Running protection method for computer software product

Abstract

The invention discloses a running protection method for a computer software product. The method comprises the following steps of: starting key service, injecting a process monitoring module in a system process when the key service is started for the first time, running the process monitoring module in a system process space, periodically checking whether the key service runs or not by using the process monitoring module, and restarting the key service if the key service is abnormally stopped; filtering file operation in a key directory according to configuration by using a file protection module, and if an application program outside the key directory performs deletion operation on the file in the key directory, stopping the operation; if a file operation process is in the key directory, allowing the file operation of the file operation process; and when a user executes unloading operation, judging whether the actual software unloading operation of the user is allowed or not according to whether an unloading password input by the user is correct or not by using an unloading protection module. According to the running protection method for the computer software product, a full software self-protection function can be realized.

Description

【Technical field】 [0001] The invention relates to the field of computer software, in particular to a method for protecting the operation of computer software products. 【Background technique】 [0002] Some key processes and software in the computer software system are to ensure the safe and reliable operation of the system. In order to prevent these key processes and software from being maliciously terminated, uninstalled, and related configurations tampered with, it is necessary to protect key programs, key files, and configurations in software products. , Prevent key programs from being closed abnormally, key files from being deleted abnormally, and key configurations from being tampered with. However, the Windows system does not provide a corresponding standard protection mechanism, and each application needs to be developed according to its own requirements. [0003] At present, most software protects key processes in the following ways: [0004] 1. It is only allowed t...

AI Technical Summary

Problems solved by technology

It uses Hook technology to filter the "end process" Windows API calls for key processes, allowing the execution of process end operations initiated by "task manager", and "end process" for key processes initiated by other applications operation, returns the specified error (such as no operation permission) after interception, and no longer executes the actual operation of ending the process. This method has the following defects: a. Since the process can still be terminated in the task manager, it is still It is impossible to prevent the program from being terminated maliciously; b. It is impossible to deal with the problem of the end of the process caused by the internal exception of the program

This approach is aimed at the acquisition of the "process handle" that must be relied upon to "end the process". Through the Hook operation, third-party programs are prevented from obtaining the handle of the key process through the "open process" Windows API, thereby preventing third-party applications from obtaining The "end process" operation after the handle of the process has the following disadvantages: a. The application program can write a way to enumerate the current system process handle to obtain a specific process handle, thereby bypassing this method; b. For programs such as antivirus software, it may be mistaken for the existence of the process because it cannot be opened for virus scanning risk

This method has the following disadvantages: many virus programs use this method for self-protection, so this protection method may be falsely reported as a virus by antivirus software

[0008] 1. Back up the key files. Once a problem is found, restore the file from the backup location. This method has the following disadvantages: a. If the file in the backup location is also deleted, the recovery operation cannot be performed

b. If the backup file is not updated in time when the configuration is updated, there will be a problem of loss of configuration information after recovery

[0009] 2. Perform Hook interception and filtering on all file operations in the system. If the operation on key files does not meet the filtering conditions, it will be blocked. This method has the following disadvantages: file read and write operations that operate on non-key files must also be intercepted , there is a problem of processing efficiency

Images