A method and device for finding an abnormal function

Abstract

The embodiments of the invention provide an abnormal function search method and device. The method comprises the steps of obtaining at least one dynamic link library (DLL) file under one catalogue; separately loading the at least one DLL file; obtaining the relevant data of the at least one DLL file, wherein the relevant data include at least one first derivative function corresponding to the at least one DLL file; obtaining the function address corresponding to the at least one first derivative function according to the at least one first derivative function; according to the function address corresponding to the at least one first derivative function, determining abnormal derivative functions from the at least one first derivative function. According to the embodiments, the abnormal derivative function search efficiency is increased.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for finding abnormal functions. Background technique [0002] With the continuous development of computer technology, there are more and more system versions of user equipment, such as Windows xp, Vista, Windows 7, Windows 10 and so on. In the Windows system, many application programs are not a complete executable file, but are divided into some relatively independent DLL (Dynamic Link Library, dynamic link library) files and placed in the system. At present, each system has some public DLL files, such as ntdll.dll, shell32.dll, KERNEL32.dll and other files, and each DLL file has its own export function, which is used to load the DLL file to the process call. Due to the large number of current system versions, the public DLL files corresponding to different systems may be different. Some new export functions on the new version system do not exist on the old...

AI Technical Summary

Problems solved by technology

Due to the large number of current system versions, the public DLL files corresponding to different systems may be different. Some new export functions on the new version system do not exist on the old version system. If you use the new version system directly or indirectly on the old version system When the above function, it will cause the program to crash

However, when there are too many exception export functions that cause the program to crash, it will take a lot of time to find all the exception export functions through records one by one, which makes the search efficiency low

Images