File handle closuring operation method and device

Abstract

The invention provides a file handle closuring operation method and a file handle closuring operation device. The file handle closuring operation method comprises the following steps of: acquiring a file handle closuring operation request initiated by an invoker, wherein the request comprises handle information to be closed; under the condition that a current operating system platform is supported, according to the handle information to be closed, acquiring object information to be closed; when an object to be closed has a corresponding new object type, replacing the original object type of the object with the new object type; invoking a Native API (application program interface) of a handle closing routine, extracting a callback routine from the new object type, and invoking the callback routine; and establishing an I/O (input/output) request packet inside the callback routine, sending the I/O request packet to file system lower equipment, and finishing file handle closuring operation by the file system lower equipment. The file handle closuring operation method and the file handle closuring operation device can enhance the offensive and defensive confrontation ability to a driver-stage malicious program and avoid potential possibility of incompatibility between security software due to handle closing operation interference.

Description

technical field [0001] The invention relates to the technical field of operating system security processing, in particular to a method for closing a file handle and a device for closing a file handle. Background technique [0002] When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. [0003] Compared with active behavior processes such as file creation, opening, reading and writing, setting, and deletion, the file handle closing operation (CloseHandle) in the Windows operating system is passively triggered in many cas...

AI Technical Summary

Problems solved by technology

Due to the inability to actively control the timing of the call, one security software will intercept the passive trigger request of another security software during the process of closing the handle, which will cause alarm conflicts. This type of interference is also one of the root causes of incompatibility between security software. one

In addition, when security software conducts kernel attack and defense with driver-level malicious programs, i...

Images