Method, device and electronic equipment for processing process registration

Abstract

The embodiment of the invention discloses a course register processing method and device and electronic equipment and relates to information security technology. By the adoption of the course register processing method and device and the electronic equipment, safety protection efficiency can be improved. The method comprises the steps of hooking a kernel driver stage user callback two-parameter function when the calling of the function is monitored by a hook function which is injected in advance, obtaining the version information of a current operation system and function index number information introduced by calling of the function, obtaining the course information of calling the kernel driver stage user callback two-parameter function if the version information of the current operation system and the introduced function index number information are matched with an operation system version information / function index number information set mapped by a preset login course, and refusing the calling of the kernel driver stage user callback two-parameter function if an application mapped by the acquired course information is identical with any one application needing to be intercepted in a preset intercept-required application feature library. The method and device are suitable for course register processing.

Description

technical field [0001] The invention relates to information security technology, in particular to a method, device and electronic equipment for processing process registration. Background technique [0002] With the gradual disclosure of the technical details of the kernel layer of the operating system, more and more malicious applications such as Trojan horses have begun to use kernel layer drivers to protect their own processes, and the processes of malicious applications protected by kernel layer drivers can be terminated. (Kill) other processes in the operating system, so that the malicious application process can maliciously attack the user's process or system process according to the intention of the malicious application provider, which may cause the computer to run unstable, and even cause user information leak. For example, in the operating system, the registration login process function (RegisterLogonProcess function) of the application layer is provided, which is...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the embodiments of the present invention provide a method, device, and electronic device for processing process registration, which can improve the security protection efficiency of the operating system, so as to solve the problem that in the existing method for processing process registration, the kernel NtUserCallTwoParam function can be called directly To register the process as a login process, the security protection efficiency of the operating system is low

Images