Method and device for carrying out file operation

Abstract

Provided in the present application is a method for executing a file operation, comprising: acquiring a file operation request, where the request comprises a caller input parameter, and the input parameter comprises a file path; searching for a file object parsing routine in an object manager on the basis of the file path; if a corresponding file object parsing routine is found, then generating an I / O request packet on the basis of the file object parsing routine, and transmitting to an original address of a preconfigured file system low-level device. The present application improves the resistive capability against offence and defense of driver-level malicious programs, and prevents the potential possibility of incompatibility between security software caused by interference from file operation.

Description

technical field [0001] The present invention relates to the technical field of file penetration, in particular to a file operation execution method and a file operation execution device. Background technique [0002] When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. Taking the design of the file system as an example, the hierarchical structure of the file call stack determines the risk of data flow tampering on the call chain. Because of this, ensuring the authenticity and credibility of its own file operation pro...

AI Technical Summary

Problems solved by technology

[0014] Although traditional security software vendors are aware of the possibility of various file operation calls being hijacked, most of the existing solutions only consider the hijacking risk of the operating system user state, and often show a certain lack of capability in the attack and defense of the operating system kernel state , driver-level malware (Rootkit) is weak against

[0015] Therefore, a technical problem that needs to be urgently solved by those skilled in the art is to propose a processing mechanism for file penetration operations, which not only provides attack and defense in the user state of the operating system, but also provides attack and defense in the kernel state of the operating system to enhance and drive Anti-attack and defense capabilities against malicious programs, and avoid the potential for incompatibility between security software due to file operation interference

Images