Illegal debugging protection system

Abstract

This invention relates to an illegal debugging protection system, belonging to the field of computer technology. The system includes a kernel-level processing module, which is used to: monitor debugging behavior in real time through hook functions registered in the kernel layer and obtain debugging information; the debugging information includes debugging process information, debugging behavior information, and information of the process being debugged; obtain a pre-configured anti-debugging policy for the process being debugged based on the information of the process being debugged; if an anti-debugging policy is obtained, determine the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging policy; the anti-debugging policy includes a combination of at least one protective behavior, including prohibited debugging behaviors; if the debugging behavior is illegal debugging, obtain a pre-configured illegal debugging handling policy; if a pre-configured illegal debugging handling policy is obtained, execute the illegal debugging handling policy. The illegal debugging protection system provided by this invention achieves a balance between security and convenience.

Images