A file decryption method and related apparatus

Abstract

This invention provides a file decryption method and related equipment, belonging to the field of computer technology, to solve the problem of excessively long decryption time in existing file decryption processes. The method includes: obtaining file fragments from an encrypted file, wherein the file fragments are portions of encrypted data in the encrypted file; decrypting the file fragments by calling a decryption algorithm through a preset decryption interface to determine a target decryption algorithm corresponding to the encrypted file, wherein the preset decryption interface encapsulates at least one of the decryption algorithms used to decrypt the encrypted file; performing a decryption operation on the encrypted file according to the target decryption algorithm to obtain a decrypted file, and verifying the success of the decryption operation through a preset verification operation, wherein the preset verification operation involves transferring the decrypted file from system memory to a target program for verification; if successful, the encrypted file is determined to be decrypted.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a file decryption method and related apparatus. Background Technology

[0002] With increasing emphasis on security and privacy, people are increasingly inclined to encrypt important data and files. When users need to use this encrypted data, they first need to decrypt it.

[0003] Currently, decrypting encrypted files typically requires users to know the encryption algorithm or key. However, when users forget the algorithm used for encryption, or when files or data are encrypted by ransomware, it's often necessary to continuously try various algorithms to decrypt. In practice, decrypting files with unknown encryption algorithms generally requires constantly changing the decryption algorithm to decrypt the entire encrypted file and verifying the result. This means decrypting the entire encrypted file while verifying the result takes considerable time, especially when the encrypted file is large. Existing decryption methods become excessively time-consuming in such cases. Summary of the Invention

[0004] The purpose of this invention is to provide a file decryption method that can determine the target decryption algorithm that matches the encrypted file by decrypting file fragments. This achieves the effect of determining a suitable decryption algorithm based only on file fragments containing a portion of the encrypted file, thereby reducing the overall decryption operation time during decryption attempts. Furthermore, since the decrypted file is directly transferred from system memory to the target program for verification during the verification operation, the data transfer time when retrieving the decrypted file from the disk can be reduced, further reducing the operation time of the decryption process.

[0005] In a first aspect, the present invention provides a file decryption method comprising the following steps:

[0006] Obtain file fragments from the encrypted file, wherein the file fragments are portions of encrypted data in the encrypted file;

[0007] The file fragments are decrypted by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file. The preset decryption interface encapsulates at least one of the decryption algorithms used to decrypt the encrypted file.

[0008] The encrypted file is decrypted according to the target decryption algorithm to obtain the decrypted file. The decryption operation is then verified by a preset verification operation to determine whether the decryption operation was successful. The preset verification operation involves transferring the decrypted file from system memory to the target program for verification.

[0009] If successful, the encrypted file has been decrypted.

[0010] Optionally, obtaining file fragments from the encrypted file includes:

[0011] The data volume of the file fragments is determined based on the decryption data requirement and the file format data volume. The decryption data requirement is used to characterize the minimum data volume required by each decryption algorithm when performing the decryption operation, and the file format data volume is the maximum data volume among the data volumes in the file header used to characterize the data of the various file types.

[0012] The file fragments are obtained from the file header of the encrypted file based on the file fragment data volume.

[0013] Optionally, determining the data size of the file fragments based on the required amount of decrypted data and the file format data size includes:

[0014] If the file format data volume is less than the decryption data requirement, then the decryption data requirement is determined as the data volume of the file fragment;

[0015] If the file format data volume is greater than the decryption data requirement, then the target data volume is set to the data volume of the file fragment. The target data volume is greater than the file format data volume and is a minimum multiple of the decryption data requirement.

[0016] Optionally, the step of decrypting the file fragments by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file includes:

[0017] At least one of the aforementioned decryption algorithms is invoked through a preset decryption interface and added to a preset algorithm queue;

[0018] According to the priority of the decryption algorithm, the preset algorithm queue is sorted to obtain a decryption algorithm sequence. The priority of the decryption algorithm is determined according to a priority judgment strategy. The priority judgment strategy includes the execution time and execution record of each decryption algorithm. The execution record includes the number of successful decryption, the time of the last successful decryption, and the duration of the last failed decryption.

[0019] The file fragments are decrypted according to the decryption algorithm sequence, and the target decryption algorithm suitable for the encrypted file is determined.

[0020] Optionally, the step of performing a decryption operation on the encrypted file according to the target decryption algorithm, obtaining a decrypted file, and verifying whether the decryption operation was successfully performed through a preset verification operation includes:

[0021] The decrypted file in the system memory is transferred to the target program through a preset hook function. The target program is an opening program corresponding to the file type of the decrypted file. The preset hook function is pre-deployed in the target program to control the target program to perform the opening operation and obtain the operation result of the opening operation.

[0022] The operation result is obtained from the target program using the preset hook function. The operation result is obtained by the target program after performing an open operation on the decrypted file.

[0023] Verify whether the decryption operation was successfully executed based on the operation results.

[0024] Optionally, before calling the decryption algorithm through a preset decryption interface to decrypt the file fragments to determine the target decryption algorithm corresponding to the encrypted file, the method further includes:

[0025] Add a category label to each of the decryption algorithms and encapsulate each decryption algorithm and its corresponding algorithm details;

[0026] The preset decryption interface is set by a smart pointer, and the preset decryption interface is used to call the encapsulated decryption algorithm.

[0027] Optionally, setting the preset decryption interface via a smart pointer includes:

[0028] Add an instance of the decryption algorithm to the Decode function;

[0029] Set shared_ptr for the Decode function <decode>Smart pointers, the shared_ptr <decode>Smart pointers are used to look up the decryption algorithm within the Decode function.

[0030] A second aspect of this application provides a file decryption apparatus, comprising:

[0031] An acquisition unit is used to acquire file fragments from an encrypted file, wherein the file fragments are portions of encrypted data in the encrypted file;

[0032] The first determining unit is used to call a decryption algorithm through a preset decryption interface to decrypt the file fragments, so as to determine the target decryption algorithm corresponding to the encrypted file. The preset decryption interface encapsulates at least one of the decryption algorithms used to decrypt the encrypted file.

[0033] An execution unit is configured to perform a decryption operation on the encrypted file according to the target decryption algorithm, obtain a decrypted file, and verify whether the decryption operation was successfully executed through a preset verification operation, wherein the preset verification operation involves transferring the decrypted file from system memory to the target program for verification;

[0034] The second determining unit is used to determine that the encrypted file has been decrypted if the decryption operation is successfully verified through a preset verification operation.

[0035] This invention provides a file decryption method and related apparatus. The method involves obtaining file fragments from an encrypted file; then, decrypting the file fragments using a pre-defined decryption interface to determine the target decryption algorithm for the encrypted file; subsequently, performing a decryption operation on the encrypted file according to the target decryption algorithm to obtain a decrypted file; and verifying the success of the decryption operation through a pre-defined verification operation. Finally, if the decryption operation is verified as successful, the encrypted file is determined to be decrypted, thus achieving the decryption of the encrypted file. In this scheme, the file fragments are portions of encrypted data within the encrypted file, and the pre-defined decryption interface encapsulates at least one decryption algorithm for decrypting the encrypted file. This achieves the effect of determining a suitable decryption algorithm based solely on file fragments containing only a portion of the encrypted file during the decryption process, eliminating the need to attempt decryption algorithms for the entire encrypted file, thereby reducing the overall decryption operation time and the total decryption time required. Meanwhile, since the preset verification operation involves transferring the decrypted file from system memory to the target program for verification, data can be directly retrieved from system memory during the verification process after decryption, without needing to retrieve it from the disk. Because the memory transfer process is based on inter-process communication and does not require reading from the hard drive, the data transfer time when retrieving the decrypted file is reduced, further reducing the overall operation time of the decryption process. Attached Figure Description

[0036] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0037] Figure 1 A flowchart of a file decryption method provided in an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of an embodiment of a file decryption device provided by the present invention;

[0039] Figure 3 A schematic diagram illustrating an embodiment of an electronic device provided in this application;

[0040] Figure 4 This is a schematic diagram illustrating an embodiment of a computer-readable storage medium provided in this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] The terms "comprising" and "having," and any variations thereof, used in the embodiments of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or devices.

[0043] like Figure 1 As shown, an embodiment of the present invention provides a file decryption method comprising the following steps:

[0044] 101. Obtain file fragments from encrypted files.

[0045] The file fragments are portions of encrypted data within the encrypted file.

[0046] Since the file decryption method used in this embodiment is primarily applied when the decryption algorithm for the encrypted file is unknown, various decryption algorithms need to be continuously tried during actual operation. Generally, a file is quite large, but encryption and decryption are performed by dividing the file into chunks. This means that if any file chunk can be decrypted by a certain decryption algorithm, the entire file can be decrypted by that algorithm. Therefore, in this embodiment, when attempting to decrypt a file, only one chunk needs to be decrypted at a time to determine which decryption algorithm is suitable. If a decryption algorithm can correctly decrypt a file chunk, it indicates that the algorithm is suitable for the encrypted file; otherwise, the decryption algorithm is changed, thus avoiding the use of an incorrect decryption algorithm to decrypt the entire file.

[0047] Therefore, in some examples, since the purpose of file fragmentation in this embodiment is to reduce the time spent attempting decryption using various decryption algorithms, the method for obtaining file fragments from the encrypted file in this step can be as follows, including:

[0048] First, the data volume of the file fragments is determined based on the data requirement for decryption and the data volume of the file format. The data requirement for decryption is used to characterize the minimum amount of data required by each decryption algorithm when performing the decryption operation, and the data volume of the file format is the maximum amount of data in the file header used to characterize the data of the various file types.

[0049] Then, the file fragments are obtained from the file header of the encrypted file based on the file fragment data volume.

[0050] The above method allows us to obtain the required file fragments from the header of an encrypted file based on the amount of data in each fragment. Since every encrypted file has a header containing the file format, this method enables us to quickly determine the file fragments, thereby reducing the time required for fragment determination. Furthermore, this method ensures that the amount of data in the obtained file fragments is sufficient for decryption, thus guaranteeing the implementation of the function of determining the target decryption algorithm based on the file fragments.

[0051] In some examples, since the process of determining file fragments is performed in conjunction with the file type data in the file header, the data volume of the file fragments can also be determined based on actual needs when obtaining the file fragments. Specifically, the process of determining the data volume of the file fragments based on the decryption data requirement and the file format data volume described in the foregoing embodiments may include the following during execution:

[0052] On the one hand, if the amount of data in the file format is less than the amount of data required for decryption, then the amount of data required for decryption is determined as the amount of data in the file fragment. This ensures that data for each file format can be obtained, avoiding the problem of some file formats having large amounts of data that make it impossible to obtain the corresponding file fragments.

[0053] For example, when the data required for decryption is 1MB, and the file format data sizes are 64KB, 128KB, and 32KB respectively, then according to the method of this embodiment, 1MB can be directly selected as the data size of the file segment.

[0054] On the other hand, if the file format data volume is greater than the decryption data requirement, then the target data volume is set to the data volume of the file fragments. The target data volume is greater than the file format data volume and is a minimum multiple of the decryption data requirement. Based on this method, it can be ensured that, under the minimum multiple of the decryption data requirement, file fragments of all file formats can be obtained, the decryption data requirement of the decryption algorithm can be met, and the data volume during decryption can be minimized as much as possible.

[0055] For example, when the data required for decryption is 1MB and the data size of the file format is 1.2MB, then according to the method of this embodiment, 2MB (the smallest multiple of the data required for decryption of 1MB) can be directly selected as the data size of the file fragment.

[0056] 102. Decrypt file fragments by calling the decryption algorithm through the preset decryption interface to determine the target decryption algorithm for the corresponding encrypted file.

[0057] The preset decryption interface encapsulates at least one of the decryption algorithms used to decrypt the encrypted file.

[0058] In this embodiment, since multiple algorithms are needed to decrypt file fragments, a suitable encryption algorithm for the encrypted file, i.e., the target decryption algorithm, is determined. Therefore, when this step is executed, a method needs to be set up to specifically control the execution order of the various algorithms, for example, a queue can be used.

[0059] Based on this, in some examples, the method described in this step may specifically include the following when executed:

[0060] First, at least one of the decryption algorithms is called through a preset decryption interface and added to a preset algorithm queue;

[0061] Secondly, according to the priority of the decryption algorithm, the preset algorithm queue is sorted to obtain the decryption algorithm sequence.

[0062] Finally, the decryption algorithm is selected according to the decryption algorithm sequence to decrypt the file fragments, and the target decryption algorithm suitable for the encrypted file is determined.

[0063] In the above steps, the priority of the decryption algorithm is determined according to a priority determination strategy, which includes the execution time and execution record of each decryption algorithm. The execution record, which serves as the basis for the priority determination strategy, may include the number of successful decryption attempts, the time of the last successful decryption, and the duration of the last failed decryption.

[0064] For example, a field can be added to each decryption algorithm to record the execution result, which can be the decryption result of the algorithm's most recent 8 attempts. Since only the most recent 8 records need to be recorded, a single byte can be used to record success or failure. That is, each of the 8 bits in a byte is used to record a success or failure, with 1 for success and 0 for failure. Specifically, a macro command can be used for recording: #define SETFLAG(SET,DATA)DATA=(((DATA)<<1)|(bool(SET))). This macro command is used to record the execution result in DATA, where a SET value of 1 indicates a successful execution and 0 indicates a failed execution.

[0065] It should be noted that in order to reduce the number of records, only part of the execution process was recorded in the above process. Therefore, it is necessary to select an update cycle to ensure the accuracy of the priority judgment strategy. For example, the update cycle can be selected as 60 seconds, that is, the execution record is updated every 60 seconds.

[0066] Meanwhile, in some cases, a certain algorithm might consistently fail to decrypt the aforementioned file over a period of time. For such algorithms, a disabling mechanism can be set to ensure that the algorithm is excluded from the preset algorithm queue. For example, if the most recent update of a decryption algorithm's eight most recent records is within the last five minutes, and the most recent record shows three consecutive failures, then the decryption algorithm can be disabled. This avoids calling the algorithm into the preset algorithm queue, minimizing attempts on that algorithm and prioritizing other algorithms to improve decryption efficiency.

[0067] Furthermore, some decryption algorithms may remain unused, or the method described in this embodiment may be being executed for the first time. In such cases, the execution record in the priority judgment strategy is not recorded. Therefore, algorithm priority can be selected through preset rules. For example, the preset rule can prioritize algorithms based on the number of historical successes. Algorithms with the same number of historical successes will have higher priority if the execution time of their most recent failure is shorter, thus placing them at the front of the preset algorithm queue. If the execution times of failures are the same, the closer the time of the most recent successful execution is to the current time, the higher the priority, thus placing them at the front of the preset algorithm queue.

[0068] Specifically, the process of setting the priority judgment strategy and the order of adding algorithms to the preset algorithm queue in the aforementioned example can be executed in the following manner:

[0069] 1. First, set the data structure for the data records of each algorithm.

[0070] First, a structure `Struct DecodeRecodrs` is set up to record all relevant data; then, `uint8_t records` is used to record the success or failure of the decryption algorithm using one byte; then, `Timelastfailtime` is used to record the time of the most recent failure of the current decryption algorithm; then, `Timelastsuctime` is used to record the time of the most recent success of the current decryption algorithm; finally, the unique identifier of the decryption algorithm is recorded.

[0071] In this example, records are used to track the most recent 8 decryption attempts. Specifically, a function is used to count the number of times a record shows a value of 1, thus recording the number of successful decryption attempts using this algorithm within the records. This function is:

[0072]

[0073] 2. A function to set the number of most recent consecutive successful records.

[0074]

[0075] 3. When adding a decryption algorithm to the preset algorithm team, the relevant functions can be implemented in the following way.

[0076] 1) Creating a queue: This default algorithm queue can use an array to store the record data for each algorithm, specifically: vector <decoderecodrs>decodequeue.

[0077] 2) Queue initialization: During the decryption process, a preset algorithm queue will be created, and a data item will be generated for each algorithm and stored in the queue.

[0078] DecodeRecodrs item; This step is used to define an algorithm record item.

[0079] Item.records = 0;

[0080] Item.lastfailtime = 0;

[0081] Item.lastsuctime = 0;

[0082] Item.type = AesType;

[0083] Decodequeue.push_back(item); This step is used to store raw data in the queue.

[0084] 3) Update the execution record of the decryption algorithm in the queue: Update the record to the preset algorithm queue based on the execution result (success or failure) of each algorithm.

[0085] Each time a decryption algorithm is called to decrypt a file, the success or failure of decryption is updated in the queue record. The specific algorithm iterates through the algorithms in the Decodequeue and determines whether to update the success or failure record based on the record's time. The code uses a for loop to iterate through the queue. If it checks if the algorithm type is the current one, it checks whether the current record is a success or failure record, and then checks the last time of success or failure for each record to determine if updating the success or failure record is possible. If it's a success record, it calculates the difference between the current time and the last successful time (lastsuctime). If the difference is satisfied, it updates the record (SETFLAG(1, it.records)); the success record is updated. Otherwise, if it's not a success record, it calculates the time difference between the last failed time (lastfailtime) and the current time. If the difference is satisfied, it updates the record (SETFLAG(0, it.records)); the failure record is updated.

[0086] 4) Set the sorting algorithm. Following the steps 1) to 3) above, the algorithms in the preset algorithm queue need to be sorted. The priority judgment strategy during sorting is based on the functions described in the previous steps.

[0087] In fact, the sorting algorithm only needs to compare any two decryption algorithms, and so on, to achieve the effect of comparing each algorithm in the preset algorithm queue, so that the optimal algorithm can be sorted to the front.

[0088] First, Bool compare(DecodeRecodrs item1, DecodeRecodrs item2) { This function is used to compare which of the two encryption algorithms has a smaller parameter, and the smaller one is placed at the end of the queue.}

[0089] If (SuccessCount(item1->records) != SuccessCount(item2->records)) { In this step, we determine whether the number of successful executions of the two decryption algorithms is different. If they are different, we compare them according to the number of successful executions, and the sorting method is that the one with more successful executions is ranked first.

[0090] return SuccessCount(item1->records)<SuccessCount(item2-> In this step, if the number of successful attempts of the two decryption algorithms is the same, then the failure time is determined.

[0091] If (item1->lastfailtime != item2->lastfailtime) { In this step, if the times of the most recent failures of the two decryption algorithms are different, then compare the most recent failure times; the earlier the failure time, the later it is placed in the queue.}

[0092] Return item1->lastfailtime <item2->lastfailtime;} In this step, if the failure time of the most recent failure of the two decryption algorithms is the same, then the success time can be further compared.

[0093] If (item1->lastsuctime != item2->lastsuctime) { If the most recent success time of two records is different, then compare the most recent success time, and the record with the later success time should be placed at the back of the queue.}

[0094] Return item1->lastsuctime>item2->lastsuctime;

[0095] Additionally, if no algorithm is initially recorded, the algorithms can be sorted by the time consumed to obtain decryption data. Algorithms with shorter decryption times are placed at the front of the queue for priority testing. Based on the previous example, decryption algorithms that fail multiple times may be removed from the queue and banned. However, if many algorithms experience numerous decryption failures, the removed algorithms can be retried. If decryption is successful, the algorithm can be added back to the list of usable algorithms from the banned list.

[0096] As can be seen from the methods described in the preceding steps, in this embodiment, since multiple decryption algorithms are required for operation, each decryption algorithm generally needs to create a corresponding encryption / decryption instance object when used. This process involves initializing data and tables for the decryption algorithm, which consumes a certain amount of time. Therefore, in some examples, before the method described in this step calls the decryption algorithm through a preset decryption interface to decrypt the file fragments to determine the target decryption algorithm for the encrypted file, the method further includes:

[0097] First, add a category label to each of the decryption algorithms and encapsulate each decryption algorithm and its corresponding algorithm details;

[0098] Then, the preset decryption interface is set via a smart pointer, which is used to call the encapsulated decryption algorithm.

[0099] The process of adding category labels to existing decryption algorithms in this step can be carried out in the following way. For example, in this example, an enumeration variable can be used to uniformly identify all decryption algorithms, specifically:

[0100]

[0101] ...list all the decryption algorithms required for the execution of the methods described in this embodiment.

[0102] The above method allows for the addition of categorized tags to each required decryption algorithm, facilitating subsequent calls. Furthermore, encapsulating each decryption algorithm along with its details avoids the need to write execution instances in practical applications, simplifying the use of decryption algorithms. Additionally, by setting preset decryption interfaces using smart pointers, the algorithm can be invoked via interface calls, further simplifying the selection of decryption algorithms and improving decryption efficiency.

[0103] In some embodiments, the step of setting the preset decryption interface via a smart pointer in the foregoing example steps may include, during execution:

[0104] First, add an instance of the decryption algorithm to the Decode function. Then, set a shared_ptr for the Decode function. <decode>Smart pointers. The shared_ptr <decode>Smart pointers are used to look up the decryption algorithm within the Decode function.

[0105] Specifically, in conjunction with the method described in the above example, the process of setting classification labels, encapsulating, and setting up dedicated preset decryption interfaces for each decryption algorithm can be performed as follows: First, the existing decryption algorithms need to be encapsulated to facilitate the subsequent creation of each decryption algorithm based on classification labels, and a unified interface to call the required decryption algorithms.

[0106] The encapsulation process specifically includes the following steps:

[0107] A. A class with a unified interface (pre-defined decryption interface) needs to be set up, which can adapt to different decryption algorithms.

[0108] B. Configure each decryption algorithm individually to inherit the class of the unified interface.

[0109] C. Set a unique identifier (classification label) for each algorithm to realize the interface for creating specific decryption algorithms.

[0110] Based on the steps of AC described above, the specific algorithm for its implementation can be as follows:

[0111] First, in this step, we define the base class of the abstract decryption class.

[0112] Virtual Data*decode(Data*src, string key) = 0; This step sets up an abstract decryption interface class.

[0113] Virtual time decodeTime() = 0; This step sets the time consumed by each algorithm to decrypt the same amount of data.

[0114] Virtual size decodeSize() = 0; This step means obtaining the smallest set of decryption data packets for the decryption algorithm. This is because files are usually quite large, and encryption and decryption algorithms divide the file into fragments for encryption and decryption. Therefore, when trying to decrypt a file, you can try decrypting only one fragment to see if the decryption is successful. If the decryption is successful, continue decrypting; otherwise, change the decryption algorithm.

[0115] Then, taking the AES decryption algorithm as an example, the process of setting up an interface that inherits from this interface to implement the preset decryption interface is as follows:

[0116] Class AES: public Decode{This step is used to set the AES decryption algorithm.

[0117] Data*decode(Data*src,string key){In this step, the pre-set decryption interface is overridden. This example calls the AES decryption algorithm to decrypt the data.

[0118] Data*d = AES.Decode(src,key); This gives us the decryption interface based on the AES algorithm.

[0119] Return d;} In this step, AES is used to decrypt the algorithm, obtain the decryption result, and return it to the caller.

[0120] Based on the steps described above, other decryption algorithms can be set up in the same way.

[0121] Virtual time decodeTime(){This step sets the time consumption for providing data for decryption using this AES algorithm.}

[0122] Next, we will obtain the decryption algorithm interface through the pre-defined category tags.

[0123] shared_ptr <decode>FactoryCreate(DecodeType type) { This step is used to return the preset decryption interface that was called. This time, a shared smart pointer needs to be returned so that the decryption interface can be reused.}

[0124] Switch(type); Select the algorithm type in this step;

[0125] Case AesType: This step is used to select the specific algorithm to create based on the algorithm's classification label;

[0126] shared_ptr <decode>sp=make_shared <aes>()); The interface based on AES decryption algorithm is created in this step;

[0127] Return sp;} This step is used to return the result;

[0128] Case TEAType: This step is used to implement the interface of TEA and the interface of other algorithms.

[0129] 103. Perform decryption operation on the encrypted file according to the target decryption algorithm, obtain a decrypted file, and verify whether the decryption operation is successfully performed through a preset verification operation.

[0130] The preset verification operation is to transfer the decrypted file from the system memory to the target program for verification.

[0131] In actual application, when the encrypted file is decrypted by the decryption algorithm, it does not mean that the decryption is completed, and it is very likely that the decrypted file cannot be opened by the corresponding operation program or application, for example, the decrypted file is XXX.doc; but when opening by the application program WORD, it is found that it cannot be opened. In this case, manual operation is generally required to verify by the corresponding application program in the field.

[0132] In some embodiments, automatic verification and result analysis can also be performed based on the HOOK function, so as to eliminate the need for manual verification. The hook function HOOK is part of the Windows message processing mechanism, and by setting the "hook", the application program can filter all messages and events at the system level, and access messages that cannot be accessed under normal circumstances. The essence of the hook is a program used to process system messages, which is hung into the system through system call. Therefore, in step 103, the decryption operation is performed on the encrypted file according to the target decryption algorithm, the decrypted file is obtained, and the decryption operation is verified whether it is successfully performed through a preset verification operation, which can be performed in the following manner, which includes:

[0133] Firstly, the decrypted file in the system memory is transmitted to the target program through a preset hook function, wherein the target program is an opening program corresponding to the file type of the decrypted file, and the preset hook function is pre-deployed in the target program to control the target program to perform opening operation and obtain the operation result of the opening operation.

[0134] Then, the operation result is obtained from the target program by using the preset hook function, wherein the operation result is obtained by the target program after performing the opening operation on the decrypted file;

[0135] Finally, whether the decryption operation is successfully performed is verified according to the operation result.

[0136] Through the above process, the decrypted file can be transmitted to the target program by using the HOOK hook function, and the corresponding operation result can be directly obtained after execution by the target program and verified whether it is successful, so that the verification operation can be automatically executed without manual operation, avoiding human consumption. At the same time, since the hook function is directly transmitted to the target program from the decrypted data saved in the memory after decryption, that is, the data transmission is completed in the memory, without the need to obtain data through the disk, and as we all know, the inter-process data transmission in the memory has an exponential improvement in efficiency compared with the data transmission between the disk and the memory. Therefore, the method of the embodiment can further improve the efficiency of the entire decryption process during data transmission, and can avoid the time consumption problem caused by disk reading and writing.

[0137] Specifically, in actual application, the process of performing the verification operation by using the hook function in this step can be implemented according to the following steps:

[0138] Firstly, the target program of opening various files, such as word, is reversely analyzed, so as to obtain the code position of the program when opening the file and the code position of the parsed file result, and then the two positions are obtained by injecting a preset code, so that the decrypted file can be directly sent to the target program for parsing and obtaining the parsed result.

[0139] Then, a transmission module (which is defined based on the hook function in advance) is set, which has the function of inter-process communication and creates a memory mapping file for multi-process data transmission.

[0140] After that, the transmission module is injected into different target programs, including video players, word programs, excel programs, audio programs, pdf programs, etc., by remote injection.

[0141] After that, the decrypted operation is completed, and the process of the corresponding target program is created, so as to start the target program.

[0142] Finally, the preset transmission module is injected into the target program, the transmission module will capture the place where the target program reads the file and parses the file content, and transmit the decrypted file to the reading space of the target program, and obtain the execution result after the target program executes the decrypted file, so as to accurately determine whether the file is decrypted correctly according to the execution result, and supplement the suffix of the file name, so as to complete the verification operation.

[0143] 104、If successful, it is determined that the encrypted file has been decrypted.

[0144] If it is judged that the decryption operation verification is successful, it indicates that the decrypted file can be opened by the corresponding application program, thereby indicating that the decryption operation has been implemented, and it is determined that the encrypted file has been decrypted. Otherwise, it indicates that the encrypted file fails to be decrypted after the decryption operation is performed.

[0145] According to the method described above, the file fragment is obtained from the encrypted file; then, the decryption algorithm is called through the preset decryption interface to decrypt the file fragment, so as to determine the target decryption algorithm corresponding to the encrypted file; then, the decryption operation is performed on the encrypted file according to the target decryption algorithm, to obtain the decrypted file and verify whether the decryption operation is successfully performed through the preset verification operation; finally, if the decryption operation is verified to be successful, it is determined that the encrypted file has been decrypted, thereby realizing the decryption of the encrypted file. In the above scheme, the file fragment is part of the encrypted data in the encrypted file, and the preset decryption interface encapsulates at least one decryption algorithm for decrypting the encrypted file. In the decryption process of the encrypted file, the effect of determining the suitable decryption algorithm only by relying on the file fragment of part of the data in the encrypted file is achieved, without the need for the attempt process of the decryption algorithm for the entire encrypted file, thereby reducing the overall time length of the decryption operation during the attempt decryption, and thereby reducing the time length required by the decryption process. At the same time, since the preset verification operation is to transfer the decrypted file from the system memory to the target program for verification, the data can be directly obtained from the system memory during the decryption verification process, without the need to obtain it from the disk. Since the transmission process of the memory is based on the inter-process, it is not necessary to read from the hard disk, thereby reducing the data transmission time length when obtaining the decrypted file, and further reducing the operation time length of the decryption process as a whole.

[0146] The file decryption method in the embodiments of the present application is described above, and the file decryption device in the embodiments of the present application is described below.

[0147] Please refer to Figure 2 In one embodiment of the file decryption device in the present application, the device comprises:

[0148] The obtaining unit 21 can be used to obtain the file fragment from the encrypted file, and the file fragment is part of the encrypted data in the encrypted file;

[0149] The first determining unit 22 can be used to call the decryption algorithm through the preset decryption interface to decrypt the file fragment, so as to determine the target decryption algorithm corresponding to the encrypted file, and the preset decryption interface encapsulates at least one decryption algorithm that can be used to decrypt the encrypted file;

[0150] The execution unit 23 can be configured to perform a decryption operation on the encrypted file according to the target decryption algorithm, to obtain a decrypted file and verify whether the decryption operation is successfully performed through a preset verification operation, wherein the preset verification operation is to transfer the decrypted file from a system memory to a target program for verification.

[0151] The second determination unit 24 can be configured to determine that the encrypted file is decrypted if the decryption operation is verified to be successful through the preset verification operation.

[0152] Referring to Figure 3 , Figure 3 An embodiment of an electronic device provided by the present application is shown in the accompanying drawings.

[0153] As Figure 3 shown, the present application provides an electronic device, which includes a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, the following steps are implemented: obtaining a file fragment from an encrypted file, the file fragment being part of encrypted data in the encrypted file; calling a decryption algorithm through a preset decryption interface to decrypt the file fragment, to determine a target decryption algorithm corresponding to the encrypted file, the preset decryption interface encapsulating at least one decryption algorithm for decrypting the encrypted file; performing a decryption operation on the encrypted file according to the target decryption algorithm, to obtain a decrypted file and verify whether the decryption operation is successfully performed through a preset verification operation, wherein the preset verification operation is to transfer the decrypted file from a system memory to a target program for verification; and determining that the encrypted file is decrypted if the decryption operation is verified to be successful.

[0154] Optionally, in some embodiments, the processor 320 is specifically configured to: the obtaining of the file fragment from the encrypted file includes:

[0155] determining a data amount of the file fragment according to a decryption data requirement amount and a file format data amount, wherein the decryption data requirement amount is used to represent a minimum data amount required by each decryption algorithm when performing a decryption operation, and the file format data amount is a maximum data amount in data amounts used to represent the plurality of file type data in a file header;

[0156] obtaining the file fragment from the file header of the encrypted file according to the data amount of the file fragment.

[0157] Optionally, in some embodiments, the processor 320 is specifically configured to: the determining of the data amount of the file fragment according to the decryption data requirement amount and the file format data amount includes:

[0158] If the file format data volume is less than the decryption data requirement, then the decryption data requirement is determined as the data volume of the file fragment;

[0159] If the file format data volume is greater than the decryption data requirement, then the target data volume is set to the data volume of the file fragment. The target data volume is greater than the file format data volume and is a minimum multiple of the decryption data requirement.

[0160] Optionally, in some embodiments, the aforementioned processor 320 is specifically used for: decrypting the file fragments by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file, including:

[0161] At least one of the aforementioned decryption algorithms is invoked through a preset decryption interface and added to a preset algorithm queue;

[0162] According to the priority of the decryption algorithm, the preset algorithm queue is sorted to obtain a decryption algorithm sequence. The priority of the decryption algorithm is determined according to a priority judgment strategy. The priority judgment strategy includes the execution time and execution record of each decryption algorithm. The execution record includes the number of successful decryption, the time of the last successful decryption, and the duration of the last failed decryption.

[0163] The file fragments are decrypted according to the decryption algorithm sequence, and the target decryption algorithm suitable for the encrypted file is determined.

[0164] Optionally, in some embodiments, the aforementioned processor 320 is specifically used for: performing a decryption operation on the encrypted file according to the target decryption algorithm, obtaining a decrypted file, and verifying whether the decryption operation was successfully performed through a preset verification operation, including:

[0165] The decrypted file in the system memory is transferred to the target program through a preset hook function. The target program is an opening program corresponding to the file type of the decrypted file. The preset hook function is pre-deployed in the target program to control the target program to perform the opening operation and obtain the operation result of the opening operation.

[0166] The operation result is obtained from the target program using the preset hook function. The operation result is obtained by the target program after performing an open operation on the decrypted file.

[0167] Verify whether the decryption operation was successfully executed based on the operation results.

[0168] Optionally, in some embodiments, the aforementioned processor 320 is specifically configured to: before calling the decryption algorithm through a preset decryption interface to decrypt the file fragments to determine the target decryption algorithm corresponding to the encrypted file, the method further includes:

[0169] Add a category label to each of the decryption algorithms and encapsulate each decryption algorithm and its corresponding algorithm details;

[0170] The preset decryption interface is set by a smart pointer, and the preset decryption interface is used to call the encapsulated decryption algorithm.

[0171] Optionally, in some embodiments, the aforementioned processor 320 is specifically used for: setting the preset decryption interface via a smart pointer, including:

[0172] Add an instance of the decryption algorithm to the Decode function;

[0173] Set shared_ptr for the Decode function <decode>smart pointer, the shared_ptr <decode>The smart pointer is used to query the decryption algorithm in the Decode function.

[0174] As shown in Figure 4 The embodiment provides a computer readable storage medium 400, and a computer program 411 is stored in the computer readable storage medium 400, and the computer program 411 is executed by a processor to realize the following steps: obtaining a file fragment from an encrypted file, the file fragment being part of encrypted data in the encrypted file; calling a decryption algorithm on the file fragment through a preset decryption interface to determine a target decryption algorithm corresponding to the encrypted file, the preset decryption interface encapsulating at least one decryption algorithm used for decrypting the encrypted file; performing a decryption operation on the encrypted file according to the target decryption algorithm to obtain a decrypted file and verifying whether the decryption operation is successfully performed through a preset verification operation, wherein the preset verification operation is to transfer the decrypted file from a system memory to a target program for verification; and if the decryption operation is successfully performed, it is determined that the encrypted file has been decrypted.

[0175] Optionally, in a possible embodiment, the computer program 411 is executed by the processor to be specifically used for: the obtaining of the file fragment from the encrypted file comprises:

[0176] determining the data amount of the file fragment according to a decryption data requirement amount and a file format data amount, wherein the decryption data requirement amount is used to represent a minimum data amount required by each decryption algorithm when performing the decryption operation, and the file format data amount is a maximum data amount in data amounts used to represent the plurality of file type data in a file header;

[0177] obtaining the file fragment from the file header of the encrypted file according to the file fragment data amount.

[0178] Optionally, in a possible embodiment, the computer program 411 is executed by the processor to be specifically used for: the determining of the data amount of the file fragment according to the decryption data requirement amount and the file format data amount comprises:

[0179] if the file format data amount is less than the decryption data requirement amount, the decryption data requirement amount is determined as the data amount of the file fragment;

[0180] if the file format data amount is greater than the decryption data requirement amount, a target data amount is set as the data amount of the file fragment, the target data amount being greater than the file format data amount and being a minimum multiple of the decryption data requirement amount.

[0181] Optionally, in a possible implementation, the computer program 411, when executed by the processor, is specifically configured to: determine the target decryption algorithm corresponding to the encrypted file by calling the decryption algorithm through the preset decryption interface to decrypt the file fragments, including:

[0182] calling at least one of the decryption algorithms through the preset decryption interface and adding to a preset algorithm queue;

[0183] performing algorithm arrangement on the preset algorithm queue according to the decryption algorithm priority to obtain a decryption algorithm sequence, wherein the priority of the decryption algorithm is determined according to a priority judgment strategy, and the priority judgment strategy contains the execution time length and execution record of each decryption algorithm, and the execution record includes the number of decryption successes, the last decryption success time, and the time length of the last decryption failure;

[0184] decrypting the file fragments according to the decryption algorithm sequence and determining the target decryption algorithm suitable for the encrypted file.

[0185] Optionally, in a possible implementation, the computer program 411, when executed by the processor, is specifically configured to: perform decryption operation on the encrypted file according to the target decryption algorithm to obtain a decrypted file and verify whether the decryption operation is successfully performed through a preset verification operation, including:

[0186] transmitting the decrypted file in the system memory to the target program through a preset hook function, wherein the target program is an opening program corresponding to the file type of the decrypted file, and the preset hook function is pre-deployed in the target program to control the target program to perform an opening operation and obtain an operation result of the opening operation;

[0187] obtaining the operation result from the target program by using the preset hook function, the operation result being obtained by the target program after performing the opening operation on the decrypted file;

[0188] verifying whether the decryption operation is successfully performed according to the operation result.

[0189] Optionally, in a possible implementation, the computer program 411, when executed by the processor, is specifically configured to: before the decryption algorithm is called through the preset decryption interface to decrypt the file fragments to determine the target decryption algorithm corresponding to the encrypted file, the method further includes:

[0190] adding a classification label to each decryption algorithm and encapsulating each decryption algorithm and corresponding algorithm details together;

[0191] The preset decryption interface is set through the smart pointer, and the preset decryption interface is used to call the encapsulated decryption algorithm.

[0192] Optionally, in a possible embodiment, the computer program 411 is specifically used for, when executed by the processor: setting the preset decryption interface through the smart pointer, including:

[0193] adding an algorithm instance of the decryption algorithm to a Decode function;

[0194] setting a shared_ptr for the Decode function <decode>smart pointer, the shared_ptr <decode>The smart pointer is used to query the decryption algorithm in the Decode function.

[0195] It should be noted that the steps of the file decryption method performed by the above device, processor and electronic device are consistent with the methods and steps corresponding to the above method embodiments, and will not be repeated here. Figure 1

[0196] In several embodiments provided by the present application, it should be understood that the disclosed device and method can also be implemented by other manners. The device embodiments described above are only schematic, for example, the flowcharts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the device, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0197] For example, the division of the above units is only a logical function division, and in actual implementation, there can be another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, which can be electrical, mechanical or other forms.

[0198] The units described above as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment.

[0199] In addition, each functional unit in the embodiments provided by the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0200] ​If the above functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the present application that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the above-mentioned method of various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0201] It should be noted that similar reference numbers and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings, in addition, the terms "first", "second", "third" and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0202] Finally, it should be noted that the above embodiments are only specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the present application, the protection scope of the present application is not limited to this, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art within the technical range disclosed by the present application can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features, and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application. All should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.< / decode> < / decode> < / decode> < / decode> < / aes> < / decode> < / decode> < / decode> < / decode> < / decoderecodrs> < / decode> < / decode>

Claims

1. A file decryption method, characterized in that, Includes the following steps: Obtain file fragments from the encrypted file, wherein the file fragments are portions of encrypted data in the encrypted file; The file fragments are decrypted by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file. The preset decryption interface encapsulates at least one of the decryption algorithms used to decrypt the encrypted file. The encrypted file is decrypted according to the target decryption algorithm to obtain the decrypted file. The decryption operation is then verified by a preset verification operation to determine whether the decryption operation was successful. The preset verification operation involves transferring the decrypted file from system memory to the target program for verification. If successful, it is determined that the encrypted file has been decrypted; The step of obtaining file fragments from an encrypted file includes: determining the data size of the file fragments based on the decryption data requirement and the file format data size, wherein the decryption data requirement is used to characterize the minimum data size required by each decryption algorithm when performing a decryption operation, and the file format data size is the maximum data size among the data sizes in the file header used to characterize multiple file types; and obtaining the file fragments from the file header of the encrypted file based on the file fragment data size. The step of determining the data volume of the file fragment based on the data volume required for decryption and the data volume of the file format includes: if the data volume of the file format is less than the data volume required for decryption, then the data volume required for decryption is determined as the data volume of the file fragment; if the data volume of the file format is greater than the data volume required for decryption, then a target data volume is set as the data volume of the file fragment, wherein the target data volume is greater than the data volume of the file format and is a minimum multiple of the data volume required for decryption. The step of decrypting the file fragments by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file includes: At least one of the aforementioned decryption algorithms is invoked through a preset decryption interface and added to a preset algorithm queue; According to the priority of the decryption algorithm, the preset algorithm queue is sorted to obtain a decryption algorithm sequence. The priority of the decryption algorithm is determined according to a priority judgment strategy. The priority judgment strategy includes the execution time and execution record of each decryption algorithm. The execution record includes the number of successful decryption, the time of the last successful decryption, and the duration of the last failed decryption. The file fragments are decrypted according to the decryption algorithm sequence, and the target decryption algorithm suitable for the encrypted file is determined.

2. The file decryption method according to claim 1, characterized in that, The step of performing a decryption operation on the encrypted file according to the target decryption algorithm, obtaining the decrypted file, and verifying whether the decryption operation was successfully performed through a preset verification operation includes: The decrypted file in the system memory is transferred to the target program through a preset hook function. The target program is an opening program corresponding to the file type of the decrypted file. The preset hook function is pre-deployed in the target program to control the target program to perform the opening operation and obtain the operation result of the opening operation. The operation result is obtained from the target program using the preset hook function. The operation result is obtained by the target program after performing an open operation on the decrypted file. Verify whether the decryption operation was successfully executed based on the operation results.

3. The file decryption method according to any one of claims 1-2, characterized in that, Before decrypting the file fragments by calling a decryption algorithm through a preset decryption interface to determine the target decryption algorithm corresponding to the encrypted file, the method further includes: Add a category label to each of the decryption algorithms and encapsulate each decryption algorithm and its corresponding algorithm details; The preset decryption interface is set by a smart pointer, and the preset decryption interface is used to call the encapsulated decryption algorithm.

4. The file decryption method according to claim 3, characterized in that, The step of setting the preset decryption interface via smart pointer includes: Add an instance of the decryption algorithm to the Decode function; Set shared_ptr for the Decode function <decode>Smart pointers, the shared_ptr <decode> Smart pointers are used to look up the decryption algorithm within the Decode function.< / decode> < / decode> 5. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program stored in the memory, implements the steps of the file decryption method as described in claim 1.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the file decryption method as described in claim 1.

Images