CN106020958A - Method and device for acquiring file occupation process and electronic equipment - Google Patents
Method and device for acquiring file occupation process and electronic equipment Download PDFInfo
- Publication number
- CN106020958A CN106020958A CN201610327243.5A CN201610327243A CN106020958A CN 106020958 A CN106020958 A CN 106020958A CN 201610327243 A CN201610327243 A CN 201610327243A CN 106020958 A CN106020958 A CN 106020958A
- Authority
- CN
- China
- Prior art keywords
- file
- handle
- information
- value
- pid
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/48—Program initiating; Program switching, e.g. by interrupt
- G06F9/4806—Task transfer initiation or dispatching
- G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
- G06F9/485—Task life-cycle, e.g. stopping, restarting, resuming execution
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the invention discloses a method and a device for acquiring a file occupation process and electronic equipment, relates to the technical field of computer security, and can enable a user to conveniently find the process of finding and occupying a target file. The method comprises the following steps: acquiring all handle structure information in the system; wherein, the handle structure information comprises a handle value, a handle type and a process identification value; judging whether the file path of the target file is consistent with the file path of the file corresponding to one file handle structure information in all handle structure information in the system, if so, determining the file handle structure information of the corresponding file, which is consistent with the file path of the target file, as the file handle structure information corresponding to the target file; and determining the process identification value in the file handle structure information corresponding to the target file as the process identification value of the process occupying the target file. The invention can efficiently and stably search the progress occupying the file.
Description
Technical field
The present invention relates to computer security technique field, particularly relate to a kind of obtain file take process method,
Device and electronic equipment.
Background technology
Along with the development of computer technology, user is more and more universal to computer application.User is using
During computer, often can run into the problem that cannot delete, even if computer kills when deleting some files
Poison software application layer module also can run into the problem that cannot delete file, and reason is that these files are monopolized by process
Its file handle, causes other process cannot delete file, including the Explorer process of user operation,
All cannot delete.In computer security technique field, how deleting contamination file is fail-safe software
Purport.At present, in order to delete the file using common means to delete, universal method is to find out to take this
After the process of file, first terminate process, just file can be deleted.But, system has many and enters
Journey, user cannot judge to take the process of file destination by naked eyes, again can not system all enter
Journey is all turned off, accordingly, it would be desirable to a kind of file that can effectively obtain takies the scheme of process.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of file that obtains to take the method for process, device and electronics
Equipment, it is possible to make user find easily and look for the process taking file destination.
First aspect, the embodiment of the present invention provides a kind of and obtains the method that file takies process, including:
All of handle structure information in acquisition system；Wherein, described handle structure information include handle value,
Handle type and process identification (PID) value；
Judge the file path of a file destination whether file sentence in all of handle structure information with system
The file path of the file that handle structure information is corresponding is consistent, the most then by the file path of corresponding file
The file handle structural information consistent with the file path of described file destination is defined as described file destination pair
The file handle structural information answered；
It is defined as taking described by the process identification (PID) value in file handle structural information corresponding for described file destination
The process identification (PID) value of the process of file destination.
In conjunction with first aspect, in the first embodiment of first aspect, system is that Windows operation is
System；Wherein,
All of handle structure information in described acquisition system, including:
Call the function NtQuerySystemInformation of inquiry system information in Windows operating system,
When calling, first parameter of the function NtQuerySystemInformation of inquiry system information is set to
16:
Obtain the list structure that the function NtQuerySystemInformation of described inquiry system information returns
Data；Wherein, the back end of described list structure is preserved handle structure information in system.
In conjunction with first aspect, in the second embodiment of first aspect, the literary composition of described judgement file destination
The file that in the handle structure information the most all of with system of part path, a file handle structural information is corresponding
File path consistent, the most then by the file of the file path of corresponding file with described file destination
The consistent file handle structural information in path is defined as the file handle structure letter that described file destination is corresponding
Breath, including:
Step 21: judge in the n-th handle structure information of all of handle structure information in described system
Whether handle type is file handle type, is then to perform step 22, otherwise performs step 25；Wherein, N
Initial value be 1；
Step 22: according to the handle value in described n-th handle structure information, obtain described n-th handle
The file path of the file that structural information is corresponding, and continue executing with step 23；
Step 23: judge the file path of described file destination whether with described n-th handle structure information pair
The file path of the file answered is consistent, is then to perform step 24, otherwise performs step 25；
Step 24: described n-th handle structure information is defined as the file handle that described file destination is corresponding
Structural information；
Step 25: judge that N, whether equal to M, if N is equal to M, terminates flow process, if N is not equal to M,
Step 21 is returned after then making N=N+1；Wherein, M number of all of handle structure information in being described system
Amount.
In conjunction with the second embodiment of first aspect, in the third embodiment of first aspect, described
According to the handle value in described n-th handle structure information, obtain described n-th handle structure information corresponding
The file path of file, including:
According to the handle value in described n-th handle structure information, Query Information documentation function in calling system
NtQueryInformationFile obtains the file path of file corresponding to described n-th handle structure information.
In conjunction with first aspect, in the 4th kind of embodiment of first aspect, described file destination is corresponding
File handle structural information in process identification (PID) value be defined as taking the process mark of the process of described file destination
After knowledge value, also include:
According to the process identification (PID) value of the described process taking described file destination, obtain and take described file destination
Process name.
In conjunction with the 4th kind of embodiment of first aspect, in the 5th kind of embodiment of first aspect, described
System is Windows operating system；Wherein,
Take the process identification (PID) value of the process of described file destination described in described basis, obtain and take described target
The process name of file, including:
Obtain in function CreateToolhelp32Snapshot acquisition system by calling process information snap
The all progress information lists run；Described progress information includes process identification (PID) value and process name；
Function Process32First is obtained, by described progress information list by calling first process handle
1st progress information extracts to deposit in progress information structure PROCESSENTRY32 and preserves；
Whether the process identification (PID) value of the process taking described file destination described in judgement deposits progress information with described
In structure PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent；
If the process identification (PID) value of the process taking described file destination described in deposits progress information structure with described
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent, then obtain described
Deposit the process name in the current progress information preserved in progress information structure PROCESSENTRY32,
As the process name taking described file destination；
If the process identification (PID) value of the process taking described file destination described in deposits progress information structure with described
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is inconsistent, then by calling
Next process handle obtains function Process32Next, deposits progress information structure by described
The current progress information preserved corresponding next in described progress information list in PROCESSENTRY32
Individual progress information extracts to deposit in progress information structure PROCESSENTRY32 and preserves, and is then back to
Whether the process identification (PID) value of the process taking described file destination described in execution judgement deposits progress information with described
The step that in structure PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent
Suddenly.
In conjunction with first aspect, in the 6th kind of possible implementation of first aspect, described by described mesh
Process identification (PID) value in the file handle structural information that mark file is corresponding is defined as taking entering of described file destination
After the process identification (PID) value of journey, also include:
According to the process identification (PID) value of the process taking described file destination, release and take entering of described file destination
Described file destination is taken by journey；
Delete described file destination.
In conjunction with the 6th kind of embodiment of first aspect, in the 7th kind of embodiment of first aspect, described
System is Windows operating system；
Described basis takies the process identification (PID) value of the process of described file destination, releases and takies described file destination
Process described file destination is taken, including:
According to the process identification (PID) value of the process taking described file destination, calling system open process function
OpenProcess opens the process taking described file destination, and acquisition takies entering of the process of described file destination
Journey handle；
Using the described process handle that gets as parameter incoming termination process function TerminateProcess, logical
Cross described termination process function TerminateProcess and terminate to take the process of described file destination；
The described file destination of described deletion, including: the deletion documentation function DeleteFile of calling system deletes institute
State file destination.
Second aspect, the embodiment of the present invention provides a kind of file that obtains to take the device of process, including:
Handle structure data obtaining module, all of handle structure information in acquisition system, and obtaining
Matching instruction is sent to matching module after all of handle structure information in system；Wherein, described handle knot
Structure information includes handle value, handle type and process identification (PID) value；
Matching module, for according to described matching instruction, it is judged that the file path of file destination whether with handle
A file handle structural information in all of handle structure information in the system that structural information acquisition module obtains
The file path of corresponding file is consistent, the most then by file path and the described target of corresponding file
The file handle structural information that the file path of file is consistent is defined as the file sentence that described file destination is corresponding
Handle structure information, and file handle structural information corresponding for described file destination is sent to process identification (PID) determines
Module；
Process identification (PID) determines module, for the file that the described file destination that provided by described matching module is corresponding
Process identification (PID) value in handle structure information, is defined as taking the process identification (PID) value of the process of described file destination.
In conjunction with second aspect, in the first embodiment of second aspect, described system is Windows behaviour
When making system, described handle structure data obtaining module is by calling inquiry system in Windows operating system
The function NtQuerySystemInformation of information, obtains the function of described inquiry system information
The data of the list structure that NtQuerySystemInformation returns；Wherein, when calling, inquiry system is believed
First parameter of the function NtQuerySystemInformation of breath is set to 16；At described list structure
Back end in preserve handle structure information in system.
In conjunction with second aspect, in the second embodiment of second aspect, described matching module includes:
Reading submodule, for reading, according to matching instruction, the institute that described handle structure data obtaining module obtains
State the n-th handle structure information of all of handle structure information in system, read backward first and judged son
Module sends the first instruction, and current N value is sent to the 3rd judges submodule；Wherein, the initial value of N
It is 1；
First judges submodule, for according to the first instruction, it is judged that this institute read of described reading submodule
State whether the handle type in n-th handle structure information is file handle type；The most then to file road
Footpath obtains submodule and sends file path acquisition instruction；Otherwise, judge that submodule sends the 3rd instruction to the 3rd；
File path obtains submodule, for when receiving described file path and obtaining instruction, according to described reading
Take the handle value in this described n-th handle structure information read of submodule, obtain described n-th sentence
To second, the file path of the file that handle structure information is corresponding, judges that submodule sends the second instruction with rear；Its
In, described second instructs the file path of file corresponding to the described n-th handle structure information including obtaining；
Second judges submodule, for according to the second instruction received, it is judged that the file road of described file destination
The file path of the file that footpath is the most corresponding with described n-th handle structure information is consistent；The most then will
Described n-th handle structure information is defined as file handle structural information corresponding to described file destination and sends
Module is determined to described process identification (PID)；Otherwise, judge that submodule sends the 3rd instruction to the 3rd；
3rd judges submodule, with according to the 3rd instruction received, it is judged that what described reading submodule was sent works as
Whether front N value is equal to M, if N is not equal to M, then sends bag to described reading submodule after making N=N+1
Include the matching instruction of up-to-date N value；Wherein, during M is the described system that handle structure data obtaining module obtains
The quantity of all of handle structure information.
In conjunction with the second embodiment of second aspect, in the third embodiment of second aspect, described
File path obtains submodule according to this described n-th handle structure information read of described reading submodule
In handle value, in calling system, Query Information documentation function NtQueryInformationFile obtains described the
The file path of the file that N number of file handle structural information is corresponding.
In conjunction with second aspect, in the 4th kind of embodiment of second aspect, described acquisition file takies process
Device also include that process name determines module；
Described process identification (PID) determines module, is additionally operable to the process identification (PID) value of process by taking described file destination
It is sent to process name and determines module；
Described process name determines module, for the process mark according to the process taking described file destination received
Knowledge value, obtains the process name taking described file destination.
In conjunction with the 4th kind of embodiment of second aspect, in the 5th kind of embodiment of second aspect, described
When system is Windows operating system, described process name determines that module includes:
First calls submodule, for obtaining function by calling process information snap
The all progress information lists being currently running in CreateToolhelp32Snapshot acquisition system, and obtaining
Call submodule to second after all progress information lists being currently running in system and send the 4th instruction；Described
Progress information includes process identification (PID) value and process name；
Second calls submodule, for according to the 4th instruction, obtaining function by calling first process handle
Process32First, calls described first the 1st progress information in the progress information list that submodule obtains and carries
Get to deposit in progress information structure PROCESSENTRY32 and preserve, judge submodule with the backward 4th
Send the 5th instruction；
4th judges submodule, for according to the 5th instruction, it is judged that described process identification (PID) determines what module provided
Whether the process identification (PID) value of the process taking described file destination deposits progress information structure with described
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent；If it is consistent, then
Deposit described in return in the progress information currently preserved in progress information structure PROCESSENTRY32
Process name, as the process name taking described file destination；If inconsistent, then call submodule to the 3rd and send out
Send the 6th instruction；
3rd calls submodule, for according to the 6th instruction, obtaining function by calling next process handle
Process32Next, deposits current preservation in progress information structure PROCESSENTRY32 by described
The next progress information that progress information is corresponding in described progress information list extracts deposits progress information knot
Structure body PROCESSENTRY32 preserves, then judges that submodule sends the 5th instruction to the 4th.
In conjunction with second aspect, in the 6th kind of embodiment of second aspect, described acquisition file takies process
Device also include:
Releasing takies module, for determining that what module determined takies described file destination according to described process identification (PID)
The process identification (PID) value of process, release and take the process of described file destination described file destination is taken,
Process termination notice is sent to file removing module with rear；
File removing module, for, after receiving described process termination notice, deleting described file destination.
In conjunction with the 6th kind of embodiment of second aspect, in the 7th kind of embodiment of second aspect, described
Releasing takies module and includes that process handle obtains submodule and process terminator module:
Described process handle obtains submodule, for determining that what module determined takies institute according to described process identification (PID)
Stating the process identification (PID) value of the process of file destination, process function OpenProcess of opening of calling system is opened and is accounted for
By the process of described file destination, obtain the process handle of the process taking described file destination, by obtain
Process handle is sent to process terminator module；
Described process terminator module, the process handle being used for receiving is as parameter incoming termination process function
TerminateProcess, terminates to take the process of described file destination by described termination process function, subsequently
Send process to file removing module and terminate notice；
Described file removing module is for deleting described mesh by the deletion documentation function DeleteFile of calling system
Mark file.
The third aspect, the embodiment of the present invention provides a kind of electronic equipment, and described electronic equipment includes: housing,
Processor, memorizer, circuit board and power circuit, wherein, circuit board is placed in the space that housing surrounds
Portion, processor and memorizer are arranged on circuit boards；Power circuit, for for each of above-mentioned electronic equipment
Circuit or device are powered；Memorizer is used for storing executable program code；Processor is by reading in memorizer
The executable program code of storage runs the program corresponding with executable program code, is used for performing aforementioned
The method that acquisition file described in one embodiment takies process.
A kind of file that obtains that the embodiment of the present invention provides takies the method for process, device and electronic equipment, can
With by the handle structure information of file destination, obtain the process identification (PID) value of the process taking this file destination, side
Just user searches the process taking file destination, the most also can search as antivirus software security procedure and take literary composition
The process source of part, if occupied file is virus document, and the when that antivirus software cannot being deleted,
Find the process name taking file destination, FEFO process with this programme, then can delete and be accounted for by process
Virus document, improve the cleaning success rate to virus document, long-pending to safeguarding that computer system security has
Pole meaning.Additionally, search process concrete taking file by the way of providing application windows function
Mode so that the enforcement of the program is highly efficient stable and is easy to safeguard.
Accompanying drawing explanation
In order to be illustrated more clearly that the embodiment of the present invention or technical scheme of the prior art, below will be to enforcement
In example or description of the prior art, the required accompanying drawing used is briefly described, it should be apparent that, describe below
In accompanying drawing be only some embodiments of the present invention, for those of ordinary skill in the art, do not paying
On the premise of going out creative work, it is also possible to obtain other accompanying drawing according to these accompanying drawings.
Fig. 1 is the flow chart that the present invention obtains that file takies the embodiment of the method one of process；
Fig. 2 is the flow chart that the present invention obtains that file takies the embodiment of the method two of process；
Fig. 3 is the flow chart that the present invention obtains that file takies the embodiment of the method three of process；
The process identification (PID) value of the process taking file destination according to Fig. 4 obtains and takies entering of described file destination
The flow chart of journey name；
Fig. 5 is the structural representation that the present invention obtains that file takies the device embodiment one of process；
Fig. 6 is the structural representation that the present invention obtains that file takies the device embodiment two of process；
Fig. 7 is the structural representation that the present invention obtains that file takies the device embodiment three of process；
Fig. 8 is the structural representation that the present invention obtains that file takies the device embodiment four of process；
Fig. 9 is the structural representation that the present invention obtains that file takies the device embodiment five of process；
Figure 10 is the structural representation that the present invention obtains that file takies the device embodiment six of process；
Figure 11 is the structural representation of one embodiment of electronic equipment of the present invention.
Detailed description of the invention
Obtain file a kind of to the embodiment of the present invention takies the method and device of process and carries out in detail below in conjunction with the accompanying drawings
Thin description.
It will be appreciated that described embodiment be only the present invention a part of embodiment rather than whole realities
Execute example.Based on the embodiment in the present invention, those of ordinary skill in the art are not before making creative work
Put all other embodiments obtained, broadly fall into the scope of protection of the invention.
Fig. 1 is the flow chart that the present invention obtains that file takies the embodiment of the method one of process, as it is shown in figure 1,
The method of the present embodiment may include that
All of handle structure information in step 101, acquisition system；Wherein, handle structure information includes handle
Value, handle type and process identification (PID) value (PID, Process Identification).
In the present embodiment, when system is Windows operating system, Windows provides
NtQuerySystemInformation is the function of inquiry system information, as query procedure information, CPU information,
Handle information, first parameter of NtQuerySystemInformation be 16 representatives be handle information,
Therefore, this step can be by calling the function of inquiry system information in Windows operating system
All of handle structure information in NtQuerySystemInformation acquisition system, will when calling
First parameter of NtQuerySystemInformation is set to 16, obtains function
The SYSTEM_HANDLE_INFORMATION chained list knot that NtQuerySystemInformation returns
The data of structure, in system, all of handle structure information is all saved in this list structure, i.e. this chained list knot
Each node of the data of structure is preserved a handle structure information in system.Due to handle not just file
Exclusive, except file handle structural information in the data of this list structure of acquisition, also process handle knot
Structure information, thread handle structure information etc..
Step 102, judge that the file path of file destination is whether with system in all of handle structure information one
The file path of the file that individual file handle structural information is corresponding is consistent, the most then perform step 103；No
Then, flow process is terminated.
In the present embodiment, it is the process taking file destination due to need searching, the most only judges system
Whether file handle structural information has the file path of file corresponding to file handle structural information whether
Consistent with the file path of file destination.
Step 103, by literary composition consistent with the file path of described file destination for the file path of corresponding file
Part handle structure information is defined as the file handle structural information that described file destination is corresponding.
Step 104, by the process identification (PID) value in file handle structural information corresponding for described file destination, determine
For taking the process identification (PID) value of the process of file destination.
The present embodiment, by enumerating all of handle structure information in system, is obtained by file handle structural information
Get the file path of the file of correspondence, get, by matching files path, the file sentence that file destination is corresponding
Handle mechanism information, then be defined as accounting for by the process identification (PID) value in file handle mechanism information corresponding for file destination
By the process identification (PID) value of the process of file destination, this is just found by file path and takies entering of file destination
Journey, it is possible to solve cannot effectively find in prior art and take the process of file destination thus delete file
Problem, the method is implemented simple effective, and is easy to safeguard.
Fig. 2 is the flow chart that the present invention obtains that file takies the embodiment of the method two of process, as in figure 2 it is shown,
The method of the present embodiment may include that
All of handle structure information in step 201, acquisition system.
When the operating system of this method application is Windows operating system, this step can be embodied as following two
Step:
(1) function NtQuerySystemInformation in Windows operating system is called, will when calling
First parameter of function NtQuerySystemInformation is set to 16.
(2) data of the list structure that function NtQuerySystemInformation returns are obtained；Wherein,
Handle structure information in system is preserved in the back end of list structure.
Sentence in the n-th handle structure information of all of handle structure information in step 202, judgement system
Whether handle type is file handle type, is then to perform step 203, otherwise performs step 205；Wherein, N
Initial value be 1.
In the present embodiment, it is judged that step 202 such as can be embodied as judgement and call function
The handle structure that the n-th node of the data of the list structure that NtQuerySystemInformation returns preserves
Whether the handle type in information is " file " file handle type, the most just represents this handle structure information
It it is file handle structural information.Wherein, the initial value of N is 1, i.e. from the first of the data of described list structure
Individual node starts to judge, n-th node is that the chained list of the data according to described list structure is gone to
N number of node.
Step 203, according to the sentence in the n-th handle structure information of handle structure information all of in system
Bin value, obtains the file path of file corresponding to this n-th handle structure information.
In the present embodiment, this step such as can be embodied as: according to calling function NtQuerySystemInformation
Handle value in the file handle structural information that the n-th node of the data of the list structure returned preserves, adjusts
Obtain n-th node with Query Information documentation function NtQueryInformationFile in Windows system to protect
The file path of the file that the file handle structural information deposited is corresponding.
Step 204, judge that the file path of file destination is whether with system the of all of handle structure information
The file path of the file that N number of handle structure information is corresponding is consistent, is then to perform step 207, otherwise performs
Step 205.
Such as, this step may be embodied as judging the file path of file destination whether with call function
The handle structure that the n-th node of the data of the list structure that NtQuerySystemInformation returns preserves
The file path of the file that information is corresponding is consistent.
Step 205, judge that N, whether equal to M, if N is equal to M, terminates flow process, if N is not equal to M,
Then perform step 206；Wherein, M quantity of all of handle structure information in being system.
Wherein, when the data using the list structure calling function NtQuerySystemInformation return it is
When basis performs the method for the present embodiment, M is the node total number of the data of described list structure.
Step 206, make N=N+1, be then returned to step 202.
Step 207, the n-th handle structure information of handle structure information all of in system is defined as mesh
The file handle structural information that mark file is corresponding, and continue executing with step 208.
Step 208, by the process identification (PID) value in file handle structural information corresponding for file destination, be defined as accounting for
Process identification (PID) value by the process of described file destination.
In the present embodiment, if at the number calling the list structure that function NtQuerySystemInformation returns
According to the file handle structural information that middle lookup file destination is corresponding, the top n node of the data of list structure is protected
The handle structure information deposited not is that (handle type is not literary composition to file handle structural information corresponding to file destination
The file path of the file of part handle type or correspondence is inconsistent with the file path of file destination), then perform
During to step 206, first judge whether to have had stepped through the data of this list structure, if not having, then step 207
The middle value making N adds 1, i.e. goes to next node and continues to return execution step 202.
In the present embodiment, for each handle structure information in system, first pass through handle type and determine this sentence
Whether handle structure information is file handle structural information, if so, further according to the sentence of this document handle structure information
After the file path of the file that bin value obtains correspondence, the file path with file destination compares.The method exists
All handle structure information of system find the efficiency of file handle structural information corresponding to file destination
High.
Certainly, except the present embodiment two provide according in system all handle structure information searching targets literary composition
The method of the file handle structural information that part is corresponding, it is also possible to have other embodiments to get file destination pair
The file handle structural information answered, such as: getting all of handle structure in system according to step 201
After information, all of file sentence in system can be filtered out first according to the handle type in handle structure information
Handle structure information；Then further according to the handle value in file handle structural information, each file handle knot is obtained
The file path of the file that structure information is corresponding；Finally by corresponding for the All Files handle structure information that gets
The file path of file mates with the file path of file destination, finds out one of them and file destination
The consistent file path of file path, and by file handle structure letter corresponding for this document path of finding
Breath is defined as the file handle structural information that file destination is corresponding.
Fig. 3 is the flow chart that the present invention obtains that file takies the embodiment of the method three of process, as it is shown on figure 3,
The present embodiment, on the basis of embodiment of the method shown in Fig. 1, also includes terminating taking the process of file destination also
The step of delete target file, concrete, the method for the present embodiment may include that
All of handle structure information in step 301, acquisition system；
In the present embodiment, the process of step 301 and the step 101 of said method embodiment or step 201 class
Seemingly, here is omitted.
Step 302, judge that the file path of file destination is whether with system in all of handle structure information one
The file path of the file that individual file handle structural information is corresponding is consistent, the most then perform step 303；No
Then, flow process is terminated.
In the present embodiment, the process of step 302 is similar with the step 102 of said method embodiment, or
Being embodied as step 202-206 in above-described embodiment two in Windows system, here is omitted.
Step 303, by literary composition consistent with the file path of described file destination for the file path of corresponding file
Part handle structure information is defined as the file handle structural information that described file destination is corresponding.
In the present embodiment, the process of step 302 is similar with the step 103 of said method embodiment, the most not
Repeat again.
Step 304, by the process identification (PID) value in file handle structural information corresponding for file destination, be defined as accounting for
By the process identification (PID) value of the process of file destination.
Step 305, basis take the process identification (PID) value of the process of file destination, release and take described file destination
Process file destination is taken.
In the present embodiment, when system is Windows operating system, step 305 can be according to taking target
The process identification (PID) value of the process of file, process function OpenProcess of opening of first calling system is opened and is taken institute
State the process of file destination, obtain the process handle of the process taking file destination, subsequently by entering of getting
Journey handle is as parameter incoming termination process function TerminateProcess, by described termination process function
TerminateProcess terminates to take the process of file destination.
Step 306, delete target file.
In the present embodiment, when system is Windows operating system, step 306 can pass through calling system
Deletion documentation function DeleteFile delete target file.
The present embodiment, after the process identification (PID) value getting the process taking file destination, should by end
The process that process identification (PID) value is corresponding, can delete target file.The present embodiment three gives conventional Windows
Terminating process and the feasible solution of delete target file under operating system, method is the most effective.
In said method embodiment one or two or three, after step 104 or step 208 or step 304, should
Method may further comprise the step of: the process identification (PID) value according to the process taking described file destination, obtains and takies institute
State the process name of file destination.
As shown in Figure 4, file destination is taken according to the process identification (PID) value acquisition of the process taking file destination
The concrete grammar of process name may include that
Step 401, by calling process information snap obtain function CreateToolhelp32Snapshot obtain
The all progress information lists being currently running in system；Wherein, progress information includes process identification (PID) value and process
Name；
Step 402, obtain function Process32First by calling first process handle, will
In the progress information list that CreateToolhelp32Snapshot obtains the 1st progress information extract deposit into
Journey information structure PROCESSENTRY32 preserves.
Specifically, in this step 402, call function Process32First and first obtain in progress information list
The process handle of 1 progress information, then according to the process of the 1st progress information in described progress information list
Handle, extracts the 1st progress information to deposit in progress information structure PROCESSENTRY32 and protects
Deposit.
Step 403, judge to take the process identification (PID) value of the process of described file destination whether with
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent；If it is consistent, then
Perform step 404, if inconsistent, then perform step 405；
Step 404, the process name obtained in the progress information currently preserved in PROCESSENTRY32, make
For taking the process name of described file destination；
Step 405, make N1=N1+1, and obtain function by calling next process handle
Process32Next, extracts the N1 progress information in described progress information list
PROCESSENTRY32 preserves, is then back to perform step 403.
Specifically, in this step 405, call function Process32Next and can obtain described progress information list
In the process handle of N1 progress information, the initial value of N1 is 1, actually function Process32Next
Obtain is exactly currently to preserve progress information in PROCESSENTRY32 in described progress information list
The process handle of next progress information.Then according to the process handle of N1 the progress information obtained, will
The N1 progress information extracts in PROCESSENTRY32 and preserves.
In the present embodiment, function CreateToolhelp32Snapshot is for obtaining the process snapshot of system, i.e.
Call CreateToolhelp32Snapshot and obtain all progress information lists in system, pass through function
The process handle of the 1st progress information, root in all progress information lists of Process32First acquisition system
According to this handle, the 1st progress information is extracted preservation in PROCESSENTRY32, then pass through function
Process32Next can get the process handle of the next progress information of progress information list, and will
The progress information that process handle that Process32Next gets is corresponding extracts in PROCESSENTRY32
Preserve.PROCESSENTRY32 can only preserve the data that the last time is stored in, and therefore, the most only need to will account for
With entering of currently preserving in the process identification (PID) value of the process of described file destination, with PROCESSENTRY32
Process identification (PID) value in journey information carries out mating.Owing to calling Windows function
CreateToolhelp32Snapshot, Process32First, Process32Next enumerate all processes in system
Method be mature technology, only take file destination to how being used in combination these three function herein
The acquisition of process name illustrates, and concrete is called Windows function CreateToolhelp32Snapshot,
Process32First, Process32Next enumerate the method for system process and repeat no more.
Fig. 5 is the structural representation that the present invention obtains that file takies the device embodiment one of process, such as Fig. 5 institute
Showing, the device of the present embodiment may include that handle structure data obtaining module 11, matching module 12 and enters
Journey mark determines module 13；Wherein,
Handle structure data obtaining module 11, all of handle structure information in acquisition system, and obtaining
Get in system and send matching instruction to matching module 12 after all of handle structure information；Wherein, acquisition
Handle structure information includes handle value, handle type and process identification (PID) value；
Matching module 12, for according to matching instruction, it is judged that whether the file path of file destination is tied with handle
A file handle structural information in all of handle structure information in the system that structure data obtaining module 11 obtains
The file path of corresponding file is consistent, the most then by file path and the file destination of corresponding file
The consistent file handle structural information of file path be defined as the file handle structure letter that file destination is corresponding
Breath, and file handle structural information corresponding for file destination is sent to process identification (PID) determines module 13；
Process identification (PID) determines module 13, for the file handle that the file destination that provided by matching module 12 is corresponding
Process identification (PID) value in structural information, is defined as taking the process identification (PID) value of the process of described file destination.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 1, and it realizes
Principle is similar with technique effect, and here is omitted.
Preferably, when the device that acquisition file takies process is applied to Windows operating system, in Fig. 1
Handle structure data obtaining module 11 by calling the function of inquiry system information
NtQuerySystemInformation is (by first of function NtQuerySystemInformation when calling
Parameter is set to 16), obtain the data of the list structure that function NtQuerySystemInformation returns；
Wherein, the back end of described list structure is preserved handle structure information in system.
Fig. 6 is the structural representation that the present invention obtains that file takies the device embodiment two of process, and this device should
Under Windows operating system, as shown in Figure 6, the device of the present embodiment is in Fig. 5 shown device structure
On the basis of, further, matching module 12 can include reading submodule 21, first judge submodule
22, file path obtains submodule 23, second judges that submodule 24 and the 3rd judges submodule 25；Wherein,
Reading submodule 21, for read handle structure data obtaining module 11 acquisition according to matching instruction be
The n-th handle structure information of all of handle structure information in system, has read backward first and has judged submodule
22 send the first instruction, and current N value is sent to the 3rd judges submodule 25；Wherein, the initial value of N
It is 1；
First judges submodule 22, for according to first instruction, it is judged that reading submodule 21 this read be
In system, whether the handle type in the n-th handle structure information of all of handle structure information is file handle
Type；The most then obtain submodule 23 to file path and send file path acquisition instruction；Otherwise, to
Three judge that submodule 25 sends the 3rd instruction；
File path obtains submodule 23, for when receiving file path and obtaining instruction, according to reading submodule
Handle in the n-th handle structure information of all of handle structure information in this system read of block 21
Value, obtains the file path of file corresponding to n-th handle structure information, judges submodule with backward second
24 send the second instruction；Wherein, the second instruction includes in the system obtained the of all of handle structure information
The file path of the file that N number of handle structure information is corresponding；
Second judges submodule 24, for according to the second instruction received, it is judged that the file path of file destination
The file road of the file that the n-th handle structure information of handle structure information the most all of with system is corresponding
Footpath is consistent；The most then n-th handle structure information is defined as the file handle knot that file destination is corresponding
Structure information is also sent to process identification (PID) and determines module 13；Otherwise, judge that submodule 25 sends the 3rd finger to the 3rd
Order；
3rd judges submodule 25, with according to the 3rd instruction received, it is judged that what reading submodule 21 was sent works as
Whether front N value is equal to M, if N is equal to M, then and the file path of file destination and all of file in system
The file path of the file that handle structure information is corresponding all differs, if N is not equal to M, then makes N=N+1
The matching instruction including up-to-date N value is sent afterwards to reading submodule 21；Wherein, M all of sentence in being system
The quantity of handle structure information.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 1 or Fig. 2,
It is similar with technique effect that it realizes principle, and here is omitted.
Preferably, the present invention obtains in the device embodiment two that file takies process, and file path obtains submodule
In the block 23 n-th handle structure information according to the data of this list structure read of reading submodule 21
Handle value, in calling system Query Information documentation function NtQueryInformationFile obtain n-th sentence
The file path of the file that handle structure information is corresponding.
Fig. 7 is the structural representation that the present invention obtains that file takies the device embodiment three of process, such as Fig. 7 institute
Showing, the device of the present embodiment is on the basis of Fig. 5 shown device structure, and further, this acquisition file accounts for
Also include that process name determines module 14 with the device of process；Wherein, process identification (PID) determines module 13, is additionally operable to
The process identification (PID) value taking the process of described file destination is sent to process name and determines module 14；Process name is true
Cover half block 14, for the process identification (PID) value according to the process taking described file destination received, acquisition takies
The process name of described file destination.
Fig. 8 is the structural representation that the present invention obtains that file takies the device embodiment four of process, and this device should
Under Windows operating system, as shown in Figure 8, the device of the present embodiment is in Fig. 7 shown device structure
On the basis of, further, process name determines that module 14 includes:
First calls submodule 31, for obtaining function by calling process information snap
The all progress information lists being currently running in CreateToolhelp32Snapshot acquisition system, and obtaining
Call submodule 32 to second after all progress information lists being currently running in system and send the 4th instruction；Its
In, each progress information includes process identification (PID) value and process name；
Second calls submodule 32, for according to the 4th instruction, obtaining letter by calling first process handle
Number Process32First, calls the 1st progress information in the progress information list that submodule 31 obtains by first
Extract to deposit in progress information structure PROCESSENTRY32 and preserve, judge submodule with the backward 4th
Block 33 sends the 5th instruction；
4th judges submodule 33, for according to the 5th instruction, it is judged that process identification (PID) determines what module 13 provided
Whether the process identification (PID) value of the process taking described file destination currently preserves in PROCESSENTRY32
Progress information in process identification (PID) value consistent；If consistent, then obtain in PROCESSENTRY32 when
Process name in the progress information of front preservation, as the process name taking file destination；If inconsistent, then to
3rd calls submodule 34 sends the 6th instruction；
3rd calls submodule 34, and for according to the 6th instruction, Schilling N1=N1+1, subsequently by calling down
One process handle obtains function Process32Next, calls the progress information row that submodule 31 obtains by first
In table, the N1 progress information extracts to deposit in progress information structure PROCESSENTRY32 and preserves,
Then judge that submodule 33 sends the 5th instruction to the 4th；Wherein, the initial value of N1 is 1.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 4, and it realizes
Principle is similar with technique effect, and here is omitted.
Fig. 9 is the structural representation that the present invention obtains that file takies the device embodiment five of process, such as Fig. 9 institute
Showing, the device of the present embodiment is on the basis of Fig. 5 shown device structure, and further, this acquisition file accounts for
Also include that releasing takies module 15 and file removing module 16 with the device of process；Wherein:
Releasing takies module 15, for determining that what module 13 determined takies entering of file destination according to process identification (PID)
The process identification (PID) value of journey, releasing takies the process of described file destination and takies file destination, with backward literary composition
Part removing module 16 sends process and terminates notice；
File removing module 16, after terminating notice in the process that receives, delete target file.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 3, and it realizes
Principle is similar with technique effect, and here is omitted.
Figure 10 is the structural representation that the present invention obtains that file takies the device embodiment six of process, such as Figure 10
Shown in, the device of the present embodiment is on the basis of Fig. 9 shown device structure, further, releases and takies mould
Block 15 includes that process handle obtains submodule 41 and process terminator module 42: wherein,
Process handle obtains submodule 41, for determining that what module 13 determined takies described mesh according to process identification (PID)
The process identification (PID) value of process of mark file, process function OpenProcess of opening of calling system is opened and is taken mesh
The process of mark file, obtains the process handle of the process taking file destination, is sent by the process handle obtained
To process terminator module 42；
Process terminator module 42, the process handle being used for receiving is as parameter incoming termination process function
TerminateProcess, terminates to take the process of file destination by function TerminateProcess, with backward
File removing module 16 sends process and terminates notice；
File removing module 16 is for by the deletion documentation function delete target file of calling system.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 3, and it realizes
Principle is similar with technique effect, and here is omitted.
The acquisition file that the embodiment of the present invention provides takies the device of process, can be tied by the handle of file destination
Structure information, obtains the process taking this file destination, facilitates user to search the process taking file destination, with
Sample also can search the process source taking file as antivirus software security procedure, if occupied file is
Virus document, and the when that antivirus software cannot being deleted, find the process taking file destination with this programme
Name, FEFO process, then can delete the virus document taken by process, improve virus document
Cleaning success rate, to safeguarding that computer system security has positive effect.Additionally, by providing application windows
The mode of function searches the concrete mode of the process taking file so that the enforcement of the program is highly efficient stable
And be easy to safeguard.
Figure 11 is the structural representation of one embodiment of electronic equipment of the present invention, it is possible to achieve Fig. 1-4 of the present invention
The flow process of illustrated embodiment, as shown in figure 11, above-mentioned mobile device may include that housing 51, processor
52, memorizer 53, circuit board 54 and power circuit 55, wherein, circuit board 54 is placed in housing 51 and encloses
The interior volume become, processor 52 and memorizer 53 are arranged on circuit board 54；Power circuit 55, is used for
Each circuit or device for above-mentioned electronic equipment are powered；Memorizer 53 is used for storing executable program code；
Processor 52 runs and executable program generation by reading the executable program code of storage in memorizer 53
The program that code is corresponding, the method that the acquisition file for performing described in aforementioned any embodiment takies process.
Processor 52 to concrete process and the processor 52 of performing of above-mentioned steps by running executable program
The step that code performs further, may refer to the description of Fig. 1-4 illustrated embodiment of the present invention, at this no longer
Repeat.
This electronic equipment exists in a variety of forms, includes but not limited to:
(1) mobile communication equipment: the feature of this kind equipment is to possess mobile communication function, and with provide speech,
Data communication is main target.This Terminal Type includes: smart mobile phone (such as iPhone), multimedia handset,
Functional mobile phone, and low-end mobile phone etc..
(2) super mobile personal computer equipment: this kind equipment belongs to the category of personal computer, has calculating and place
Reason function, the most also possesses mobile Internet access characteristic.This Terminal Type includes: PDA, MID and UMPC equipment
Deng, such as iPad.
(3) portable entertainment device: this kind equipment can show and play content of multimedia.This kind equipment includes:
Audio frequency, video player (such as iPod), handheld device, e-book, and intelligent toy and portable
In-vehicle navigation apparatus.
(4) other have the electronic equipment of data interaction function.
It should be noted that in this article, the relational terms of such as first and second or the like be used merely to by
One entity or operation separate with another entity or operating space, and not necessarily require or imply these
Relation or the order of any this reality is there is between entity or operation.
One of ordinary skill in the art will appreciate that all or part of flow process realizing in above-described embodiment method,
Can be by computer program and complete to instruct relevant hardware, described program can be stored in a calculating
In machine read/write memory medium, this program is upon execution, it may include such as the flow process of the embodiment of above-mentioned each method.
Wherein, described storage medium can be magnetic disc, CD, read-only store-memory body (Read-Only Memory,
Or random store-memory body (Random Access Memory, RAM) etc. ROM).
The above, the only detailed description of the invention of the present invention, but protection scope of the present invention is not limited to
This, any those familiar with the art, in the technical scope that the invention discloses, can readily occur in
Change or replacement, all should contain within protection scope of the present invention.Therefore, protection scope of the present invention
Should be as the criterion with scope of the claims.
Claims (10)
1. one kind obtains the method that file takies process, it is characterised in that including:
All of handle structure information in acquisition system；Wherein, described handle structure information include handle value,
Handle type and process identification (PID) value；
Judge the file path of a file destination whether file sentence in all of handle structure information with system
The file path of the file that handle structure information is corresponding is consistent, the most then by the file path of corresponding file
The file handle structural information consistent with the file path of described file destination is defined as described file destination pair
The file handle structural information answered；
It is defined as taking described by the process identification (PID) value in file handle structural information corresponding for described file destination
The process identification (PID) value of the process of file destination.
The method that acquisition file the most according to claim 1 takies process, it is characterised in that described system
System is Windows operating system；Wherein,
All of handle structure information in described acquisition system, including:
Call the function NtQuerySystemInformation of inquiry system information in Windows operating system,
When calling, first parameter of the function NtQuerySystemInformation of inquiry system information is set to
16；
Obtain the list structure that the function NtQuerySystemInformation of described inquiry system information returns
Data；Wherein, the back end of described list structure is preserved handle structure information in system.
The method that acquisition file the most according to claim 1 takies process, it is characterised in that described in sentence
The file path of a disconnected file destination whether file handle structure in all of handle structure information with system
The file path of the file that information is corresponding is consistent, the most then by the file path of corresponding file with described
The file handle structural information that the file path of file destination is consistent is defined as the literary composition that described file destination is corresponding
Part handle structure information, including:
Step 21: judge in the n-th handle structure information of all of handle structure information in described system
Whether handle type is file handle type, is then to perform step 22, otherwise performs step 25；Wherein, N
Initial value be 1；
Step 22: according to the handle value in described n-th handle structure information, obtain described n-th handle
The file path of the file that structural information is corresponding, and continue executing with step 23；
Step 23: judge the file path of described file destination whether with described n-th handle structure information pair
The file path of the file answered is consistent, is then to perform step 24, otherwise performs step 25；
Step 24: described n-th handle structure information is defined as the file handle that described file destination is corresponding
Structural information；
Step 25: judge that N, whether equal to M, if N is equal to M, terminates flow process, if N is not equal to M,
Step 21 is returned after then making N=N+1；Wherein, M number of all of handle structure information in being described system
Amount.
The method that acquisition file the most according to claim 3 takies process, it is characterised in that described
According to the handle value in described n-th handle structure information, obtain described n-th handle structure information corresponding
The file path of file, including:
According to the handle value in described n-th handle structure information, Query Information documentation function in calling system
NtQueryInformationFile obtains the file path of file corresponding to described n-th handle structure information.
The method that acquisition file the most according to claim 1 takies process, it is characterised in that by institute
State the process identification (PID) value in the file handle structural information that file destination is corresponding to be defined as taking described file destination
Process process identification (PID) value after, also include:
According to the process identification (PID) value of the described process taking described file destination, obtain and take described file destination
Process name.
The method that acquisition file the most according to claim 5 takies process, it is characterised in that described system
System is Windows operating system；Wherein,
Take the process identification (PID) value of the process of described file destination described in described basis, obtain and take described target
The process name of file, including:
Obtain in function CreateToolhelp32Snapshot acquisition system by calling process information snap
The all progress information lists run；Described progress information includes process identification (PID) value and process name；
Function Process32First is obtained, by described progress information list by calling first process handle
1st progress information extracts to deposit in progress information structure PROCESSENTRY32 and preserves；
Whether the process identification (PID) value of the process taking described file destination described in judgement deposits progress information with described
In structure PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent；
If the process identification (PID) value of the process taking described file destination described in deposits progress information structure with described
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent, then obtain described
Deposit the process name in the current progress information preserved in progress information structure PROCESSENTRY32,
As the process name taking described file destination；
If the process identification (PID) value of the process taking described file destination described in deposits progress information structure with described
In PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is inconsistent, then by calling
Next process handle obtains function Process32Next, deposits progress information structure by described
The current progress information preserved corresponding next in described progress information list in PROCESSENTRY32
Individual progress information extracts to deposit in progress information structure PROCESSENTRY32 and preserves, and is then back to
Whether the process identification (PID) value of the process taking described file destination described in execution judgement deposits progress information with described
The step that in structure PROCESSENTRY32, the process identification (PID) value in the current progress information preserved is consistent
Suddenly.
The method that acquisition file the most according to claim 1 takies process, it is characterised in that described
It is defined as taking described target by the process identification (PID) value in file handle structural information corresponding for described file destination
After the process identification (PID) value of the process of file, also include:
According to the process identification (PID) value of the process taking described file destination, release and take entering of described file destination
Described file destination is taken by journey；
Delete described file destination.
The method that acquisition file the most according to claim 7 takies process, it is characterised in that described system
System is Windows operating system；
Described basis takies the process identification (PID) value of the process of described file destination, releases and takies described file destination
Process described file destination is taken, including:
According to the process identification (PID) value of the process taking described file destination, calling system open process function
OpenProcess opens the process taking described file destination, and acquisition takies entering of the process of described file destination
Journey handle；
Using the described process handle that gets as parameter incoming termination process function TerminateProcess, logical
Cross described termination process function TerminateProcess and terminate to take the process of described file destination；
The described file destination of described deletion, including: the deletion documentation function DeleteFile of calling system deletes institute
State file destination.
9. one kind obtains file and takies the device of process, it is characterised in that including:
Handle structure data obtaining module, all of handle structure information in acquisition system；Wherein, institute
State handle structure information and include handle value, handle type and process identification (PID) value；
Matching module, for judging whether the file path of file destination obtains with handle structure data obtaining module
The file road of the file that file handle structural information is corresponding in all of handle structure information in the system taken
Footpath is consistent, the most then by the file path phase one of the file path of corresponding file with described file destination
The file handle structural information caused is defined as the file handle structural information that described file destination is corresponding；
Process identification (PID) determines module, for the file that the described file destination that determined by described matching module is corresponding
Process identification (PID) value in handle structure information, is defined as taking the process identification (PID) value of the process of described file destination.
Acquisition file the most according to claim 9 takies the device of process, it is characterised in that described
When system is Windows operating system, described handle structure data obtaining module is specifically for by calling
The function NtQuerySystemInformation of inquiry system information in Windows operating system, obtains described
The data of the list structure that the function NtQuerySystemInformation of inquiry system information returns；Wherein,
When calling, first parameter of the function NtQuerySystemInformation of inquiry system information is set to
16；Handle structure information in system is preserved in the back end of described list structure.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610327243.5A CN106020958A (en) | 2016-05-17 | 2016-05-17 | Method and device for acquiring file occupation process and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610327243.5A CN106020958A (en) | 2016-05-17 | 2016-05-17 | Method and device for acquiring file occupation process and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106020958A true CN106020958A (en) | 2016-10-12 |
Family
ID=57098583
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610327243.5A Pending CN106020958A (en) | 2016-05-17 | 2016-05-17 | Method and device for acquiring file occupation process and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106020958A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108984212A (en) * | 2017-05-31 | 2018-12-11 | 腾讯科技（深圳）有限公司 | A kind of method and electronic equipment of closing process |
| CN109117631A (en) * | 2018-07-05 | 2019-01-01 | 武汉斗鱼网络科技有限公司 | A kind of method that program exits and relevant device |
| CN110765456A (en) * | 2018-11-07 | 2020-02-07 | 北京安天网络安全技术有限公司 | Method and device for detecting hidden process and storage equipment |
| CN111723016A (en) * | 2020-06-24 | 2020-09-29 | 湖南国科微电子股份有限公司 | File closing method and device, electronic equipment and storage medium |
| CN111723016B (en) * | 2020-06-24 | 2024-06-04 | 湖南国科微电子股份有限公司 | File closing method, device, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6907605B1 (en) * | 1998-05-18 | 2005-06-14 | International Business Machines Corporation | Method and apparatus for providing for notification of task termination |
| CN101266550A (en) * | 2007-12-21 | 2008-09-17 | 北京大学 | Malicious code detection method |
| CN102103676A (en) * | 2011-02-28 | 2011-06-22 | 南京邮电大学 | Method for protecting Java program progress based on inheritance relationship among progresses |
| CN102214088A (en) * | 2010-04-07 | 2011-10-12 | 腾讯科技（深圳）有限公司 | Document unlocking method and device |
| US20110271087A1 (en) * | 2010-04-30 | 2011-11-03 | International Business Machines Corporation | Embedding process identification information in a pathname to indicate process status |
-
2016
- 2016-05-17 CN CN201610327243.5A patent/CN106020958A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6907605B1 (en) * | 1998-05-18 | 2005-06-14 | International Business Machines Corporation | Method and apparatus for providing for notification of task termination |
| CN101266550A (en) * | 2007-12-21 | 2008-09-17 | 北京大学 | Malicious code detection method |
| CN102214088A (en) * | 2010-04-07 | 2011-10-12 | 腾讯科技（深圳）有限公司 | Document unlocking method and device |
| US20110271087A1 (en) * | 2010-04-30 | 2011-11-03 | International Business Machines Corporation | Embedding process identification information in a pathname to indicate process status |
| CN102103676A (en) * | 2011-02-28 | 2011-06-22 | 南京邮电大学 | Method for protecting Java program progress based on inheritance relationship among progresses |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108984212A (en) * | 2017-05-31 | 2018-12-11 | 腾讯科技（深圳）有限公司 | A kind of method and electronic equipment of closing process |
| CN108984212B (en) * | 2017-05-31 | 2021-06-25 | 腾讯科技（深圳）有限公司 | Method for closing process and electronic equipment |
| CN109117631A (en) * | 2018-07-05 | 2019-01-01 | 武汉斗鱼网络科技有限公司 | A kind of method that program exits and relevant device |
| CN110765456A (en) * | 2018-11-07 | 2020-02-07 | 北京安天网络安全技术有限公司 | Method and device for detecting hidden process and storage equipment |
| CN111723016A (en) * | 2020-06-24 | 2020-09-29 | 湖南国科微电子股份有限公司 | File closing method and device, electronic equipment and storage medium |
| CN111723016B (en) * | 2020-06-24 | 2024-06-04 | 湖南国科微电子股份有限公司 | File closing method, device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2445751A1 (en) | Dynamic packet filter utilizing session tracking | |
| US20090249248A1 (en) | User directed refinement of search results while preserving the scope of the initial search | |
| CN106020958A (en) | Method and device for acquiring file occupation process and electronic equipment | |
| CN108804516A (en) | Similar users search device, method and computer readable storage medium | |
| CN105183464B (en) | Information display method and device and electronic equipment | |
| CN105183902A (en) | File cleaning method and device and terminal | |
| CN106201698A (en) | Method and device for managing application program and electronic equipment | |
| CN109522405A (en) | File information processing method, electronic equipment and computer-readable deposit medium | |
| CN105468411A (en) | Application processing method and device and electronic equipment | |
| CN106354804A (en) | File download processing method and device thereof | |
| CN106055078B (en) | A kind of sensor processing method of mobile terminal, device and mobile terminal | |
| CN106250182A (en) | File processing method and device and electronic equipment | |
| CN106201218A (en) | Method and device for clearing picture files in chat records and mobile device | |
| CN108846121A (en) | A kind of data search method and device | |
| CN105893847A (en) | Method and device for protecting safety protection application program file and electronic equipment | |
| CN109525647A (en) | Message pushes badge value control method, electronic device and storage medium | |
| CN106126291A (en) | Method and device for deleting malicious file and electronic equipment | |
| CN102611777A (en) | Method for checking and updating address book of handheld communication device | |
| CN106127029A (en) | Starting method and device of security application program and electronic equipment | |
| CN103838731B (en) | The method of a kind of data process and terminal | |
| CN106201198B (en) | Lookup method, device and the mobile terminal of terminal applies | |
| CN103841253A (en) | Method and terminal for adding contact persons | |
| CN106022120A (en) | File monitoring processing method and device and electronic equipment | |
| CN106169048A (en) | File deletion method and device and electronic equipment | |
| CN105956475A (en) | DLL file interception processing method and device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20190111 Address after: 519031 Room 105-53811, No. 6 Baohua Road, Hengqin New District, Zhuhai City, Guangdong Province Applicant after: Zhuhai Leopard Technology Co.,Ltd. Address before: 100085 East District, No. 33 Xiaoying West Road, Haidian District, Beijing Applicant before: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20161012 |
|
| RJ01 | Rejection of invention patent application after publication |