynamic library API (Application Program Interface) in Linux system

Abstract

The invention discloses an interception method and device applied to a dynamic library API (Application Program Interface) in a Linux system. The method comprises: acquiring APIs and hook functions, which are called by dynamic library services to be performed; finding the corresponding APIs from a pre-set double-grade interception mapping table according to the APIs; hooking the hook functions and primitive functions of the APIs; replacing the primitive functions by the hook functions to perform the dynamic library services; after the dynamic library services are performed, unhooking the APIs and recovering the primitive functions. According to the interception method provided by the invention, the double-grade interception mapping table is utilized and a correlation relation of the APIs called by the different dynamic library services and corresponding ELF (Executable and Linkable Format) files thereof, the hook functions and the primitive functions is established; a plurality of API calling records can be inserted into the mapping table according to the difference of the hook functions; when the dynamic library services are performed, the APIs are recovered to the primitive functions according to the calling records and the different dynamic library services can conveniently and repeatedly call the same API for a plurality of times.

Description

technical field [0001] The invention relates to the technical field of computer API interception, in particular to an interception method and device applied to a dynamic library API in a Linux system. Background technique [0002] In order to realize the debugging of computer applications and expand the original functions, the existing computing technology generally adopts hook technology to intercept the calls of different APIs. There are many technologies for intercepting APIs, which are roughly divided into user layer and kernel layer interception. , among them, for the user-level interception technology, it is generally to directly modify the memory and program flow of the API to be intercepted, so that the program jumps to the specified address for execution, and then returns to the original address. However, in the above-mentioned interception method, because the hook functions executed by the same API called by different dynamic library services are different, when a ...

AI Technical Summary

Problems solved by technology

However, in the above-mentioned interception method, because the hook functions executed by the same API called by different dynamic library services are different, when a certain called API has not completed the corresponding dynamic library service, other dynamic libraries that also need to call the instruction The service must be delayed and executed later, and repeated hooking and unhooking operations on the same API cannot be supported.

Images