Windows system-oriented file association protection method and device and computer equipment

Abstract

The invention discloses a file association protection method and device oriented to a Windows system and computer equipment. The method comprises the following steps: in response to an opening instruction of a target file, intercepting a reading request for a file association item of the target file through a kernel driver of a Windows system and / or an agent program of an application layer, and generating first file association data based on system feature data; and returning the first file associated data to a reading source process of the reading request, so that the reading source process starts an application program specified by a user based on the first file associated data to open the target file. According to the method provided by the invention, a dual defense line is established through the driving layer and the application layer, so that a file associated item tampering protection mechanism of a Windows operating system is effectively broken through, and the reading requests initiated by a third-party program can be intercepted, so that the robustness and the countermeasure resistance of the protection method are greatly improved; personalized requirements of file opening and security and stability of system relevance are considered.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus and computer device for file association protection for Windows systems. Background Technology

[0002] File association is a core mechanism in the Windows operating system for managing how files are opened. The frequent occurrence of third-party processes changing file opening methods without user permission severely impacts the user experience. Therefore, preventing unauthorized changes to file opening methods is crucial.

[0003] In existing technologies, Microsoft introduced a strong protection mechanism in Windows 11, represented by the UserChoiceLatest registry key, which uses a complex internal hash algorithm to verify the legitimacy of file association settings. However, existing technologies, such as conventional registry modifications and static hooks, are easily detected and rendered ineffective by the Windows system in real time, and lack effective runtime self-protection mechanisms. This makes them not only difficult to defend against malicious programs illegally modifying file associations, but also vulnerable to being overwritten or bypassed by malicious programs with higher privileges. Consequently, legitimate custom file association configurations cannot be stably maintained, and the security and stability of system file openings and file associations cannot be guaranteed. Summary of the Invention

[0004] In view of this, this application provides a file association protection method, apparatus and computer device for Windows systems, which dynamically generates and returns legitimate file association data through the driver layer and application layer, thereby achieving persistent, covert and difficult-to-detect or bypass hijacking and control of the default file opening program of the Windows system.

[0005] According to a first aspect of this application, a file association protection method for Windows systems is provided, the method comprising: In response to an open command for a target file, the system intercepts requests to read file association entries of the target file through a kernel driver and / or an application-layer proxy program of the Windows system, and generates first file association data based on system feature data. The file association entries are used to guide the application corresponding to the file association entries to open the target file. The proxy program is injected into the file resource management process when the Windows system's file resource management process restarts, and modifies the entry code of the API function used to read file association entries in the file resource management process after injection. The first file association data is returned to the reading source process of the reading request, so that the reading source process can launch the user-specified application to open the target file based on the first file association data, wherein the reading source process includes the file resource management process.

[0006] Optionally, the file association protection method for Windows systems further includes: Register the agent program to the DeskBand extension object of the file resource management process; In response to the restart command of the file resource management process, a programming interface or operating system shell interaction object is invoked to activate and display the DeskBand extended object in the file resource management process, so as to inject the agent program into the file resource management process.

[0007] Optionally, the file association protection method for Windows systems further includes: The monitoring thread is invoked to monitor the modification operations of the entry code, as well as the loading operations or thread creation operations of non-whitelisted programs in the file resource management process. In response to the modification of the entry code, a write-back repair operation is performed on the entry code through the agent program to maintain the continuity of the agent program; In response to the loading operation or the thread creation operation creation request, the loading operation or the thread creation operation creation request is intercepted and filtered.

[0008] Optionally, the file association protection method for Windows systems further includes: In response to the first write request to the file association, the first write request to the file association is intercepted in the kernel driver, and the write source process that initiated the first write request is obtained; If the characteristics of the writing source process match those of a malicious process, then the write operation corresponding to the first write request is refused.

[0009] Optionally, the file association protection method for Windows systems further includes: If the characteristics of the writing source process do not match the characteristics of a malicious process, the second file associated data indicated by the first write request is stored in a kernel-protected cache. Create a system worker thread in the kernel driver that is distinct from the writing source process; The system worker thread writes the second file association data in the cache into the file association item.

[0010] Optionally, the file association protection method for Windows systems further includes: The registry callback function is invoked to monitor read and write requests for the file association entries in the kernel driver.

[0011] Optionally, generating the first file association data based on system feature data includes: Get the Windows system version data; The system fixed string, the identifier of the user-specified application, and the system environment data are concatenated in a preset order associated with the version data to form a feature string. The system environment data includes a system identifier, a user security identifier, and a current timestamp. The preset order is obtained through a reverse assembly tool. The feature string is compressed to determine the feature data; A hash operation is performed based on the feature data to generate the hash value in the first file association data.

[0012] Optionally, the proxy program is implemented as a dynamic link library.

[0013] According to a second aspect of this application, a file association protection device for Windows systems is provided, the device comprising: A dynamic protection module, in response to an open command for a target file, intercepts requests to read file association entries of the target file via a Windows system kernel driver and / or an application-layer proxy program, and generates first file association data based on system characteristic data. The file association entries guide the application corresponding to the file association entries to open the target file. The proxy program is injected into the Windows system's file resource management process upon restart, and modifies the entry code of the API function used to read file association entries within the file resource management process after injection. The first file association data is returned to the reading source process of the reading request, so that the reading source process can launch the user-specified application to open the target file based on the first file association data, wherein the reading source process includes the file resource management process.

[0014] Optionally, the file association protection device for Windows systems further includes: An injection module is used to register the agent program with the DeskBand extension object of the file resource management process; in response to the restart command of the file resource management process, it calls a programming interface or operating system shell interaction object to activate and display the DeskBand extension object in the file resource management process, so as to inject the agent program into the file resource management process.

[0015] Optionally, the file association protection device for Windows systems further includes: The program maintenance module is used to call the monitoring thread to monitor the modification operations of the entry code, as well as the loading operations or thread creation operations of non-whitelisted programs in the file resource management process; in response to the modification of the entry code, it performs a write-back repair operation on the entry code through the proxy program to maintain the continuity of the proxy program; in response to the loading operation or the thread creation operation establishment request, it intercepts and filters the loading operation or the thread creation operation establishment request.

[0016] Optionally, the file association protection device for Windows systems further includes: The static protection module is used to intercept the first write request to the file association item in the kernel driver in response to the first write request, and to obtain the write source process that initiated the first write request; if the characteristics of the write source process match the characteristics of a malicious process, the write operation corresponding to the first write request is refused to be executed.

[0017] Optionally, the static protection module is further configured to, if the characteristics of the writing source process do not match the characteristics of a malicious process, store the second file association data indicated by the first write request in a kernel-protected cache; create a system worker thread in the kernel driver that is different from the writing source process; and write the second file association data in the cache into the file association item through the system worker thread.

[0018] Optionally, the file association protection device for Windows systems further includes: The driver monitoring module is used to call registry callback functions to monitor read and write requests for the file association items in the kernel driver.

[0019] Optionally, the dynamic protection module is specifically used to obtain the version data of the Windows system; concatenate the system fixed string, the identifier of the user-specified application, and system environment data in a preset order associated with the version data to form a feature string, wherein the system environment data includes a system identifier, a user security identifier, and a current timestamp, and wherein the preset order is obtained through a reverse assembly tool; compress the feature string to determine feature data; and perform a hash operation based on the feature data to generate a hash value in the first file association data.

[0020] Optionally, the proxy program is implemented as a dynamic link library.

[0021] According to a third aspect of this application, a readable storage medium is provided on which a program or instructions are stored, which, when executed by a processor, implement the steps of the file association protection method for Windows systems described above.

[0022] According to a fourth aspect of this application, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the file association protection method for Windows systems described above.

[0023] By employing the aforementioned technical solution, a kernel driver and / or application-layer proxy program intercepts file association read requests for the target file from the underlying layer and dynamically generates and returns first file association data that conforms to Windows system verification rules. On one hand, without directly modifying protected registry keys, the legitimate first file association data triggers the system's file resource management process to open the target file using a user-specified legitimate application. This not only effectively bypasses the Windows operating system's file association tampering protection mechanism, solving the problem of traditional registry-modified protected association configurations being detected and repaired by the system, but also intercepts read requests initiated by third-party programs, preventing malicious programs from tampering with file associations. On the other hand, the proxy program performs API hooking the moment the file resource management process restarts, ensuring that subsequent read requests are intercepted by the proxy program, guaranteeing the persistent effectiveness of legitimate custom association configurations. Furthermore, by establishing a dual defense at the driver and application layers, the robustness and anti-attack capabilities of the protection method are greatly improved, balancing personalized file opening needs with the security and stability of system associations.

[0024] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating the file association protection method for Windows systems provided in an embodiment of this application is shown. Figure 2 This paper illustrates a schematic diagram of the system architecture for a file association protection method for Windows systems provided in an embodiment of this application. Figure 3This paper shows a structural block diagram of a file association protection device for Windows systems provided in an embodiment of this application; Figure 4 A schematic diagram of the electronic structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0026] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0027] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0028] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “attached” to another element, it can be directly connected or attached to the other element, or there may be intermediate elements. Furthermore, “connected” or “attached” as used herein can include wireless connections or wireless interconnections. The term “and / or” as used herein includes all or any unit and all combinations of one or more associated listed items.

[0029] Exemplary embodiments according to this application will now be described in more detail with reference to the accompanying drawings. However, these exemplary embodiments may be implemented in many different forms and should not be construed as being limited to the embodiments set forth herein. It should be understood that these embodiments are provided so that the disclosure of this application is thorough and complete, and that the concept of these exemplary embodiments is fully conveyed to those skilled in the art.

[0030] This embodiment provides a file association protection method for Windows systems, such as... Figure 1 As shown, the method includes: Step 101: In response to the open command of the target file, intercept the read request of the file association item of the target file through the kernel driver of the Windows system and / or the agent program of the application layer, and generate the first file association data based on the system feature data.

[0031] The file association item includes an application identifier (ProgId) and a hash value. The application identifier guides the opening of the target file through the corresponding application, while the hash value is used by the Windows system to verify whether the ProgId is legitimately authorized.

[0032] It's worth noting that the application-layer agent is injected into the Windows file resource management process upon restart. This allows the agent's code to run immediately within the process space and permission context of the file resource management process (explorer.exe), avoiding failures caused by injection delays. After injection, the agent modifies the entry point code of the API function (RegQueryValueEx) used to read file association entries in the file resource management process. This ensures that whenever any code within explorer.exe calls RegQueryValueEx to attempt to query the registry (including querying UserChoice), the system's execution flow is forcibly redirected to the agent. At the driver level, registry callback functions can be called to monitor file association entry read requests in the kernel driver.

[0033] In this embodiment, the kernel driver and / or application-layer agent do not actually call the original API functions to read file association entries in memory that may have been tampered with or require protection. Instead, they calculate first file association data containing a specified application identifier and a valid hash value in real time, and use this first file association data to replace the data already written to the file association entries in memory. Therefore, it does not rely on the vulnerable physical storage of the registry on disk, thus bypassing the Windows system's write protection mechanism for file association entries. Furthermore, even if a malicious program modifies the physical registry, the data read by the file resource management process is always the correct first file association data.

[0034] In one embodiment, the agent is implemented as a dynamic link library (DLL).

[0035] In practical application scenarios, for application agent programs and kernel drivers, step 101, which generates the first file association data based on system feature data, specifically includes: obtaining the version data of the Windows system; concatenating the system fixed string, the identifier of the user-specified application, and system environment data in a preset order associated with the version data to form a feature string; compressing the feature string to determine the feature data; and performing a hash operation based on the feature data to generate the hash value in the first file association data.

[0036] The system environment data includes a system identifier, a user security identifier, and a current timestamp. The preset order is obtained using a reverse engineering tool.

[0037] In this embodiment, based on Windows system version data, system environment data such as a fixed system string, user-specified application identifier and system identifier, user security identifier, and current timestamp are concatenated in a system-preset order obtained through reverse assembly. Then, the characteristic string is compressed using a function and a hash operation is performed to generate a dynamic hash value. This ensures that the hash value conforms to the file association hash verification logic in Windows 11 and later versions, guaranteeing that the generated association data is legal and valid and cannot be detected and repaired by the system. Furthermore, by following the system's native concatenation order and relying on internal system dynamic link libraries for processing, it overcomes the technical bottleneck of traditional plaintext concatenation failing to generate valid hashes.

[0038] For example, taking a proxy program (DLL) as an example, after the DLL injects into the file resource management process (explorer.exe), it immediately hooks the RegQueryValueEx series of functions and executes the following logic: 1. Detect system version. For Windows 11 and above, enter the enhanced algorithm branch. Specifically, read HKEY_LOCAL_MACHINE\Software\Microsoft\SqmClient\MachineID, remove the leading and trailing curly braces {} to obtain the clean MachineGUID (system identifier), and obtain system characteristic data of Win11 and above such as UserSID (user security identifier) ​​and Time (current timestamp string).

[0039] 2. Concatenate the string according to the specific order of the system version obtained in reverse: FixedString (system fixed string) + Extension (system environment suffix) + Time + MachineGUID + ProgId (user-specified application identifier) ​​+ SID.

[0040] 3. The Windows 11 algorithm requires compression of the concatenated string. The DLL can load the system component Windows.Internal.OpenWithHost.dll, locate the undocumented compression function inside by using "base address + hard-coded offset (such as 0x658e8)", and use this function to obtain the compressed binary data of the concatenated string.

[0041] 4. Perform the final hash calculation on the compressed binary data using the system's desired operational logic.

[0042] 5. Intercept Explorer's read requests, return the calculated valid hash and correct ProgId to explorer.exe, and make explorer.exe execute it as the system default setting.

[0043] Understandably, the kernel driver can use the exact same algorithms and logic as the application layer to calculate and generate dynamic hash values. However, since the driver layer cannot directly and securely call the user-space OpenWithHost.dll, a kernel module containing the hash algorithm and compression functions can be pre-embedded in the kernel driver, allowing the kernel driver to directly perform hash value calculations using kernel algorithm functions.

[0044] Step 102: Return the first file association data to the reading source process of the reading request, so that the reading source process can start the user-specified application to open the target file based on the first file association data.

[0045] The source process for reading can be the system's file resource management process, or it can be a malicious process, other security processes, or other processes that attempt to read the configuration items associated with the file.

[0046] The file association protection method for Windows systems provided in this application intercepts file association read requests from the target file at the underlying level through a kernel driver and / or application-layer agent program, and dynamically generates and returns first file association data that conforms to Windows system verification rules. On one hand, without directly modifying protected registry keys, the system's file resource management process triggers a user-specified legitimate application to open the target file using the legitimate first file association data. This not only effectively bypasses the Windows operating system's file association tampering protection mechanism and solves the problem of traditional registry-modified protection association configurations being detected and repaired by the system, but also intercepts read requests initiated by third-party programs, preventing malicious programs from tampering with file associations. On the other hand, the agent program completes API hooking the moment the file resource management process restarts, ensuring that subsequent read requests are intercepted by the agent program, guaranteeing the persistent effectiveness of legitimate custom association configurations. Furthermore, by establishing a dual defense at the driver and application layers, the robustness and anti-attack capabilities of the protection method are greatly improved, balancing personalized file opening needs with the security and stability of system associations.

[0047] For example, such as Figure 2 This paper illustrates a layered technical architecture for implementing custom file associations in Windows systems, including two layers: user mode (RING 3) and kernel mode (RING 0).

[0048] The user-mode layer employs process injection technology. Within the File Explorer process (Explorer.exe), the DeskBand module is automatically activated via a COM interface. Upon system startup, the DeskBand module hooks relevant APIs to enable proxy program injection during process restarts, preparing for subsequent interception. Furthermore, targeting Win11's UserChoice protection mechanism, it calls exported functions (such as 0x6558E) in the system's internal OpenWithHost.dll to generate valid hashes according to system rules.

[0049] At the kernel level, driver logic is used to achieve secure interaction between user mode and kernel mode through a read-only IO cache (user context) and a System Thread with PID 4 (system context). The kernel callback mechanism is used to intercept UserChoiceLatest read requests in the registry query callback (RegNtPreQueryValueKey), preventing the process from reading the raw registry value on disk. Instead, a valid hash is calculated in memory using the system's internal hash algorithm, and a custom valid hash is returned to achieve custom file association. This is combined with cloud-based blacklisting for process blocking (CloudIntelligence), protecting critical resources (Windows Registry), such as the UserChoice registry, from malicious tampering.

[0050] It's worth noting that when a user attempts to open a file, the request is first intercepted by the user-space layer's proxy within the current process space, and the user-space layer returns the correct initial file association data. When the user-space request is checked and allowed by a hook, or when it actively communicates via DeviceIoControl (IOCTL), the user-space module may proactively call DeviceIoControl to send a request to the kernel driver. Further, upon receiving the IOCTL, the kernel driver checks if the filename contains a specific identifier indicating that the application layer has already processed it, or queries the application layer's controlled thread list to see if the thread that initiated the request is present. If it is, it indicates that the application layer has intervened, and the driver performs the appropriate processing before ending the call without triggering kernel callback defenses to prevent further interception.

[0051] In one embodiment, prior to step 101, the file association protection method for Windows systems further includes: registering the agent program with the DeskBand extension object of the file resource management process; and, in response to a restart instruction from the file resource management process, calling a programming interface or an operating system shell interaction object to activate and display the DeskBand extension object in the file resource management process, so as to inject the agent program into the file resource management process.

[0052] In this embodiment, the agent program is registered to the DeskBand extension object of the file resource management process. Upon process restart, the extension object is activated and displayed via a programming interface or system shell interaction object to complete the agent program injection. This leverages the native process embedding feature of the DeskBand extension object, ensuring timely and stable loading of the agent program upon file resource management process restart, avoiding the timing delays and susceptibility to system interception issues of traditional injection methods. Furthermore, the native system interaction interface enables automated DeskBand extension startup, allowing the agent program to be automatically loaded after the file resource management process restarts without user intervention. This achieves zero-interference persistent injection, providing a stable and tamper-proof in-process execution environment for subsequent interception of file association read requests and implementation of custom file association configurations.

[0053] For example, during software installation, the DLL is registered to the DeskBand extension object of File Explorer. Then, COM interfaces (such as ITrayDeskBand related interfaces) are called or the ShellBrowser object is manipulated to programmatically set the DeskBand state to "display," thus addressing the pain point of traditional DeskBands requiring users to manually enable the toolbar.

[0054] In one embodiment, after the agent program is injected into the file resource management process, the file association protection method for the Windows system further includes: calling the monitoring thread to monitor the modification operation of the entry code, as well as the loading operation or thread creation operation of non-whitelisted programs in the file resource management process; in response to the entry code being modified, performing a write-back repair operation on the entry code through the agent program to maintain the continuity of the agent program; and in response to the loading operation or thread creation operation establishment request, intercepting and filtering the loading operation or thread creation operation establishment request.

[0055] In this embodiment, the stability of the proxy program is monitored by a monitoring thread on modifications to the entry code of the API function used to read file association items in the file resource management process, as well as the loading and thread creation operations of non-whitelisted programs. When modification or overwriting of the entry code is detected, it is immediately written back to repair the issue, ensuring the proxy program's control over jumps to the API function. Similarly, when loading operations or thread creation requests from non-whitelisted programs are detected, they are intercepted to prevent code injection and thread interference from unauthorized programs. This helps isolate the proxy program's runtime environment within the file resource management process from third-party interference. Therefore, it effectively resists malicious programs from affecting the proxy program's operation through code tampering and injection of illegal processes / threads, improving the stability and security of the proxy program's file association configuration.

[0056] For example, such as Figure 2As shown, an independent monitoring thread is established to periodically poll the Hook header instruction (JMP) of RegQueryValueEx. If it is found to be overwritten, it is immediately rewritten to repair, ensuring that the agent program can always hook the API functions used to read file association items in the file resource management process. At the same time, it monitors Hook LoadLibrary (hook program loading operation) and CreateRemoteThr (thread creation operation). When a non-whitelisted module is detected attempting to inject into the file resource management process, it is directly intercepted or suspended to prevent malicious DLLs from damaging the protection logic.

[0057] In one embodiment, the file association protection method for Windows systems further includes: in response to a first write request for a file association item, intercepting the first write request for the file association item in the kernel driver and obtaining the write source process that initiated the first write request; if the characteristics of the write source process match the characteristics of a malicious process, refusing to execute the write operation corresponding to the first write request; if the characteristics of the write source process do not match the characteristics of a malicious process, storing the second file association data indicated by the first write request in a kernel-protected cache; creating a system worker thread in the kernel driver that is different from the write source process; and writing the second file association data in the cache into the file association item through the system worker thread.

[0058] It is understood that the characteristics of malicious processes can be obtained synchronously from the cloud and can be reasonably set according to needs. This application does not impose specific limitations on these characteristics.

[0059] In this embodiment, Microsoft introduces a strong protection mechanism in Windows 11 systems, implemented by the kernel-level driver UCPD (User Choice Protection Driver) for write protection. UCPD verifies the call context of the write operation. Even if a normal driver uses ZwSetValueKey, if it is triggered by the application layer through DeviceIoControl, its call stack still belongs to the user process, and it will be identified and intercepted by UCPD, returning ACCESS_DENIED. To allow users to set specific programs to be intercepted by UCPD, after any process initiates a static first write request, the kernel driver intercepts this first write request and first verifies whether the characteristics of the write source process are malicious. If a malicious process is detected, the write operation is refused, blocking the risk of illegal tampering from the bottom layer. Conversely, if it is a non-malicious process, the legitimate write data is temporarily stored in the kernel's protected buffer, and the final write is completed through an independent system worker thread. This completely separates user-mode data transmission from kernel-mode write execution, making write operations appear as system-initiated process behavior that conforms to UCPD's trust rules. This successfully modifies write-protected file associations, avoiding the security risks of the writing source process directly manipulating file associations and preventing legitimate association data from being tampered with by intermediate links. This ensures the security and legitimacy of writing file associations and better resists malicious interference.

[0060] Understandably, similar to monitoring read requests, write requests to file associations in the kernel driver can be monitored by calling registry callback functions.

[0061] For example, file association security protection can be achieved through cloud synchronization and kernel interception.

[0062] The user interface (UI) configuration panel in the user control layer provides authorized users with access points for protection switches, blacklist management, and trusted process settings, allowing users to directly control protection rules. The UI configuration panel and the cloud synchronize the latest malware signature database (CloudRules) and user-configured rules to the kernel driver layer via IOCTL / shared memory. The driver receives the malicious process signature database (blacklist) from the cloud via the network module and, in the registry pre-write callback (RegNtPreSetValueKey), if the process being operated on is in the blacklist, it directly returns ACCESS_DENIED.

[0063] The kernel driver layer employs an asynchronous write strategy for write protection in Windows 11's UCPD: 1. Intercept write requests for file association items (UserChoice) through the RegNtPreSetValueKey hook. First, check the operation process. If it matches the blacklist, return ACCESS_DENIED directly to block malicious tampering.

[0064] 2. When the driver processes a DeviceIoControl request, it does not perform a write operation. Instead, it performs a deep copy of the ProgID and Hash data passed from the application layer into a protected global variable in the kernel and adds a spinlock to protect it.

[0065] 3. In DriverEntry, a system worker thread belonging to System (PID4) is created using PsCreateSystemThread. This thread continuously checks the state of global variables. Once new data is detected, the system thread calls ZwSetValueKey to execute the write, thus completely separating user-mode data transfer from kernel-mode write execution, making the write operation behave as System process behavior, so as to successfully modify UserChoiceLatest.

[0066] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0067] Furthermore, such as Figure 3 As shown, as a specific implementation of the above-mentioned file association protection method for Windows systems, this application embodiment provides a file association protection device 300 for Windows systems, which includes: a dynamic protection module 301.

[0068] The dynamic protection module 301 is used to respond to the open command of the target file by intercepting the read request of the file association item of the target file through the kernel driver of the Windows system and / or the agent program of the application layer, and generating the first file association data based on system characteristic data. The file association item is used to guide the application corresponding to the file association item to open the target file. The agent program is injected into the file resource management process when the file resource management process of the Windows system restarts, and modifies the entry code of the API function used to read the file association item in the file resource management process after injection. The first file association data is returned to the reading source process of the read request, so that the reading source process starts the user-specified application to open the target file based on the first file association data. The reading source process includes the file resource management process.

[0069] Furthermore, the file association protection device 300 for Windows systems also includes: The injection module (not shown in the figure) is used to register the agent program with the DeskBand extension object of the file resource management process; in response to the restart command of the file resource management process, it calls the programming interface or operating system shell interaction object to activate and display the DeskBand extension object in the file resource management process, so as to inject the agent program into the file resource management process.

[0070] Furthermore, the file association protection device 300 for Windows systems also includes: The program maintenance module (not shown in the figure) is used to monitor the entry code modification operations by calling the monitoring thread, as well as the loading operations or thread creation operations of non-whitelisted programs in the file resource management process; in response to the entry code being modified, it performs a write-back repair operation on the entry code through the agent program to maintain the continuity of the agent program; in response to the loading operation or thread creation operation establishment request, it intercepts and filters the loading operation or thread creation operation establishment request.

[0071] Furthermore, the file association protection device 300 for Windows systems also includes: The static protection module (not shown in the figure) is used to intercept the first write request to the file association in the kernel driver in response to the first write request, and obtain the write source process that initiated the first write request; if the characteristics of the write source process match the characteristics of a malicious process, the write operation corresponding to the first write request is refused to be executed.

[0072] Furthermore, the static protection module is also used to store the second file association data indicated by the first write request in a kernel-protected cache if the characteristics of the writing source process do not match the characteristics of a malicious process; to create a system worker thread in the kernel driver that is different from the writing source process; and to write the second file association data in the cache into the file association item through the system worker thread.

[0073] Furthermore, the file association protection device 300 for Windows systems also includes: The driver monitoring module (not shown in the figure) is used to call registry callback functions to monitor read and write requests for file association items in the kernel driver.

[0074] Furthermore, the dynamic protection module 301 is specifically used to obtain the version data of the Windows system; to concatenate the system fixed string, the identifier of the user-specified application, and the system environment data in a preset order associated with the version data to form a feature string, wherein the system environment data includes the system identifier, the user security identifier, and the current timestamp, wherein the preset order is obtained by a reverse assembly tool; to compress the feature string to determine the feature data; and to perform a hash operation based on the feature data to generate the hash value in the first file association data.

[0075] Furthermore, the proxy program is implemented as a dynamic link library.

[0076] For specific limitations regarding file association protection devices for Windows systems, please refer to the limitations of file association protection methods for Windows systems mentioned above, which will not be repeated here. Each module in the aforementioned file association protection device for Windows systems can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0077] Based on the above, Figure 1 Accordingly, embodiments of this application also provide a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method. Figure 1 The file association protection method shown is for Windows systems.

[0078] Based on this understanding, the technical solution of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or portable hard drive), and includes several instructions to cause a computer device (such as a personal computer, server, or network device) to execute the methods described in the various implementation scenarios of this application.

[0079] Based on the above, Figure 1 The method shown, and Figure 3 The virtual device embodiment shown is designed to achieve the above objectives, such as... Figure 4 As shown in the figure, this application embodiment also provides a computer device 400, which includes a processor 401 and a memory 402. The memory 402 stores a program or instructions that can run on the processor 401. When the program or instructions are executed by the processor 401, they implement the above-mentioned... Figure 1 The file association protection method shown is for Windows systems.

[0080] The memory 402 can be used to store software programs and various data. The memory 402 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 402 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 402 in this embodiment includes, but is not limited to, these and any other suitable types of memory.

[0081] Processor 401 may include one or more processing units; optionally, processor 401 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 401.

[0082] Computer equipment can specifically include personal computers, servers, network devices, etc.

[0083] Optionally, the computer device may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB ports, card reader ports, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Bluetooth interfaces, Wi-Fi interfaces), etc.

[0084] Those skilled in the art will understand that the computer device structure provided in this embodiment does not constitute a limitation on the computer device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0085] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platform, or it can be implemented by hardware.

[0086] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application. Those skilled in the art will understand that the modules in the apparatus of the embodiment can be distributed within the apparatus of the embodiment as described, or can be modified to be located in one or more apparatuses different from this embodiment. The modules of the above-described embodiment can be combined into one module, or further divided into multiple sub-modules.

[0087] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of any particular implementation scenario. The above disclosures are merely a few specific implementation scenarios of this application; however, this application is not limited thereto, and any variations conceived by those skilled in the art should fall within the protection scope of this application.

Claims

1. A file association protection method for Windows systems, characterized in that, The method includes: In response to an open command for a target file, the system intercepts requests to read file association entries of the target file through a kernel driver and / or an application-layer proxy program of the Windows system, and generates first file association data based on system feature data. The file association entries are used to guide the application corresponding to the file association entries to open the target file. The proxy program is injected into the file resource management process when the Windows system's file resource management process restarts, and modifies the entry code of the API function used to read file association entries in the file resource management process after injection. The first file association data is returned to the reading source process of the reading request, so that the reading source process can launch the user-specified application to open the target file based on the first file association data, wherein the reading source process includes the file resource management process.

2. The file association protection method for Windows systems according to claim 1, characterized in that, The method further includes: Register the agent program to the DeskBand extension object of the file resource management process; In response to the restart command of the file resource management process, a programming interface or operating system shell interaction object is invoked to activate and display the DeskBand extended object in the file resource management process, so as to inject the agent program into the file resource management process.

3. The file association protection method for Windows systems according to claim 1, characterized in that, The method further includes: The monitoring thread is invoked to monitor the modification operations of the entry code, as well as the loading operations or thread creation operations of non-whitelisted programs in the file resource management process. In response to the modification of the entry code, a write-back repair operation is performed on the entry code through the agent program to maintain the continuity of the agent program; In response to the loading operation or the thread creation operation creation request, the loading operation or the thread creation operation creation request is intercepted and filtered.

4. The file association protection method for Windows systems according to claim 1, characterized in that, The method further includes: In response to the first write request to the file association, the first write request to the file association is intercepted in the kernel driver, and the write source process that initiated the first write request is obtained; If the characteristics of the writing source process match those of a malicious process, then the write operation corresponding to the first write request is refused.

5. The file association protection method for Windows systems according to claim 4, characterized in that, The method further includes: If the characteristics of the writing source process do not match the characteristics of a malicious process, the second file associated data indicated by the first write request is stored in a kernel-protected cache. Create a system worker thread in the kernel driver that is distinct from the writing source process; The system worker thread writes the second file association data in the cache into the file association item.

6. The file association protection method for Windows systems according to claim 1, characterized in that, The method further includes: The registry callback function is invoked to monitor read and write requests for the file association entries in the kernel driver.

7. The file association protection method for Windows systems according to claim 1, characterized in that, The generation of the first file association data based on system feature data includes: Get the Windows system version data; The system fixed string, the identifier of the user-specified application, and the system environment data are concatenated in a preset order associated with the version data to form a feature string. The system environment data includes a system identifier, a user security identifier, and a current timestamp. The preset order is obtained by a reverse assembly tool. The feature string is compressed to determine the feature data; A hash operation is performed based on the feature data to generate the hash value in the first file association data.

8. The file association protection method for Windows systems according to claim 1, characterized in that, The proxy program is implemented as a dynamic link library.

9. A file association protection device for Windows systems, characterized in that, The device includes: A dynamic protection module, in response to an open command for a target file, intercepts requests to read file association entries of the target file via a Windows system kernel driver and / or an application-layer proxy program, and generates first file association data based on system characteristic data. The file association entries guide the application corresponding to the file association entries to open the target file. The proxy program is injected into the Windows system's file resource management process upon restart, and modifies the entry point code of the API function used to read file association entries within the file resource management process after injection. The first file association data is returned to the reading source process of the reading request, so that the reading source process can launch the user-specified application to open the target file based on the first file association data, wherein the reading source process includes the file resource management process.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the file association protection method for Windows systems as described in any one of claims 1 to 8.

Images