Method, device, medium and equipment for safely creating threads in a target process

Abstract

The present invention provides a method, device, medium and electronic device for safely creating a thread in a target process, comprising: writing an import module; modifying a system function to load the import module; searching for a thread creation address, wherein the thread creation address is a location where multiple threads are created simultaneously and cyclically when a target program is running; modifying the number of threads created and the thread execution function address of the creation address to create a new thread. The present invention realizes the creation of a thread by modifying the number of threads created and the execution function address of the creation address, that is, the creation is realized by modifying data, without modifying or adding code, and can safely bypass system monitoring.

Description

Technical Field

[0001] The present invention relates to the technical field of computer software control, and in particular to a method, device, medium and equipment for safely creating a thread in a target process. Background Art

[0002] For some scenarios, it is necessary to create a new thread in the target process to facilitate the completion of some functions in the thread. For example, the live broadcast software needs to create a thread in the target priority software to obtain the game screen data, or to draw the bullet content in the game process, etc.

[0003] However, currently game manufacturers will detect the created processes to prevent the creation of external "plug-in" processes. The target process will usually monitor the call to the system function CreateThread, so no matter what method is used to call it, it will be detected by the target process.

[0004] Therefore, a safer method is urgently needed to create threads in the target process. Summary of the invention

[0005] The present invention provides a method for safely creating a thread in a target process, and realizes the creation of a thread by modifying the number of threads created and the execution function address of the creation address, that is, the creation is realized by modifying data, without modifying or adding code, and can safely bypass system monitoring.

[0006] The technical solution provided by the present invention is:

[0007] A method for safely creating a thread in a target process, comprising:

[0008] Write the import module;

[0009] Modify the system function to load the import module;

[0010] Finding a thread creation address, where the thread creation address is a location where multiple threads are created in a loop while the target program is running;

[0011] Modify the thread creation number and thread execution function address of the creation address to create a new thread.

[0012] Preferably, the loading setting of the import module includes the following steps:

[0013] Get the loader library;

[0014] Search the loader library to obtain all loading modules for loading the target program and sort them in loading order;

[0015] The first loaded module is used as the target module;

[0016] Hook the loader library, obtain the import table of the target module, and add an import item to the import table;

[0017] The import item includes the name of the import module and the name of the export function of the import module.

[0018] Preferably, the thread creation address search comprises the following steps:

[0019] Traverse the main program and module programs;

[0020] Find and record all modules that introduce system functions and the locations where the system functions are introduced;

[0021] Filter the position of the introduced system function to obtain the real calling position;

[0022] Searching for a thread creation calling code with a loop feature in the real calling position, and taking the starting position of the creation instruction of the calling code as the thread creation address;

[0023] Wherein, the introduced system function is the CreateThread function.

[0024] Preferably, screening the position of the introduced system function to obtain the real call position comprises the following steps:

[0025] Record all the locations of the introduced system functions by hooking the system functions, and record all the calling locations;

[0026] The calling position is compared with the position of the introduced system function, and the overlapping position is taken as the real calling position.

[0027] Preferably, the calling code for creating a thread with a loop feature must satisfy at least one or more of the loop conditions; the loop conditions include: a loop marking code for marking a creation position, a storage instruction for storing the number of threads in a register, a parameter creation instruction for thread creation, a creation function for calling a thread, a count increment instruction for thread creation, and an instruction for comparing the number of threads created; wherein the register is one or more of the EAX, EBX and ECX registers.

[0028] Preferably, the creating a new thread comprises the following steps:

[0029] By using memory access breakpoints to record the number of threads created;

[0030] Modify the variable of the number of created threads;

[0031] And modify the execution parameters of the system thread function.

[0032] Preferably, the modifying the execution parameters of the system thread function includes:

[0033] Obtaining a relocation table of an imported module, and parsing the relocation table to obtain relocation data;

[0034] The memory address of the execution parameter in the relocation table is modified to make the newly created thread effective.

[0035] A device for safely creating a thread in a target process, comprising:

[0036] Import the module;

[0037] A modification module, which is used to modify the system function to load the import module;

[0038] A search module, which is used to search for a thread creation address, where the thread creation address is a location where multiple threads are created simultaneously and cyclically when the target program is running;

[0039] A creation module is provided to modify the number of threads to be created and the address of a thread execution function of the creation address to create a new thread.

[0040] An electronic device comprises an application processor and a memory, wherein the processor is used to implement the steps of a method for safely creating a thread in a target process when a computer management program stored in the memory is executed.

[0041] A computer-readable storage medium stores a computer management program, which, when executed by a processor, implements the steps of the method for safely creating a thread in a target process.

[0042] Beneficial Effects

[0043] The present invention provides a method for safely creating threads in a target process, and realizes the creation of new threads by modifying the number of threads created at the creation address, that is, the creation is realized by modifying data, without modifying or adding codes, and can safely bypass system monitoring.

[0044] The present invention uses the positions of cyclically creating multiple threads during the target program loading process as thread creation addresses, and only needs to modify the thread creation parameters to create one more thread, thereby effectively avoiding the monitoring means of verifying the integrity of the code. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The present invention is a flowchart of safely creating a thread in a target process.

[0046] Figure 2 This is a flowchart of modifying the system function described in the present invention so that the import module must be loaded when the main program is running.

[0047] Figure 3 A flowchart of creating an address for a search thread according to the present invention.

[0048] Figure 4 A schematic diagram of the structure of the device for securely creating a thread in a target process according to the present invention.

[0049] Figure 5 A schematic diagram of a hardware device for securely creating a thread in a target process according to the present invention.

[0050] Figure 6 It is a schematic structural diagram of the electronic device described in the present invention.

[0051] Figure 7 It is a schematic diagram of the structure of the computer-readable storage medium described in the present invention. DETAILED DESCRIPTION

[0052] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] It should be noted that in the description of the present invention, the terms "middle", "upper", "lower", "lateral", "inner", etc. indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings, which are only for the convenience of description, and do not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0054] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0055] like Figure 1 As shown, based on the technical problem raised by the background technology, the present invention provides a method for safely creating a thread in a target process, including:

[0056] Step S110, writing an import module;

[0057] Specifically, it includes the following contents: a module is written, and an export function of the written module is provided. In this embodiment, the written module is named xx.dll, and the export function of the module is named export function name.

[0058] It should be noted that in this step, by writing an import module to create an association with a thread, a beneficial effect of associating the newly created thread with the module is achieved.

[0059] Step S120, modifying the system function to load the import module written in step S110;

[0060] In this embodiment, the dynamic loading mode of the module means that it is not known which functions will be called before compilation, and which functions should be called are determined according to the needs during the running process. The method is to use the LoadLibrary function to load the dynamic link library into the memory. When a module xx.dll is explicitly loaded by LoadLibrary, it can be explicitly unloaded from the memory at any time by calling the FreeLibrary (release dynamic database) function. That is, the main program loads other modules by calling the system function loadlibrary (load database).

[0061] Therefore, by modifying the system function loadlibrary, the import module xx.dll written in step S110 must be loaded when the main program is running.

[0062] like Figure 2 As shown, in a specific embodiment, the specific process of modifying the system function loadlibrary is:

[0063] Step S121, obtain and search the loader library to obtain all loading modules for loading the target program;

[0064] Specifically, after the program is started, the main program will call the system function loadlibrary to load other modules. Therefore, by searching the loader library loadlibrary, all the loading modules of the target program can be obtained.

[0065] Step S122, obtaining a priority loading module of a loading program library;

[0066] Specifically, the method can be implemented by the following steps: sorting all the obtained load modules according to the loading order; taking the load module ranked first as the target module; taking the load module ranked first as the target module;

[0067] It should be noted that by sorting the loading modules of the main program, the modules that are loaded first when the main program is running can be identified, and the modules that are loaded first can be selected as target modules, that is, the beneficial effect of loading the selected target modules is achieved when the main program is executed.

[0068] Step S123, Hook loads the program library, obtains the import table of the target module, and adds an import item to the import table;

[0069] Specifically, when the main program is executed, the selected target modules must be loaded, including:

[0070] Hook (hook function) loads the program library loadlibrary, obtains the import table of the target module, and adds import items to the import table; the import items include the name of the import module xx.dll, and the export function of the module export. Among them, Hook technology is also called hook function. Before the system calls the function, the hook program first captures the message, and the hook function first obtains the control right. At this time, the hook function can process (change) the execution behavior of the function, and can also force the end of the message transmission. In this embodiment, the import items of the import table in the loader library loadlibrary are changed by the hook function, that is, the hook function dynamically adds additional import items to the current process at runtime, thereby achieving the purpose of inserting additional import modules.

[0071] It should be noted that, in this embodiment, by adding an import item to the import table, the import item is the import module written in step S110, that is, when the main program is executed, the beneficial effect of loading the module written in step S110 by modifying the loader library is achieved, and a loading module is provided for the newly created thread.

[0072] It should be noted that there is no distinction in the order of execution between step S110 and step S120. In actual application, the creation and execution order can be changed.

[0073] Step S130, searching for the thread creation address;

[0074] like Figure 3 As shown, the thread creation address is the location where multiple threads are created cyclically at the same time when the target program is running; specifically, in a specific embodiment, the location search for creating multiple threads cyclically at the same time in step S130 specifically includes the following steps:

[0075] Step S131, traverse the main program and module programs, and parse the import tables therein;

[0076] Step S132, searching and recording all modules that introduce system functions and the locations of the introduced system functions; wherein the introduced system function is the CreateThread function.

[0077] Specifically, by searching the import table to see if there is an import entry that references the system function CreateThread (a function for creating a new thread), all modules that have introduced system functions and the locations of all introduced system functions CreateThread in the modules are recorded.

[0078] Step S133: Since the presence of an import does not necessarily mean that it has been called, it is necessary to screen and confirm the location of the referenced system function;

[0079] Among them, screening and confirming the location of the referenced system function specifically includes:

[0080] Record all the locations of the introduced system functions by hooking the system functions, and record all the calling locations;

[0081] Compare the calling position with the position of introducing the system function CreateThread, and take the overlapping position as the real calling position;

[0082] Furthermore, in a specific embodiment, by printing the call log through hook, it can be ensured that it has been called, thereby obtaining the intersection of all call points that call the system function CreateThread and the location where the system function CreateThread is introduced, and finally obtaining all the locations where the system function is actually called.

[0083] It should be noted that, in this embodiment, the thread creation address is searched by hooking the positions of all introduced system functions recorded by the system function, and the real call position is obtained by screening, thereby achieving the beneficial effect of improving the accuracy of the creation address search.

[0084] Step S134, searching the real call location for a call code for creating a thread with a loop feature, and taking the starting position of the creation instruction of the call code as the thread creation address;

[0085] In a specific embodiment, the calling code for creating a thread with a loop feature must satisfy at least one or more of the loop conditions; wherein the loop conditions include: the first loop condition, a loop marking code having a marking creation position; the second loop condition, a storage instruction having the number of threads stored in a register; the third loop condition, a parameter creation instruction having a thread creation; the fourth loop condition, a creation function having a calling thread; the fifth loop condition, a count increment operation having a thread creation; and the sixth loop condition, a comparison instruction operation.

[0086] Specifically, it can be achieved by searching the following code to find out the characteristics of the loop code. Taking x86 assembly code (Windows platform) as an example, it can be achieved by searching the following code: Get the assembly code characteristics with loop operations:

[0087] Among them, the first loop condition and the loop marker code with the marked creation position are for finding the calling code of the thread creation with loop characteristics, and the address where the loop marker starts is the address where the thread loop is created; the specific assembly code example is: Loc_402008; wherein, Loc_402008: the loop start label.

[0088] The second loop condition has a storage instruction for storing the number of threads into a register, that is, an instruction for storing the number of threads into the register. The instruction is to pass the current number of threads into the register, wherein the register must be a common register. As a preferred embodiment, the register is one or more of the EAX, EBX and ECX registers. The specific assembly code example is: Move ebx, count; indicating that the count tag of the loop is assigned to the ebx register.

[0089] The third loop condition has a parameter creation instruction for thread creation. In this embodiment, a thread is created by calling the system function CreateThread, and the system function CreateThread contains 6 parameters. Therefore, 6 parameters must be pushed into the stack when the thread is created. Therefore, by finding an operation that stores 6 data in the stack, the 6 parameters of the system function are called for thread creation.

[0090] Among them, the system function CreateThread contains 6 parameters, including: lpThreadAttributes is the first parameter of the thread function CreateThread, which indicates the security attributes of the thread object, dwStackSize is the second parameter of the thread function CreateThread, which indicates the size of the thread space, lpStartAddress is the third parameter of the thread function CreateThread, which indicates the thread function address executed by the new thread, and multiple threads can use the same function address, lpParameter is the fourth parameter of the thread function CreateThread, which indicates the parameters passed to the thread function, dwCreationFlags is the fifth parameter of the thread function CreateThread, which indicates setting additional flags to control the creation of threads, and lpThreadID is the sixth parameter of the thread function CreateThread, which indicates the ID number of the returned thread.

[0091] Specifically, the following code is used as an example:

[0092] Push arg1;

[0093] Push arg2;

[0094] Push arg3;

[0095] Push arg4;

[0096] Push arg5;

[0097] Push arg6;

[0098] Among them, Push arg1 means pushing parameter 1 into the stack; Push arg2 means pushing parameter 2 into the stack; Push arg3 means pushing parameter 3 into the stack; Push arg4 means pushing parameter 4 into the stack; Push arg5 means pushing parameter 5 into the stack; Push arg6 means pushing parameter 6 into the stack;

[0099] It should be noted that in this embodiment, a thread is created by calling the system function CreateThread function, and the CreateThread function must include the above 6 functions. Therefore, the thread creation instruction can be found by searching for the operation of storing 6 data in the stack.

[0100] The fourth loop condition, having a thread creation function, is to find a function call instruction callcreateThread, which is the thread creation function.

[0101] Specifically, to find the calling thread creation function is to find the code Call CreateThread;

[0102] Among them, the call instruction calls the thread function CreateThread to create a thread. Therefore, through the call instruction at this place and the function memory address of CreateThread, we can know that the system function CreateThread is currently called to create a thread.

[0103] The fifth loop condition has a count increment instruction for thread creation. Specifically, it searches for the increment operation of the thread creation count. This instruction is a statistical operation of the inc register for data counting the number of threads created.

[0104] The sixth loop condition has a comparison instruction for the number of threads created. Specifically, find an instruction for comparing the total number of threads with the number of threads currently created. If it is smaller, loop to the starting position of the creation instruction to continue creating threads. That is, after the function call is completed, it is necessary to check whether there is a judgment code for the count mark after the call is completed.

[0105] Specifically, the following code is used as an example: inc ebx; Cmp ebx, Num; jleshort Loc_402008 and Cmp ebx, Num;

[0106] Among them, the ebx register stores the number of times currently created, num indicates the total number of threads created, and the count mark is increased by 1, indicating that the thread function has been called once. If it is not satisfied, this loop will continue to be called to create threads, otherwise the thread creation logic will be exited. jle short Loc_402008 is a judgment function code. If it is not satisfied, it will jump to the starting position of thread creation.

[0107] In a specific embodiment, the query process of the call code of creating a thread with a loop feature can be implemented by searching for the following code features: Doc_xxx, Mov register, 6 parameters that must be pushed into the stack, Call CreateThread, inc register and Cmp register.

[0108] Doc_xxx indicates the loop start marker, which identifies the current start loop creation thread.

[0109] Mov register; it is used to record the current number of threads; an instruction must be found to pass the current number of threads into the register, wherein as a preferred embodiment, the register is a common register, which can be one of the EAX, EBX and ECX general registers.

[0110] Then, six parameters must be pushed into the stack. The instruction for pushing the parameters into the stack uses a push general register. Six push instructions indicate that six parameters are pushed.

[0111] Call CreateThread; means to create a thread by calling the thread function.

[0112] inc register; used to increase a thread count, using a general register.

[0113] Cmp register; used to record the total number of threads; this instruction compares the currently created threads with the total number of threads we need to create.

[0114] Inc register; this instruction is used to increase a thread count, using general registers. Cmp register; total number of threads; this instruction compares the currently created thread with the total number of threads that need to be created. The template code in this embodiment is the entire process of creating a loop thread. You only need to match this code to create a thread in the loop. In practice, different modules will be compiled at different code locations, and the registers used will also be different. Therefore, this embodiment extracts the features of this code and uses abstract data to ensure that all loop creation thread codes can be matched.

[0115] It should be noted that, in this embodiment, by searching for the calling code of the thread creation with loop characteristics, giving the loop condition, and setting the comparison instruction operation in the loop condition, the beneficial effect of ensuring that the code of all loop creation threads can be matched is achieved. Step S140, modify the thread creation number and the thread execution function address of the creation address to create a new thread. Specifically, by modifying the core parameter lpStartAddress (parameter subroutine parameter) of the execution function, the newly added thread can execute the corresponding function.

[0116] Find the position where a thread can be created in the thread creation of the target program, modify the number of threads created in the target process, and thus add an additional thread creation.

[0117] It should be noted that, in this embodiment, the location of creating multiple threads only needs to modify one parameter to allow the program to create one more thread, and the modified parameter belongs to the data segment rather than the code segment, achieving the beneficial effect of hidden creation and will not be detected by the system.

[0118] In a specific embodiment, step S140 modifies the thread creation number and thread execution function address of the creation address to create a new thread. The steps include:

[0119] By using memory access breakpoints to record the variable of the number of created threads, that is, by using memory access breakpoints to find the variable of the number of created threads, it is possible to add a new thread by modifying the access segment point data when the thread is created.

[0120] Modify the variable for the number of created threads.

[0121] There are many ways to modify the execution parameters of the system thread function and the address of the thread function, but you must choose a method that does not modify the code.

[0122] Specifically, in this embodiment, a thread is created by using the system's thread function CreateThread, and the specific implementation method is:

[0123] HANDLE CreateThread(

[0124] LPSECURITY_ATTRIBUTES lpThreadAttributes,

[0125] DWORD dwStackSize,

[0126] LPTHREAD_START_ROUTINE lpStartAddress,

[0127] LPVOID lpParameter,

[0128] DWORD dwCreationFlags,

[0129] LPDWORD lpThreadID

[0130] Among them, lpThreadAttributes is the first parameter of the thread function CreateThread, which indicates the security attributes of the thread object, dwStackSize is the second parameter of the thread function CreateThread, which indicates the size of the thread space, lpStartAddress is the third parameter of the thread function CreateThread, which indicates the thread function address executed by the new thread. Multiple threads can use the same function address, lpParameter is the fourth parameter of the thread function CreateThread, which indicates the parameters passed to the thread function, dwCreationFlags is the fifth parameter of the thread function CreateThread, which indicates setting additional flags to control the creation of threads, and lpThreadID is the sixth parameter of the thread function CreateThread, which indicates the ID number of the returned thread.

[0131] It should be noted that, in this embodiment, this thread is not newly created, but is created using the target process's own code. Therefore, when the target process detects the thread, it will not think that there is a problem with the creation of the thread, but will think that the thread was created by the target process itself, thereby achieving the beneficial effect of hiding the creation.

[0132] Among them, the core parameter is lpStartAddress, which indicates that the thread will execute the function.

[0133] In another embodiment, specifically, modifying the execution parameter lpStartAddress of the system thread function specifically includes:

[0134] Obtaining a relocation table of an imported module, and parsing the relocation table to obtain relocation data;

[0135] Modify the memory address of the execution parameter in the relocation table to make the newly created thread effective;

[0136] Since the thread's execution function lpStartAddress is a memory address, which is a relative address in the memory, it will change with the memory loaded by the module and will be stored in the relocation table. Then, by parsing the relocation table, the memory address of this function can be obtained.

[0137] It should be noted that by modifying the memory address of the lpStartAddress function in the relocation table, when the thread function is created, the function address executed by the created thread is calculated by filling in the relocation data. Therefore, there is no need to modify the new code but only need to modify the data in the relocation to realize the change of the lpStartAddress function address executed by the thread function, thereby achieving the beneficial effect that the target process helps to create the thread, and at the same time the function executed by the thread is the function that needs to be executed.

[0138] like Figure 4 As shown, an embodiment of the present invention also provides an embodiment of a device for safely creating a thread in a target process, the device comprising: an import module 210, a modification module 220, a search module 230 and a creation module 240. Among them, the modification module 220 is used to modify the system function to load the import module; the search module 230 is used to find the thread creation address, the thread creation address is the location where multiple threads are created in a loop at the same time when the target program is running; the creation module 240 modifies the thread creation number and the thread execution function address of the creation address to create a new thread.

[0139] above Figure 4 The device for securely creating a thread in a target process in an embodiment of the present application is described from the perspective of a modular functional entity. The device for securely creating a thread in a target process in an embodiment of the present application is described in detail from the perspective of hardware processing.

[0140] See also Figure 5 The device for recommending securely creating a thread in a target process in the embodiment of the present application is an embodiment, comprising:

[0141] An input device 301, an output device 302, a processor 303 and a memory 304 (the number of the processor 303 can be one or more, Figure 3 In some embodiments of the present application, the input device 301, the output device 302, the processor 303 and the memory 304 may be connected via a bus or other means.

[0142] Wherein, by calling the operation instruction stored in the memory 304, the processor 303 is used to perform the following steps:

[0143] Write the import module;

[0144] Modify the system function to load the import module;

[0145] Finding a thread creation address, where the thread creation address is a location where multiple threads are created in a loop while the target program is running;

[0146] Modify the thread creation number and thread execution function address of the creation address to create a new thread.

[0147] By calling the operation instructions stored in the memory 304, the processor 303 is also used to execute Figure 1 Any method in the corresponding embodiment.

[0148] like Figure 6 , which is a schematic diagram of an embodiment of an electronic device provided in an embodiment of the present application.

[0149] In another embodiment, the present invention further provides an electronic device, including a memory 410, a processor 420, and a computer program 411 stored in the memory 410 and executable on the processor 420. When the processor 420 executes the computer program 411, the following steps are implemented:

[0150] Write the import module;

[0151] Modify the system function to load the import module;

[0152] Finding a thread creation address, where the thread creation address is a location where multiple threads are created in a loop while the target program is running;

[0153] Modify the thread creation number and thread execution function address of the creation address to create a new thread.

[0154] In the specific implementation process, when the processor 420 executes the computer program 411, it can achieve Figure 1-3 Any implementation manner in the corresponding embodiments.

[0155] Since the electronic device introduced in this embodiment is an electronic device for implementing the method of securely creating a thread in the target process in the embodiment of the present application, based on the method introduced in the embodiment of the present application, technical personnel in this field can understand the specific implementation method of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present application is not introduced in detail here. As long as the equipment used by technical personnel in this field to implement the method in the embodiment of the present application is within the scope of protection of this application.

[0156] See also Figure 7 , Figure 7 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present application.

[0157] like Figure 7 As shown, this embodiment provides a computer-readable storage medium 500, on which a computer program 511 is stored. When the computer program 511 is executed by a processor, the following steps are implemented:

[0158] Write the import module;

[0159] Modify the system function to load the import module;

[0160] Finding a thread creation address, where the thread creation address is a location where multiple threads are created in a loop while the target program is running;

[0161] Modify the thread creation number and thread execution function address of the creation address to create a new thread

[0162] In the specific implementation process, when the computer program 511 is executed by the processor, it can achieve Figure 1 Any implementation manner in the corresponding embodiments.

[0163] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0164] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0165] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] The present application also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device is caused to execute the following Figure 1-4 The process in the method for designing a digital platform for a wind farm in the corresponding embodiment.

[0169] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0170] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0171] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0172] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0173] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0174] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0175] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for securely creating a thread in a target process, characterized in that: include: Write the import module; Modify the system function to load the import module; The loading of the import module specifically includes: obtaining a loader library; searching the loader library to obtain all load modules for loading the target program and sorting them in a loading order; using the load module ranked first as the target module; hooking the loader library to obtain an import table of the target module and adding an import item to the import table; wherein the import item includes the name of the import module and the name of the export function of the import module; Finding a thread creation address; wherein the thread creation address is a location where multiple threads are created in a loop at the same time when the target program is running; Modify the thread creation number and thread execution function address of the creation address to create a new thread; The thread creation address search includes the following steps: traversing the main program and the module program; searching and recording all modules and positions of the introduced system functions; screening the positions of the introduced system functions to obtain the real call positions; searching the call code for creating a thread with a loop feature in the real call positions, and taking the starting position of the creation instruction of the call code as the thread creation address; wherein the introduced system function is the CreateThread function; Screening the position of the introduced system function to obtain the real call position includes the following steps: recording the positions of all introduced system functions through the hook system function, and recording all call positions; comparing the call position with the position of the introduced system function, and taking the overlapping position as the real call position; The calling code for creating a thread with a loop feature must satisfy at least one or more of the loop conditions; the loop conditions include: a loop marking code for marking a creation position, a storage instruction for storing the number of threads in a register, a parameter creation instruction for creating a thread, a creation function for calling a thread, a count increment instruction for creating a thread, and an instruction for comparing the number of created threads; wherein the register is one or more of the EAX, EBX, and ECX registers; The newly created thread includes the following steps: recording a variable of the number of created threads by using a memory access breakpoint; modifying the variable of the number of created threads; and modifying the execution parameters of the system thread function; The modification of the execution parameters of the system thread function includes: obtaining the relocation table of the import module, parsing the relocation table to obtain relocation data; modifying the memory address of the execution parameter in the relocation table to make the newly created thread effective.

2. An electronic device, comprising an application processor and a memory, characterized in that: The processor is used to implement the steps of the method for safely creating a thread in a target process as claimed in claim 1 when implementing the computer management program stored in the memory.

3. A computer-readable storage medium having a computer management program stored thereon, characterized in that: When the computer management program is executed by a processor, the steps of the method for safely creating a thread in a target process as claimed in claim 1 are implemented.

Images