A method, device and electronic equipment for processing thread registration

Abstract

The embodiment of the invention discloses a processing thread register method and device and an electronic device and relates to the technology of information safety. Safety protection efficiency can be improved. The method includes the steps that when a pre-injected hook function monitors that a kernel drive-stage user callback double-parameter function is called, the function is hooked; current operation system version information is obtained, and function index number information transmitted by the function is called; if the current operation system version information and the transmitted function index number information are matched with an operation system version information / function index number information set mapped by a preset system thread, process information for calling the kernel drive-stage user callback double-parameter function is obtained; if an obtained application mapped by the process information is the same with any to-be-intercepted application in a preset to-be-intercepted application feature library, calling of the kernel drive-stage user callback double-parameter function is refused. The processing thread register method is suitable for processing thread register.

Description

technical field [0001] The invention relates to information security technology, in particular to a method, device and electronic equipment for processing thread registration. Background technique [0002] With the gradual disclosure of the technical details of the kernel layer of the operating system, more and more malicious applications (APP, Application) such as Trojan horses have begun to use kernel layer drivers to protect their own processes or threads. Malicious applications protected by kernel layer drivers The process or thread of the application program can manipulate the application program corresponding to other processes or threads in the operating system, so that the process of the malicious application program can conduct malicious attacks on other processes or threads according to the intention of the malicious application program provider, which may cause The operation of the computer is unstable, and even the leakage of user information is caused. For exam...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the embodiments of the present invention provide a method, device, and electronic device for processing thread registration, which can improve the security protection efficiency of the operating system, so as to solve the problem that in the existing method for processing thread registration, the kernel NtUserCallTwoParam function can be called directly To register the target thread as a system thread, the security protection efficiency of the operating system is low

Images