CN117312006A

CN117312006A - Windows process management method, electronic device and storage medium

Info

Publication number: CN117312006A
Application number: CN202311122905.1A
Authority: CN
Inventors: 于新宇; 周欣欣; 冉幼松
Original assignee: Jiangsu Anji Technology Co ltd
Current assignee: Jiangsu Anji Technology Co ltd
Priority date: 2023-09-01
Filing date: 2023-09-01
Publication date: 2023-12-29

Abstract

The application relates to a Windows process management method, electronic equipment and storage medium, wherein the Windows process management method comprises the following steps: the method comprises the steps that a main program receives an instruction for starting a third-party application program, and calls the starting program to send first information, wherein the first information comprises starting requirements of the third-party application program; creating a service program to perform two-way communication between different components, the service program receiving first information and transmitting second information to a start program based on the first information, the second information including a start command of a third application program; the service program sends third information to the driver program, wherein the third information comprises a service name and a process identifier, and the driver program creates a callback function based on the third information so as to monitor the process; the startup procedure receives the second information and starts up the third party application. The technical scheme of the application realizes the classification of the process based on the source of the process starting, and is convenient for the process management.

Description

Windows process management method, electronic device and storage medium

Technical Field

The invention relates to a Windows process management method, electronic equipment and a storage medium, and belongs to the technical field of software.

Background

The conventional Windows process management is based on the process name or the PID (Process Identification, process identifier) of the process, and the process management structure mainly comprises the PID, the name of the executable file of the process, and the PID of the parent process, and the complete path of the executable file can be obtained through methods such as Module32 First.

Under the current mechanism of Windows process management, the parent process may have stopped running, and cannot effectively track the source of the process in real time, so that the network access rights, file access rights, local procedure calls (Local Procedure Call, LPC), remote procedure calls (Remote Procedure Call, RPC), and rights of resources such as PIPE PIPEs of the process cannot be managed based on the created source.

Based on the above situation, the related technical solutions of the present application are proposed to solve at least one problem.

Disclosure of Invention

The invention aims to provide a Windows process management method, electronic equipment and a computer readable storage medium, which realize the classification of processes based on the source of process starting and are convenient for process management.

In order to achieve the above purpose, the present invention provides the following technical solutions:

in a first aspect, the present application provides a Windows process management method, including the steps of:

the method comprises the steps that a main program receives an instruction for starting a third-party application program, and calls the starting program to send first information, wherein the first information comprises starting requirements of the third-party application program;

creating a service program to perform bidirectional communication between different components, the service program receiving the first information and transmitting second information to the start-up program based on the first information, the second information including a start-up command of the third application program;

the service program sends third information to a driver program, wherein the third information comprises a service name and a process identifier, and the driver program creates a callback function based on the third information so as to monitor a process;

the start-up program receives the second information and starts up the third party application.

As one possible implementation manner, the main program receiving an instruction for starting the third party application program, and invoking the starting program to send the first information includes:

and the main program displays an icon of the real-time third-party application program, and when a click command of the icon is received, the main program calls the starting program to send first information to the service program.

As one possible implementation, the initiator is a start Process of the Process component.

As one possible implementation, the service program includes:

the LPC service is used for receiving information sent by other components;

and the LPC client is used for sending information to the driver.

As one possible implementation, the start-up requirement includes a first start-up parameter, and the service program receives the first information and reconstructs the first start-up parameter to output a second start-up parameter to the start-up program.

As one possible implementation manner, after the driver receives the third information, a corresponding LPC server is created;

the service program loads the driver program and communicates with the driver program.

As one possible implementation manner, the driver creating a callback function based on the third information to monitor a process includes:

setting a callback function callback process_notifyprocessex of the creation Process through an application program interface PsSetCreateProcessNotifyRouteineEx, and maintaining a Process information table in the process_notifyprocessEx;

the driver is configured to add the process information of the current process to the process information table when the process identifier of the parent process is in the process information table; and deleting the process information of the current process when the current process exits.

As one possible implementation manner, after the driver receives the third information, the process identifier of the service program is added to the process information table.

In a second aspect, the present application provides an electronic device, where the electronic device includes a processor and a memory, where the memory is configured to store instructions, and the processor is configured to invoke the instructions in the memory, so that the electronic device executes the Windows process management method according to the first aspect.

In a third aspect, the present application provides a computer readable storage medium comprising computer instructions which, when run on an electronic device, cause the electronic device to perform the Windows process management method according to the first aspect.

By the embodiment of the application, the invention has the beneficial effects that:

the method comprises the steps that a main program invokes a starting program to send first information comprising starting requirements of a third-party application program to a service program, and then the service program sends second information and third information to the starting program and a driving program respectively. And the starting program starts the third-party application program after receiving the second information, and the driver creates a callback of the process after receiving the third information, so that classification based on the running source of the process is realized in the callback. Therefore, the technical scheme of the application realizes the classification of the process based on the source of the process starting, is convenient for the process management, and can designate that the process with one type of source can access the designated network, file, LPC, RPC, PIPE pipeline and other resources.

The foregoing description is only an overview of the present invention, and is intended to provide a better understanding of the present invention, as it is embodied in the following description, with reference to the preferred embodiments of the present invention and the accompanying drawings.

Drawings

FIG. 1 is a flowchart of a Windows process management method according to an embodiment of the present application;

FIG. 2 is a flowchart illustrating a method for managing Windows processes according to an embodiment of the present application;

fig. 3 is a schematic hardware structure of an electronic device according to an embodiment of the present application.

Detailed Description

The following describes in further detail the embodiments of the present invention with reference to the drawings and examples. The following examples are illustrative of the invention and are not intended to limit the scope of the invention.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein in the description of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

It is further intended that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The term "at least one" in this application means one or more, and "a plurality" means two or more. "and/or", describes an association relationship of an association object, and the representation may have three relationships, for example, a and/or B may represent: a alone, a and B together, and B alone, wherein a, B may be singular or plural.

In the embodiments of the present application, words such as "exemplary" or "such as" are used to mean serving as examples, illustrations, or descriptions. Any embodiment or design described herein as "exemplary" or "for example" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete fashion.

Fig. 1 is a flow chart illustrating a method for managing Windows processes according to an embodiment of the present application.

As shown in fig. 1, the Windows process management method of the present embodiment includes the following steps:

By way of illustration and not limitation, the host program receiving an instruction to launch a third party application, invoking the launch program to send the first information includes:

Of course, in other embodiments, the main program may perform the above-described related steps based on, for example, voice instructions, text instructions, and the like.

In some embodiments, the initiator is a start Process of a Process component.

In some embodiments, the service program comprises:

the LPC service is used for receiving information sent by other components;

and the LPC client is used for sending information to the driver.

In some embodiments, the start-up requirement includes a first start-up parameter, and the service receives the first information and reconstructs the first start-up parameter to output a second start-up parameter to the start-up program.

It will be appreciated that the start-up procedure enables different start-up methods based on different first start-up parameters. When the main program calls the starting program, specific starting parameters are constructed and sent to the service program through the LPC.

In some embodiments, after receiving the third information, the driver creates a corresponding LPC server;

By way of illustration and not limitation, the driver creating a callback function based on the third information to monitor progress includes:

In some embodiments, after the driver receives the third information, a process identifier of the service is added to the process information table.

FIG. 2 is a flowchart showing a specific procedure of a Windows process management method according to an embodiment of the present application.

As shown in fig. 2:

the main program is responsible for displaying interfaces and icon of the third party application shortcut. Upon clicking, the main program invokes a start process (start. Exe) to launch the third party application.

Creating a Windows service program svc.exe, wherein the functions of the service mainly comprise:

1. an LPC service is created to receive messages sent by other components.

2. An LPC client is created and a message is sent to the driver.

3. The LPC sends a command and PID to the driver, the LPC service name of the driver is set, and the driver creates an LPC server;

4. and receiving a message of starting the third-party program by the LPC sent by the start.exe, reconstructing a command line, and starting the start.exe again to start the third-party program.

5. The method is responsible for loading the driver and communicating with the driver, and monitors whether the driver is running to realize a windows driver, and comprises the following main functions:

1. the callback process_notifyprocessex of the creation Process is set by pssetcreateprocessnotifyprotineex.

2. A Process information list is maintained inside the process_NotifyProcessEx, and when the PID of the parent Process is in the Process information list, the current Process information is added to the Process information list, and when the Process exits, the current Process information is deleted.

3. An LPC service is realized, the process information of the svc.exe is received, and the PID of the received svc service process is added into the process information list.

4. The traversal processes the creation of each process. Since the parent process of the second started start process is the svc service process, the PID of the start process is added to the process information list.

5. The parent process of the third party process is a start process, such that the third party process is added to the list

And realizing a start process, constructing parameters when the main program is called according to the starting parameters, transmitting the parameters to the svc.exe service through the LPC, reconstructing the starting parameters after the svc receives the information, and running the start process again to start the third-party application program.

Fig. 3 is a schematic diagram showing a hardware structure of an electronic device according to an embodiment of the present application. As shown in fig. 3, the electronic device 1000 may include a processor 1001, a memory 1002. The memory 1002 is used to store one or more computer programs 1003. One or more computer programs 1003 are configured to be executed by the processor 1001. The one or more computer programs 1003 include instructions that can be used to implement the methods described above for execution in the electronic device 1000.

It is to be understood that the configuration illustrated in the present embodiment does not constitute a specific limitation on the electronic apparatus 1000. In other embodiments, electronic device 1000 may include more or fewer components than shown, or may combine certain components, or split certain components, or a different arrangement of components.

The processor 1001 may include one or more processing units, such as: the processor 1001 may include an application processor (application processor, AP), a modem, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a video codec, a digital signal processor (digital signal processor, DSP), a baseband processor, and/or a neural network processor (neural-network processing unit, NPU), etc. Wherein the different processing units may be separate devices or may be integrated in one or more processors.

The processor 1001 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 1001 is a cache memory. The memory may hold instructions or data that the processor 1001 has just used or recycled. If the processor 1001 needs to reuse the instruction or data, it can be called directly from the memory. Repeated accesses are avoided and the latency of the processor 1001 is reduced, thus improving the efficiency of the system.

In some embodiments, the processor 1001 may include one or more interfaces. The interfaces may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous receiver transmitter (universal asynchronous receiver/transmitter, UART) interface, a mobile industry processor interface (mobile industry processor interface, MIPI), a general-purpose input/output (GPIO) interface, a SIM interface, and/or a USB interface, among others.

In some embodiments, memory 1002 may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash Card (Flash Card), at least one disk storage device, a Flash memory device, or other volatile solid state storage device.

The present embodiment also provides a computer-readable storage medium having stored therein computer instructions which, when executed on an electronic device, cause the electronic device to perform the above-described related method steps to implement the method in the above-described embodiments.

The electronic device and the computer storage medium provided in this embodiment are used to execute the corresponding methods provided above, so that the beneficial effects that can be achieved by the electronic device and the computer storage medium can refer to the beneficial effects in the corresponding methods provided above, and are not described herein.

In practical applications, the above-mentioned functions may be distributed by different functional modules according to the need, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

In several embodiments provided in the present application, the disclosed apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are illustrative, and the module or division of the units, for example, is a logic function division, and may be implemented in other manners, such as multiple units or components may be combined or integrated into another apparatus, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and the parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed in a plurality of different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated unit may be stored in a readable storage medium if implemented in the form of a software functional unit and sold or used as a stand-alone product. Based on such understanding, the technical solution of the embodiments of the present application may be essentially or a part contributing to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, including several instructions for causing a device (may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

To sum up:

The technical features of the above-described embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above-described embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The above examples illustrate only a few embodiments of the invention, which are described in detail and are not to be construed as limiting the scope of the invention. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the invention, which are all within the scope of the invention. Accordingly, the scope of protection of the present invention is to be determined by the appended claims.

Claims

1. The Windows process management method is characterized by comprising the following steps:

2. The Windows process management method according to claim 1, wherein the main program receiving an instruction to start the third party application program, and invoking the start program to send the first information comprises:

3. The Windows Process management method according to claim 2, wherein the initiator is a start Process of a Process component.

4. The Windows process management method according to claim 1, wherein the service program comprises:

the LPC service is used for receiving information sent by other components;

and the LPC client is used for sending information to the driver.

5. The method of claim 4, wherein the boot requirement includes a first boot parameter, and wherein the service receives the first information and reconstructs the first boot parameter to output a second boot parameter to the boot program.

6. The method for managing Windows processes according to claim 4, wherein said driver creates a corresponding LPC server after receiving said third information;

7. The Windows process management method according to claim 1, wherein the driver creating a callback function based on the third information to monitor a process comprises:

8. The method according to claim 7, wherein the driver adds a process identifier of the service program to the process information table after receiving the third information.

9. An electronic device comprising a processor and a memory, the memory for storing instructions, the processor for invoking the instructions in the memory to cause the electronic device to perform the Windows process management method of any of claims 1-8.

10. A computer readable storage medium comprising computer instructions which, when run on an electronic device, cause the electronic device to perform the Windows process management method of any one of claims 1 to 8.