Method and device for executing registry operation

Abstract

A method and device for executing a registry operation. The method comprises: acquiring a registry operation request, where the request comprises a caller input parameter (201); configuring on the basis of the caller input parameter a registry kernel execution logic, where the kernel execution logic comprises a tampering point check and repair logic and a registry function calling logic (202); executing the tampering point check and repair logic, specifically, checking a preconfigured kernel execution flow tempered point, and, when the original value of the kernel execution flow tampering point is modified, restoring the original value of the kernel execution flow tampering point (203); and employing the registry function calling logic for calling a corresponding registry function (204). The present solution improves the resistive capability against driver-level malicious programs, and prevents the potential possibility of incompatibility between security software caused by interference from registry operation.

Description

technical field [0001] The invention relates to the technical field of operating system penetration, in particular to a registry operation execution method and a registry operation execution device. Background technique [0002] When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. For example, when security software operates (creates, opens, enumerates, reads and writes, deletes, etc.) the registry key values ​​of itself, the system, or malicious programs, it often hopes that the access process is authentic and credib...

AI Technical Summary

Problems solved by technology

[0015] Although traditional security software vendors are aware of the possibility of various registry operations being hijacked, most of the existing solutions only consider the hijacking risk of the user state of the operating system, and the attack and defense of the kernel state of the operating system often show a more obvious Lack of capability, weak against driver-level malicious programs (Rootkit)

[0016] Therefore, a technical problem that needs to be urgently solved by those skilled in the art is: to propose an execution mechanism for registry operations to enhance the ability to resist attacks and defenses against driver-level malicious programs, and to avoid interference between security software due to registry operation interference. potential for incompatibility

Images