Dynamic screen capture method and system for running multiple samples in virtual simulation environment

Abstract

The invention belongs to the technical field of computers, and discloses a dynamic screen capture method and system for operating multiple samples in a virtual simulation environment, and the method comprises the steps: creating a corresponding number of virtual desktops for an operating system according to the number of samples to be analyzed; traversing the to-be-analyzed sample list and respectively delivering each to-be-analyzed sample on an independent desktop for operation; injecting a HOOK module into an associated process started by the to-be-analyzed sample type; the type of an analysis sample in the current process is judged through a HOOK module, and whether the process separation technology is started or not is determined according to the judgment result; and starting a screenshot thread to perform screenshot operation, detecting whether the sample to be analyzed is overtime or not by utilizing the main thread, and stopping screenshot if the sample to be analyzed is overtime. According to the method, the pop-up windows or software interfaces between the samples to be analyzed can be ensured not to be mutually overlapped and interfered, the correct screen capture of the multiple samples in the simultaneous operation process is ensured, and the detection efficiency of hardware is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a dynamic screenshot method and system for running multiple samples in a virtual simulation environment. Background Art

[0002] Currently, most sandbox hardware configurations on the market are dual-core CPUs and 2GB of memory. When analyzing samples, they can usually only process one sample at a time, and the analysis time is generally 1 minute. In this case, when a pop-up window appears when running a single sample, or when analyzing Office documents or PDF files, when opening them with Office / Adobe Reader, the screenshot can accurately capture the sample running interface, without worrying about interference caused by multiple sample pop-ups. The traditional sandbox analysis architecture diagram is shown below: Figure 1 As shown. However, when the existing sandbox dynamically analyzes multiple samples at the same time, there is no effective means to accurately and efficiently take screenshots of the desktops running multiple samples. That is, in actual operation, it is found that when a VM (a virtual machine) is started to process a single sample, the hardware resources cannot be fully utilized, which greatly reduces the detection efficiency. In order to fully utilize the CPU and memory resources allocated for a single VM startup in the sandbox, we try to analyze multiple samples simultaneously in a single VM startup. In this scenario, if multiple Office documents or PDF sample files of the same type are run at the same time, the screenshot may show the problem of missing or obscured sample content during the dynamic operation of the sample: (i) Document content missing phenomenon: For example, first open Word document 1, then open Word document 2, and then take a screenshot. In the screenshot, only the content of document 2 can be seen, and the content of document 1 cannot be seen; (ii) Occlusion phenomenon: First open the Word document, then open the PDF document. At this time, the screenshot may show the PDF document content, part of the Word content, or the Word content, part of the PDF document content. Summary of the invention

[0003] (I) Purpose of the invention

[0004] The purpose of the present invention is to provide a dynamic screenshot method and system for running multiple samples in a virtual simulation environment, which provides a method for ensuring that the screenshots are correct and do not interfere with each other when running multiple samples in a virtual simulation environment. While improving the efficiency of sandbox detection, the present invention can ensure that the screenshots of each sample file during operation are accurate, and ensure that the pop-up windows or software interfaces between the samples do not overlap and interfere with each other, so as to ensure that the screenshots of multiple samples during simultaneous operation are correct.

[0005] (II) Technical solution

[0006] To solve the above problems, a first aspect of the present invention provides a dynamic screenshot method for running multiple samples in a virtual simulation environment, comprising:

[0007] According to the number of samples to be analyzed, a corresponding number of virtual desktops are created for the operating system;

[0008] Traverse the list of samples to be analyzed and deliver each sample to be analyzed to an independent desktop for running. Each independent desktop runs one sample. The independent desktop includes the default desktop of the operating system and the virtual desktop. The default desktop refers to the desktop where the user works after the system is started. The default desktop is named default and is created by the system. The virtual desktop refers to a desktop with a custom name created by the API CreateDesktop (create desktop) provided by the system. One sample is bound to one desktop.

[0009] Inject the HOOK module into the associated process started by the sample type to be analyzed;

[0010] Determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable the process separation technology according to the determination result;

[0011] Start the screenshot thread to perform the screenshot operation, and use the main thread to detect whether the sample to be analyzed has timed out. If it has timed out, stop the screenshot.

[0012] Further, determining whether to enable the process separation technology according to the judgment result includes:

[0013] If the type of the analyzed sample in the current process is Powerpnt or Adobe Reader, the process separation technology is enabled to achieve separation, and the process separation technology includes Event, Mutex, Semphore and Windows Instance Name.

[0014] Furthermore, the number of virtual desktops is the number of samples to be analyzed minus 1.

[0015] Furthermore, starting the screenshot thread to perform the screenshot operation includes:

[0016] After switching to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset period of time, then start the screenshot process to take a screenshot and save the screenshot image;

[0017] After the screenshot is saved, it stays on the original default desktop or virtual desktop for a second preset time period, and then switches to the next virtual desktop to continue screenshots until all independent desktops are traversed. The first sample to be analyzed after the system is started runs on the default desktop.

[0018] Further, the method of using the main thread to detect whether the sample to be analyzed has timed out, and stopping the screenshot if timed out, includes:

[0019] In the main thread, a cyclic sleep mode is set to detect whether the sample to be analyzed has timed out. If it has timed out, the screenshot thread is notified to stop taking screenshots.

[0020] Furthermore, the first time period is ≥4s, and the second preset time period is ≥1s.

[0021] Furthermore, after the virtual desktops are created, an Explorer process is started on each virtual desktop.

[0022] A second aspect of the present invention provides a dynamic screenshot system for running multiple samples in a virtual simulation environment, comprising:

[0023] A virtual desktop creation module is used to create a corresponding number of virtual desktops for the operating system according to the number of samples to be analyzed;

[0024] A sample delivery module is used to traverse the list of samples to be analyzed and deliver each sample to be analyzed to an independent desktop for execution. The independent desktop includes the default desktop of the operating system and the virtual desktop.

[0025] Injection HOOK module, used to inject the HOOK module into the associated process started by the sample type to be analyzed;

[0026] A process separation module, used to determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable the process separation technology according to the determination result;

[0027] The screenshot module is used to start the screenshot thread to perform the screenshot operation, and use the main thread to detect whether the sample to be analyzed has timed out. If so, the screenshot is stopped.

[0028] Furthermore, the process separation module is used to:

[0029] If the type of the analyzed sample in the current process is Powerpnt or Adobe Reader, the process separation technology is enabled to achieve separation, and the process separation technology includes Event, Mutex, Semphore and Windows Instance Name.

[0030] Furthermore, the screenshot module includes:

[0031] A screenshot saving unit, used to switch to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset time period, and then start the screenshot process to take a screenshot and save the screenshot image;

[0032] The desktop traversal unit is used to keep the screenshot on the original default desktop or virtual desktop for a second preset time period after saving it, and then switch to the next virtual desktop to continue taking screenshots until all independent desktops are traversed. The first sample to be analyzed after the system is started runs on the default desktop.

[0033] (III) Beneficial effects

[0034] The above technical scheme of the present invention has the following beneficial technical effects: the present invention provides a dynamic screenshot method and system for running multiple samples in a virtual simulation environment, in which each independent desktop runs a sample, and in order to ensure that the screen screenshots of multiple samples are correct during the simultaneous operation, virtual desktop technology and the same type of sample process separation technology are adopted, and the specific process is as follows: first, according to the number of samples to be analyzed, a corresponding number of virtual desktops are created for the operating system to ensure that each sample runs on an independent desktop, and ensure that the running screenshots of each sample do not interfere with each other, and the independent desktop includes the default desktop and the virtual desktop of the operating system; in order to solve the problem of missing or occluding content when multiple sample screenshots are run simultaneously in the same VM, the process separation technology is adopted, and the HOOK module is injected into the associated process started by the sample type to be analyzed; the type of analysis sample in the current process is judged by the HOOK module, and if it is Powerpnt or AdobeReader, multiple process separation technologies are enabled to achieve separation requirements. Finally, the screenshot thread is started to perform periodic screenshot operations, and the main thread is used to detect whether the sample to be analyzed has timed out. If it has timed out, the screenshot is stopped, and the main thread and the screenshot thread are executed concurrently to complete the screenshot process. This method improves the efficiency of sandbox detection and ensures that the screenshots of each sample file are accurate during operation, and that the pop-up windows or software interfaces between samples do not overlap and interfere with each other, just like taking screenshots of a single sample. Figure 1 The sample is clean, ensuring that the screenshots of multiple samples are correct during simultaneous operation. The present invention is designed to start a sandbox once, and multiple samples can be analyzed at the same time. Each sample runs in an independent virtual desktop space, and screenshots are taken in each independent desktop. The running screenshots of each sample do not interfere with each other. The present invention can ensure the accuracy of screenshots for detection and analysis of multiple samples when using a sandbox, and will not reduce the user's sensory experience due to the chaotic superposition of screenshots, thereby improving the hardware detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the traditional sandbox analysis architecture in the prior art;

[0036] Figure 2 is a flow chart of a dynamic screenshot method for running multiple samples in a virtual simulation environment according to the present invention;

[0037] Figure 3is a sandbox analysis architecture diagram of a specific embodiment of the present invention;

[0038] Figure 4 It is a flow chart of a specific embodiment of the present invention;

[0039] Figure 5 It is a flow chart of a dynamic screenshot system for running multiple samples in a virtual simulation environment according to the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0041] like Figure 2 As shown, the first aspect of the present invention provides a dynamic screenshot method for running multiple samples in a virtual simulation environment, comprising:

[0042] Step 101, according to the number of samples to be analyzed, a corresponding number of virtual desktops are created for the operating system, and each virtual desktop only runs one sample. A virtual desktop is a software operating environment in a virtual machine (VM). A hardware environment (such as a computer) corresponds to a sandbox analysis system. A sandbox analysis system can run multiple different VMs. One VM corresponds to multiple virtual desktops, and multiple different samples (of the same type or different types) are delivered to the same VM. In the present invention, multiple samples are detected simultaneously in one VM, such as Figure 3 As shown, in the architecture of the present invention, for example, one VM can run three samples at the same time, and multiple different samples (same type or different types) can be delivered to the same VM, each sample is on an independent virtual desktop, ensuring that only the sample content is displayed on each sample screenshot. Figure 1 As shown in Figure 4 As shown, a corresponding number of virtual desktops are created according to the number of samples to be analyzed, and the number of virtual desktops is the number of samples to be analyzed minus 1. For example, if a VM analyzes 3 samples at the same time, 2 virtual desktops need to be created. After the virtual desktops are created, an Explorer process is started on each virtual desktop. In order to avoid the situation where the background is empty when taking screenshots, an Explorer process is created for each virtual desktop.

[0043] Step 102, traverse the list of samples to be analyzed and deliver each sample to be analyzed to an independent desktop for running. The independent desktop includes the default desktop of the operating system and the virtual desktop. According to the number of samples to be analyzed, they are delivered to different independent desktops in turn, and each sample runs on an independent desktop. The first sample is in the default desktop, the second is in the first virtual desktop, the third is in the second virtual desktop, and so on. For example, if three samples are to be analyzed simultaneously in a VM, the first sample runs on the default desktop, the second sample runs on virtual desktop 1, and the third sample runs on virtual desktop 2.

[0044] Step 103, inject the HOOK module into the associated process started by the sample type to be analyzed. If the sample (sample to be analyzed) is an executable program, create a process in the manner of specifying the virtual desktop to run; if the sample is a document type (Office document, PDF document, etc.), create a corresponding associated program and open the document, and associate the associated program to the corresponding virtual desktop when it is started. Monitor the startup of the process corresponding to the sample at the driver layer, and inject the HOOK module into the process at the application layer.

[0045] Step 104, determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable process separation technology based on the determination result. Since the programs associated with Office documents and PDF type documents run in a single-process multi-document mode, in order to solve the problem of screenshot interference when running more than two documents of the same type at the same time, each document must run in its own exclusive process. In this case, HOOK technology is required. If the type of analysis sample in the current process is Powerpnt or Adobe Reader, process separation technology is enabled to achieve separation requirements. Determine whether the current process is a document process such as Powerpnt or Adobe Reader through the HOOK module. If so, multiple openings are achieved by separating Event, Mutex, Semphore, and Windows Instance Name. The following is a detailed description of the process separation technology: In order to solve the problem of missing or blocked content when running multiple sample screenshots in the same VM, the HOOK technology is used to process the relevant API parameters of the process to determine whether the instance is running (for example, to open two PDF files, the file names are PDF1 and PDF2. Double-clicking the PDF1 file will start Adobe Reader process 1, and double-clicking PDF2 will start Adobe Reader process 2. At this time, the started Adobe Reader process 2 will determine whether there is already an Adobe Reader process running. If there is, PDF2 will be notified to Adobe Reader process 1 through inter-process communication. After the notification, Adobe Reader process 2 will exit) to enable each document to run in the corresponding exclusive process. For example, in order to enable a PDF document to run in an Adobe process, it is necessary to rename the lpName parameter in CreateMutexW and the lpName parameter in CreateSemaphoreW, and determine the return of the NULL operation for the lpClassName in FindWindowW. The prototypes of CreateMutexW, CreateSempaphoreW, and FindWindowW functions are as follows:

[0046]

[0047] In order to make each PPT document run in an independent PowerPnt process, the lpName parameter of CreateEventA needs to be renamed. The prototype of CreateEventA is as follows:

[0048]

[0049] Step 105, start the screenshot thread to perform the screenshot operation, and use the main thread to detect whether the sample to be analyzed has timed out, and stop the screenshot if it has timed out. Starting the screenshot thread to perform the screenshot operation includes:

[0050] Step 1051, after switching to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset time period, then start the screenshot process to take a screenshot and save the screenshot image. Create a screenshot thread, first obtain the sample associated with each default desktop or virtual desktop in the screenshot thread, then call the Windows API to switch to the default desktop or virtual desktop of the sample and stay for a first preset time period, the first preset time period ≥ 4s to avoid the residual image of the previous desktop, for example, it can be set to 4 seconds.

[0051] Step 1052, after the screenshot is saved, it continues to stay on the original default desktop or virtual desktop (the independent desktop of step 1051) for a second preset time period, and then switches to the next virtual desktop to continue screenshots until all independent desktops are traversed, where the first sample to be analyzed after the system starts runs on the default desktop. Start the screenshot process on the original desktop to take a screenshot, and save it to the specified directory with the sample file name as the image prefix. Finally, stay on the original desktop for a second preset time period. The second preset time period ≥ 1s, for example, it can be set to 1 second before taking the next virtual desktop screenshot until the last desktop traversal is completed. Each independent desktop stays for at least 5 seconds in two preset time periods to better achieve periodic switching of each desktop.

[0052] In addition, in step 105, the main thread is used to detect whether the sample to be analyzed has timed out, and if it has timed out, the screenshot is stopped, including: in the main thread, a cyclic sleep mode is set to detect whether the sample to be analyzed has timed out, and if it has timed out, the screenshot thread is notified to stop the screenshot. In the main thread, the sample analysis time is detected by cyclic sleep mode, and the timeout time is generally set to 1 to 10 minutes. If it has timed out, the screenshot thread is notified to stop the screenshot, and if it has not timed out, it continues to wait.

[0053] The following is a detailed description of the process of the dynamic screenshot method in conjunction with a specific embodiment, which uses a Win10 sandbox environment:

[0054] The first step is to use GetTokenInformation to get the explorer process Token and determine whether the Token is a restricted token (to ensure that the default desktop Explorer process permissions are consistent with the Explorer process permissions in the sandbox desktop). In order to keep the explorer permissions in the created virtual desktop consistent with the explorer permissions in the default desktop, if it is a restricted token, use DuplicateTokenEx to copy the token to the g_hLimitToken object. In this embodiment, the sandbox analyzes 3 samples at a time, and it is necessary to use CreateDesktop to create two additional virtual desktops. Assume that the virtual desktop names are "SandBox Desktop 1" (Sandbox Desktop 1, Virtual Desktop 1) and "SandBox Desktop2" (Sandbox Desktop 2, Virtual Desktop 2). See the attached Figure 4 Step S1.

[0055] In the second step, use SwitchDesktop (switch desktop) and SetThreadDesktop (set thread desktop) to switch to the newly created virtual desktop. If the first step determines that the default explorer is a restricted token, use CreateProcessAsUser (user token to create a process) first to use the first step g_hLimitToken to create an explorer process and set lpDesktop in the STARTUP parameter to bind the virtual desktop to start. If the function fails to create, use CreateProcessWithToken (specify the token to create a process) to create it. If the first step determines that it is not a restricted token, use CreateProcess to create and start the explorer process. See the attached Figure 4 Step S2.

[0056] In the third step, the three samples are started by using CreateProcess and the STARTUP parameter lpDesktop specifies the name of the running desktop. In the first sample, lpDesktop specifies "Default". In the second sample, lpDesktop specifies "SandboxDesktop 1". In the third sample, lpDektop specifies "SandBox Desktop 2". See the attached file. Figure 4 Step S3.

[0057] The fourth step is to inject the application layer monitoring module BehaviorMon.dll (behavior monitoring) into the LoadImageNotifyRoutine (module loading notification routine) callback of the sandbox driver when ntdll is loaded. See the attached Figure 4 Step S4.

[0058] Step 5. Use GeModuleFileName (get module name) in BehaviorMon.dll (behavior monitoring) module to get the process name and determine whether the process name is an Office process such as Powerpnt.exe. If the CreateEventA (create event) function is hooked, rename the event names with the prefix "PPT11Running_" (PPT11 instance running) and "PPT12Running_" (PPT12 instance running) to "PPT11Running_<process PID>" or "PPT12Running_<process PID>". If it is determined to be a PDF process such as Adobat.exe, hook CreateMutexW (create mutex), CreateSemaphoreW (create semaphore), FindWindowW (find window). In the HOOK function corresponding to CreateMutexW, rename the mutex "Acrobat Instance Mutex" (Acrobat instance mutex), rename the semaphore "ACROSEMAPHORE" in the HOOK function corresponding to CreateSemaphoreW, and return NULL when detecting the "Acrobat Instance Window Class" window class in the HOOK function corresponding to FindWindowW. Implement multiple PPT samples and PDF samples of the same type, each sample in an independent process, see the attached Figure 4 Step S5.

[0059] Step 6: Create a screenshot thread. In the screenshot thread, first obtain the samples associated with each virtual desktop, then call SwitchDesktop and SetThreadDesktop to switch to the sample virtual desktop. In order to avoid the image of the previous desktop from staying for 4 seconds, start the screenshot process on the desktop to take a screenshot, and save it to a specific directory with the sample file name as the image prefix. Finally, after staying on the desktop for 1 second, take a screenshot of the next virtual desktop, until the last desktop traversal is completed. See the attached file. Figure 4 Step S6.

[0060] Step 7: Check whether the sample analysis time has timed out in the main thread. If so, stop the screenshot thread. If not, continue waiting. See attached. Figure 4 Step S7.

[0061] like Figure 5 As shown, the second aspect of the present invention provides a dynamic screenshot system for running multiple samples in a virtual simulation environment, comprising:

[0062] A virtual desktop creation module 21 is used to create a corresponding number of virtual desktops for the operating system according to the number of samples to be analyzed;

[0063] A sample delivery module 22, used for traversing the list of samples to be analyzed and delivering each sample to be analyzed to an independent desktop for execution, wherein the independent desktop includes a default desktop of the operating system and the virtual desktop;

[0064] Injection HOOK module 23, used to inject the HOOK module into the associated process started by the sample type to be analyzed;

[0065] A process separation module 24, used to determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable the process separation technology according to the determination result;

[0066] The screenshot module 25 is used to start the screenshot thread to perform the screenshot operation, and at the same time use the main thread to detect whether the sample to be analyzed has timed out. If it has timed out, the screenshot is stopped.

[0067] Furthermore, the process separation mold 24 is used for:

[0068] If the analysis sample in the current process is Powerpnt or Adobe Reader, multiple process separation technologies are enabled to achieve separation requirements, and the separation technologies include Event, Mutex, Semphore and Windows Instance Name.

[0069] Furthermore, the screenshot module 25 includes:

[0070] The screenshot saving unit 251 is used to switch to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset time period, and then start the screenshot process to take a screenshot and save the screenshot image;

[0071] The desktop traversal unit 252 is used to keep the screenshot on the original default desktop or virtual desktop for a second preset time period after saving, and then switch to the next virtual desktop to continue taking screenshots until all independent desktops are traversed, where the first sample to be analyzed after the system is started runs on the default desktop.

[0072] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. In addition, the claims attached to the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the attached claims, or the equivalent forms of such scope and boundaries. It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps of the functions specified in one or more boxes. Those of ordinary skill in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes the following processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (Read-Only Memory, referred to as ROM) or a random access memory (Random Access Memory, referred to as RAM), etc. The steps in the method of the embodiment of the present invention can be adjusted in sequence, merged and deleted according to actual needs. The module units in the system terminal or device of the embodiment of the present invention can be merged, divided and deleted according to actual needs.

Claims

1. A dynamic screenshot method for running multiple samples in a virtual simulation environment, characterized in that: include: According to the number of samples to be analyzed, a corresponding number of virtual desktops are created for the operating system; Traversing the list of samples to be analyzed and delivering each sample to be analyzed to an independent desktop for execution, wherein the independent desktop includes a default desktop of the operating system and the virtual desktop; Inject the HOOK module into the associated process started by the sample type to be analyzed; Determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable the process separation technology according to the determination result; Start the screenshot thread to perform the screenshot operation, and use the main thread to detect whether the sample to be analyzed has timed out. If so, stop the screenshot.

2. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 1, characterized in that: Determining whether to enable the process separation technology according to the judgment result includes: If the type of the analyzed sample in the current process is Powerpnt or Adobe Reader, the process separation technology is enabled to achieve separation. The process separation technology includes Event, Mutex, Semphore and WindowsInstance Name.

3. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 1, characterized in that: The number of virtual desktops is the number of samples to be analyzed minus 1.

4. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 1, characterized in that: The starting of the screenshot thread to perform the screenshot operation includes: After switching to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset period of time, then start the screenshot process to take a screenshot and save the screenshot image; After the screenshot is saved, it stays on the original default desktop or virtual desktop for a second preset time period, and then switches to the next virtual desktop to continue screenshots until all independent desktops are traversed. The first sample to be analyzed after the system is started runs on the default desktop.

5. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 1, characterized in that: The method of using the main thread to detect whether the sample to be analyzed has timed out, and stopping the screenshot if timed out, includes: In the main thread, a cyclic sleep mode is set to detect whether the sample to be analyzed has timed out. If it has timed out, the screenshot thread is notified to stop taking screenshots.

6. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 4, characterized in that: The first time period is ≥4s, and the second preset time period is ≥1s.

7. The method for dynamic screenshot of running multiple samples in a virtual simulation environment according to claim 1, characterized in that: After the virtual desktops are created, start the Explorer process on each virtual desktop.

8. A dynamic screenshot system for running multiple samples in a virtual simulation environment, characterized in that: include: A virtual desktop creation module is used to create a corresponding number of virtual desktops for the operating system according to the number of samples to be analyzed; A sample delivery module, used to traverse the list of samples to be analyzed and deliver each sample to be analyzed to an independent desktop for execution, wherein the independent desktop includes the default desktop of the operating system and the virtual desktop; Injection HOOK module, used to inject the HOOK module into the associated process started by the sample type to be analyzed; A process separation module, used to determine the type of analysis sample in the current process through the HOOK module, and determine whether to enable the process separation technology according to the determination result; The screenshot module is used to start the screenshot thread to perform the screenshot operation, and use the main thread to detect whether the sample to be analyzed has timed out. If so, the screenshot is stopped.

9. The dynamic screenshot system for running multiple samples in a virtual simulation environment according to claim 8, characterized in that: The process separation module is used for: If the type of the analyzed sample in the current process is Powerpnt or Adobe Reader, the process separation technology is enabled to achieve separation. The process separation technology includes Event, Mutex, Semphore and WindowsInstance Name.

10. The dynamic screenshot system for running multiple samples in a virtual simulation environment according to claim 8, characterized in that: The screenshot module includes: A screenshot saving unit, used to switch to the default desktop or virtual desktop of the sample to be analyzed, stay for a first preset time period, and then start the screenshot process to take a screenshot and save the screenshot image; The desktop traversal unit is used to keep the screenshot on the original default desktop or virtual desktop for a second preset time period after saving it, and then switch to the next virtual desktop to continue taking screenshots until all independent desktops are traversed. The first sample to be analyzed after the system is started runs on the default desktop.

Images