A processing method, device and electronic equipment for copying information

Abstract

The embodiment of the invention discloses a duplicating information processing method and device, and electronic equipment, relates to the technology of information safety, and can improve the safety protection efficiency of an operating system. The method comprises the following steps: when the calling of a kernel DuplicateHandle object function is monitored in a pre-injected hook function, hooking the kernel DuplicateHandle object function; monitoring whether the kernel DuplicateHandle object function succeeds in duplicating a target process handle or not, and if the kernel DuplicateHandle object function succeeds in duplicating the target process handle, judging whether the target process handle which succeeds in duplicating is matched with any one protection process handle in a preset protection process handle library or not; if the target process handle which succeeds in duplicating is matched with any one protection process handle in the preset protection process handle library, obtaining the process path information of the target process handle which succeeds in duplicating, and extracting a to-be-verified application program mapped by the process path information; and if the extracted to-be-verified application program is the same with any one to-be-intercepted application program in a preset to-be-intercepted application program library, closing the target process handle which succeeds in duplicating. The duplicating information processing method and device is suitable for monitoring whether the target process handle is illegally duplicated or not.

Description

technical field [0001] The invention relates to information security technology, in particular to a processing method, device and electronic equipment for copying information. Background technique [0002] With the gradual disclosure of the technical details of the kernel layer of the operating system, more and more malicious applications such as Trojan horses have begun to use kernel layer drivers to protect their own processes, and the processes of malicious applications protected by kernel layer drivers can be terminated. (Kill) other processes in the operating system, so that the malicious application process can maliciously attack the user's process or system process according to the intention of the malicious application provider, which may cause the computer to run unstable, and even cause user information Leakage, bring very large economic losses to users. For example, in the operating system, the graphics management process (csrss.exe process) will save the handles...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the embodiments of the present invention provide a processing method, device, and electronic equipment for copying information, which can improve the security protection efficiency of the operating system, so as to solve the problem that in the existing processing method for copying information, it is possible to directly call the kernel handle to copy Object functions are used to control the target application, which leads to the problem of low security protection efficiency of the operating system

Images