Method, device and equipment for acquiring executable file in memory and storage medium

Abstract

The invention discloses a method for obtaining an executable file in a memory, and the method comprises the following steps: starting a target task file in a pre-built virtual environment, wherein a virtual memory of the virtual environment has an unexecutable permission; and in the running process of the target task file, if it is monitored that the executable file is executed in the virtual memory, obtaining the executable file, and further analyzing the executable file. The technical scheme provided by the embodiment of the invention is applied; according to the method, the virtual memory of the virtual environment is set to be the non-executable permission, so that the executable file can be monitored in time when the executable file is executed in the virtual memory, the executable file can be obtained in time, the executable file can be further analyzed, a basis is provided for expansion of a virus knowledge base, and the security defense capability is enhanced. The invention further discloses a device and equipment for obtaining the executable file in the memory and a storage medium, and the corresponding technical effects are achieved.

Description

technical field [0001] The present application relates to the technical field of computer applications, and in particular to a method, device, device and storage medium for obtaining executable files in memory. Background technique [0002] In daily work and life, the use of mobile phones, computers and other equipment is becoming more and more common. With the rapid development of computer technology and Internet technology, these devices are more and more likely to be infected with viruses. Viruses will affect the normal use of devices and the security of files and data in devices. This requires antivirus software to scan and kill viruses to ensure the security of files and data in the device. [0003] When antivirus software scans and kills viruses, it usually matches the fingerprint features of suspicious files with the pre-obtained virus signature database to determine whether the suspicious files are malicious files, and further process them according to the determina...

AI Technical Summary

Problems solved by technology

However, because these encrypted malicious executable files will not land on the device, antivirus software cannot detect them, and cannot obtain the corresponding fingerprint features. Even if these malicious executable files land on the device, because the virus signature database There is no corresponding fingerprint feature in the file, and the antivirus software still cannot confirm that it is a malicious file, so it cannot detect and kill it.

Images