Execution method and device for registry operation

Abstract

The invention provides an execution method for registry operation, which comprises the steps that a registry operation request is acquired, wherein the request comprises a caller input parameter; kernel executing logics of a registry are set according to the caller input parameter, wherein the kernel executing logics include a tampering point detecting and restoring logic and a registry function calling logic; the tampering point detecting and restoring logic is executed, more specifically, a preset kernel executing flow tampering point is detected, and the original value of the kernel executing flow tampering point is restored when the original value of the kernel executing flow tampering point is changed; and a corresponding registry function is called by the registry function calling logic. According to the method and the device disclosed by the invention, the counterforce of defending a driving stage malicious program can be enhanced, and potential possibility of incompatibility of security software caused by registry operation interference is avoided.

Description

technical field [0001] The invention relates to the technical field of operating system penetration, in particular to a registry operation execution method and a registry operation execution device. Background technique [0002] When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. For example, when security software operates (creates, opens, enumerates, reads and writes, deletes, etc.) the registry key values ​​of itself, the system, or malicious programs, it often hopes that the access process is authentic and credib...

AI Technical Summary

Problems solved by technology

[0015] Although traditional security software vendors are aware of the possibility of various registry operations being hijacked, most of the existing solutions only consider the hijacking risk of the user state of the operating system, and the attack and defense of the kernel state of the operating system often show a more obvious Lack of capability, weak against driver-level malicious programs (Rootkit)

[0016] Therefore, a technical problem that needs to be urgently solved by those skilled in the art is: to propose an execution mechanism for registry operations to enhance the ability to resist attacks and defenses against driver-level malicious programs, and to avoid interference between security software due to registry operation interference. potential for incompatibility

Images