A process operating file full path acquisition method and system

Abstract

The present disclosure provides a process file full path acquisition method and system, comprising: when detecting that a process exists a file operation behavior, calling back file information operated by the process; wherein the file information comprises a file path of the operated file and a process behavior code; based on a pre-configured process window class chain group, obtaining a current window title; based on matching judgment of the file path of the operated file and the current window title, if it is judged to match, based on a pre-set pre-reading file screening strategy, filtering the pre-reading file to obtain a correct file path; based on the obtained correct file path and the process behavior code, performing file operation.

Description

Technical Field

[0001] This disclosure belongs to the field of computer technology, and in particular relates to a method and system for obtaining the full path of a process operation file. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] Currently, there is no method to accurately obtain the full path of files opened by a process in Windows systems. This is because processes involve read-ahead operations. Files previously opened will be read again when the process starts. From the kernel's perspective, this is treated the same as a normal file opening operation, making it impossible to determine from the kernel's feedback whether the currently opened file is actually open. The only way to currently determine if a user has actually opened a file is through the file information displayed in the current window. However, the file information displayed in the window only shows the file name in the window title, not the full path. It's just the filename or the filename without the extension. Therefore, obtaining the full path of a process-related file solely through the window title is not feasible. Summary of the Invention

[0004] To address the aforementioned issues, this disclosure provides a method and system for obtaining the full path of a file operated on by a process. The solution captures specific user operation behavior information at the kernel layer and, combined with information from the current foreground window, accurately locates the file information operated on by the user. The solution not only obtains the full path information but also matches the file actually operated on by the user, filters pre-read files, and distinguishes files with the same name existing in the process.

[0005] According to a first aspect of the present disclosure, a method for obtaining the full path of a process operation file is provided, comprising:

[0006] When a process is detected to be performing file operations, the file information of the process being operated on is called back; wherein, the file information includes the file path of the file being operated on and the process behavior code;

[0007] Get the current window title based on a pre-configured process window class chain;

[0008] The file path of the operation file is matched with the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path.

[0009] Based on the obtained correct file path and process behavior code, perform file operations.

[0010] Furthermore, the step of obtaining the current window title based on a pre-configured process window class chain group specifically involves: pre-configuring the current process window class chain group, traversing the window class through the configured window class chain group, obtaining the foreground window handle, and obtaining the current window title through the handle and window class.

[0011] Furthermore, the pre-read file filtering strategy based on the preset pre-read file filtering method obtains the correct file path after filtering the pre-read files. Specifically, when the file operation behavior is to open a file, the file is filtered by obtaining the recently opened file information in the process registry information to obtain the file that the user actually opened.

[0012] Furthermore, when a file with the same filename exists in the cache that is actually being opened, the file to be opened is determined based on the opening time of the file in the cache.

[0013] Furthermore, the acquisition of file operation behavior is based on the hook operation of the operating system kernel.

[0014] Furthermore, the process behavior codes include file opening, closing, saving, and saving as behavior codes.

[0015] According to a second aspect of the present disclosure, a system for obtaining the full path of a process operation file is provided, comprising:

[0016] The file information acquisition unit is used to call back the file information operated by the process when a file operation behavior of the process is detected; wherein, the file information includes the file path of the file operated on and the process behavior code.

[0017] The title acquisition unit is used to obtain the title of the current window based on a pre-configured process window class chain.

[0018] The matching unit is used to make a matching judgment based on the file path of the operation file and the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path.

[0019] The operation execution unit is used to perform file operations based on the obtained correct file path and process behavior code.

[0020] According to a third aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and running on it, wherein the processor executes the program to implement the method for obtaining the full path of a process-opened file.

[0021] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the method for obtaining the full path of a process-opened file.

[0022] Compared with the prior art, the beneficial effects of this disclosure are:

[0023] (1) This disclosure provides a method and system for obtaining the full path of a process operation file. The solution captures the specific behavior information of the user operation at the kernel layer and, in combination with the information of the current foreground window, accurately locates the file information operated by the user.

[0024] (2) The proposed scheme can not only obtain full path information, but also match the file that the user is actually operating on, filter the pre-read file, and distinguish the file with the same name that exists in the process.

[0025] Advantages of this disclosure in additional aspects will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0026] The accompanying drawings, which form part of this disclosure, are used to provide a further understanding of this disclosure. The illustrative embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an undue limitation of this disclosure.

[0027] Figure 1 This is a schematic diagram illustrating the window title acquisition method as described in this embodiment of the disclosure;

[0028] Figure 2 This is a schematic diagram illustrating file matching as described in the embodiments of this disclosure;

[0029] Figure 3 This is a flowchart of a method for obtaining the full path of a file opened by a process, as described in an embodiment of this disclosure. Detailed Implementation

[0030] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0031] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0032] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this disclosure. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0033] Where there is no conflict, the embodiments and features described herein can be combined with each other.

[0034] Example 1:

[0035] The purpose of this embodiment is to provide a method for obtaining the full path of a process operation file, including:

[0036] When a process is detected to be performing file operations, the file information of the process being operated on is called back; wherein, the file information includes the file path of the file being operated on and the process behavior code;

[0037] Get the current window title based on a pre-configured process window class chain;

[0038] The file path of the operation file is matched with the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path.

[0039] Based on the obtained correct file path and process behavior code, perform file operations.

[0040] In specific implementation, obtaining the current window title based on a pre-configured process window class chain group specifically involves: pre-configuring the current process window class chain group, traversing the window class through the configured window class chain group, obtaining the foreground window handle, and obtaining the current window title through the handle and window class.

[0041] In specific implementation, the pre-read file filtering strategy based on preset pre-read files filters the files to obtain the correct file path. Specifically, when the file operation is to open a file, the file is filtered by obtaining the recently opened file information in the process registry to obtain the file that the user actually opened.

[0042] In practice, when a file with the same filename exists in the cache that is actually being opened, the file to be opened is determined based on the opening time of the file in the cache.

[0043] In practice, the acquisition of file operation behavior is based on the HOOK operation of the operating system kernel.

[0044] In practice, the process behavior codes include file opening, closing, saving, and saving as behavior codes.

[0045] For ease of understanding, the following detailed description of the solution in this embodiment is provided in conjunction with the accompanying drawings:

[0046] To address the problems existing in the prior art, this embodiment provides a method for obtaining the full path of a process's file operation. The method employs the following technical concept: based on the system kernel module hooking the behavior of a process's file operation, the file path and process PID are captured during the file opening operation; based on the window title acquisition module, the current window title is obtained through the window class of the configured window chain and the current window handle; the obtained window title is compared with the file path in the cache information of the process's opened files obtained by the kernel module, and the actual file path opened by the current process is determined through the file matching module.

[0047] The kernel module obtains process behavior from the Windows kernel layer and calls back the file path and process behavior code of the process's PID operation, specifically including file opening, closing, saving, and saving as, etc., to obtain the user's actual operation behavior, and feeds the obtained information back to the file matching module, which, together with the window title obtained by the window title module, locates the file operated by the user.

[0048] The window title acquisition module (e.g.) Figure 1 As shown, it is necessary to obtain a pre-configured process window class chain group, traverse to the window class through the configured window class chain group, obtain the handle of the foreground window, obtain the title of the current window through the handle and the window class, and upload the title to the file matching module.

[0049] The file matching module (such as) Figure 2As shown, the process information obtained by the two modules above is matched with the file path and window title. If the file name in the file path matches the file name in the window title, the file being operated on by the current window can be determined. This matching is achieved by setting a regular expression for the process title in the configuration file, calculating the file name from the obtained title using the regular expression, and then matching it with the file name in the file path. Simultaneously, when opening a file, there is a pre-reading file opening operation. Files previously opened by the user are pre-read by the process and opened, and the kernel layer can capture the file information. These pre-read files need to be filtered out because they are not the files we are actually opening. The filtering method is to obtain the recently opened file information from the process registry, exclude these files, and combine the file cache information and the window title to calculate which file the user is actually opening. Furthermore, if there are files with the same file name in the cache that can all match the window title, further matching is needed. The matching algorithm calculates the opening order based on the file opening time in the cache (i.e., obtains the most recent file from the cache information) and matches the currently opened file.

[0050] Specifically, such as Figure 3 As shown, a method for obtaining the full path of a process operation file includes the following steps:

[0051] Step 0: The user opens a file.

[0052] Step 1: The kernel module obtains the open behavior and calls back file information.

[0053] Step 2: The file matching module records the file opening time, file path, and process ID of the opening process.

[0054] Step 3: The window title acquisition module retrieves the window title by traversing the configuration items to match the current window and uploads it to the file matching module.

[0055] Step 4: The file matching module matches the file path returned by the kernel module with the window title uploaded by the window title acquisition module to determine whether the current window title is a file opened by the user's operation process.

[0056] Step 5: If the match is successful, proceed to step 6 below.

[0057] Step 6: When a match is successful, first filter out pre-read files using the pre-read file filtering algorithm. The pre-read file cache is obtained from the registry. Taking the WPS process as an example, the file path directory is as follows: \HKEY_CURRENT_USER\SOFTWARE\Kingsoft\Office\6.0\wps\RecentFiles\files. Then, check if there is a file with the same name. Check if there is a file with the same name in the file path in the open file information that is called back and cached by the kernel module. If so, calculate the actual file path opened by the user according to the matching algorithm.

[0058] Step 7: Obtain the precise file path.

[0059] Step 8: End.

[0060] Example 2:

[0061] The purpose of this embodiment is to provide a system for obtaining the full path of a process operation file.

[0062] A system for obtaining the full path of a process operation file includes:

[0063] The file information acquisition unit is used to call back the file information operated by the process when a file operation behavior of the process is detected; wherein, the file information includes the file path of the file operated on and the process behavior code.

[0064] The title acquisition unit is used to obtain the title of the current window based on a pre-configured process window class chain.

[0065] The matching unit is used to make a matching judgment based on the file path of the operation file and the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path.

[0066] The operation execution unit is used to perform file operations based on the obtained correct file path and process behavior code.

[0067] Furthermore, the pre-read file filtering strategy based on the preset pre-read file filtering method obtains the correct file path after filtering the pre-read files. Specifically, when the file operation behavior is to open a file, the file is filtered by obtaining the recently opened file information in the process registry information to obtain the file that the user actually opened.

[0068] Furthermore, the system described in this embodiment corresponds to the method described in Embodiment 1, and its technical details have been explained in Embodiment 1, so they will not be repeated here.

[0069] In further embodiments, the following is also provided:

[0070] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor. When executed by the processor, the computer instructions perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0071] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0072] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0073] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in Embodiment 1.

[0074] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0075] Those skilled in the art will recognize that the units, i.e., algorithm steps, of the various examples described in connection with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0076] The above embodiments provide a method and system for obtaining the full path of a process operation file, which can be implemented and has broad application prospects.

[0077] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for obtaining the full path of a process operation file, characterized in that, include: Based on the operating system kernel, when a process is detected to be performing file operations, the file information of the process being operated on is called back; wherein, the file information includes the file path of the file being operated on and the process behavior code; Based on a pre-configured process window class chain, the title of the current window is obtained. Specifically, the current process window class chain is pre-configured, the window class is traversed through the configured window class chain, the handle of the foreground window is obtained, and the title of the current window is obtained through the handle and the window class. The file path of the operation file is matched with the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path. The pre-read file filtering strategy, which filters pre-read files to obtain the correct file path, specifically involves: when the file operation is to open a file, obtaining the recently opened file information from the process registry and combining it with file cache information and window title to obtain the file that the user actually opened; when the file that is actually opened has the same filename in the cache, determining the file to be opened based on the file opening time in the cache. Based on the obtained correct file path and process behavior code, perform file operations.

2. The method for obtaining the full path of a process operation file as described in claim 1, characterized in that, The process behavior codes include the behavior codes for opening, closing, saving, and saving as files.

3. A system for obtaining the full path of a process operation file, employing the method for obtaining the full path of a process operation file as described in any one of claims 1-2, characterized in that, include: The file information acquisition unit is used to call back the file information operated by the process when a file operation behavior of the process is detected; wherein, the file information includes the file path of the file operated on and the process behavior code. The title acquisition unit is used to obtain the title of the current window based on a pre-configured process window class chain. The matching unit is used to make a matching judgment based on the file path of the operation file and the current window title. If a match is found, the pre-read file is filtered based on a preset pre-read file filtering strategy to obtain the correct file path. The pre-read file filtering strategy, which filters pre-read files to obtain the correct file path, specifically involves: when the file operation is to open a file, obtaining the recently opened file information from the process registry and combining it with file cache information and window title to obtain the file that the user actually opened; when the file that is actually opened has the same filename in the cache, determining the file to be opened based on the file opening time in the cache. The operation execution unit is used to perform file operations based on the obtained correct file path and process behavior code.

4. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and running thereon, characterized in that, When the processor executes the program, it implements a method for obtaining the full path of a process operation file as described in any one of claims 1-2.

5. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements a method for obtaining the full path of a process operation file as described in any one of claims 1-2.

Images