CN102779030A - Execution method and device for registry operation - Google Patents

Abstract

The present invention provides a method for executing a registry operation, comprising: acquiring a registry operation request, the request including caller input parameters; setting registry kernel execution logic according to the caller input parameters, and the kernel execution logic Including: tampering point detection and repair logic and registry function call logic; executing the tampering point detection and repairing logic, specifically, detecting a preset kernel execution flow tampering point, and changing the original value of the kernel execution flow tampering point , restore the original value of the kernel execution flow tampering point; use the registry function call logic to call the corresponding registry function. The invention can enhance the attack and defense against driver-level malicious programs, and avoid the potential possibility of incompatibility between safety software caused by registry operation interference.

Description

Method and device for executing registry operation

technical field

The invention relates to the technical field of operating system penetration, in particular to a registry operation execution method and a registry operation execution device.

Background technique

When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. For example, when security software operates (creates, opens, enumerates, reads and writes, deletes, etc.) the registry key values of itself, the system, or malicious programs, it often hopes that the access process is authentic and credible, but the layering of the Microsoft Windows operating system The formula structure determines that there is a risk of data flow tampering in its call chain. Therefore, ensuring the authenticity and reliability of the registry operation process has become a basic requirement of security software. From the perspective of the operating system, there are potential tampering points in the execution process of registry operations as follows:

Referring to the schematic diagram of the operating system registry operation execution flow shown in Figure 1, the following layered calling method is used to execute the registry operation:

The caller 101 calls the kernel interface layer 102, the kernel interface layer 102 calls the kernel execution layer 103, the kernel execution layer 103 calls the registry parsing routine 104, and the registry parsing routine 104 calls the Cm* registry implementation routine 105, and the Cm* registration The table implementation routine 105 calls the third-party driver 106 and the HvpGetCellPaged/HvpGetCellMapped object routine 107 . Wherein, the caller 101 and the kernel interface layer 102 belong to the user state of the operating system, the kernel execution layer 103, the registry analysis routine 104, the Cm* registry implementation routine 105, the third-party driver 106 and the HvpGetCellPaged/HvpGetCellMapped object routine etc. 107 It belongs to the kernel state of the operating system.

From the perspective of the operating system, there are the following potential tampering points in the registry operation execution flow:

1) User mode IAT Hook (Import Address Table Hook, import table hook)/EAT Hook (Export Address Table Hook, export table hook) in the kernel interface layer;

2) User-mode Inline Hook at the kernel interface layer (inline hook);

3) Int 2E (interrupt)/SysEnter Hook (hook when user mode enters kernel mode) when the kernel interface layer calls the kernel execution layer;

4) Native API SSDT Hook (System Service DispatchTable Hook) of the kernel execution layer;

5) Native API Inline Hook of the kernel execution layer;

6) Object Parse Routine Hook of registry parsing routine (object parsing routine hook);

7) The Cm* registry implements the Cm*Routine Hook of the routine;

8) The Cm* registry implements the CmpCallBack callback mechanism when the routine 105 calls the third-party driver 106;

9) HvpGetCellPaged/HvpGetCellMapped Object Routine Hook (object routine hook).

Although traditional security software vendors are aware of the possibility of various registry operations being hijacked, most of the existing solutions only consider the hijacking risk of the user state of the operating system, and the attack and defense of the kernel state of the operating system often show a more obvious The ability is lacking, and the ability to resist driver-level malicious programs (Rootkit) is relatively weak.

Therefore, a technical problem that needs to be urgently solved by those skilled in the art is: to propose an execution mechanism for registry operations to enhance the ability to resist attacks and defenses against driver-level malicious programs, and to avoid interference between security software due to registry operation interference. Potential for incompatibility.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method for executing registry operations, so as to enhance the ability to resist attack and defense against driver-level malicious programs, and to avoid potential incompatibility between security software caused by registry operation interference.

The present invention also provides an execution device for registry operation to ensure the practical application and realization of the above method.

In order to solve the above problems, the embodiment of the present invention discloses a registry operation execution method, including:

Obtaining a registry operation request, the request including caller input parameters;

Registry kernel execution logic is set according to the input parameters of the caller, and the kernel execution logic includes: tampering point detection and repair logic and registry function call logic;

Executing the tampering point detection and repair logic, specifically, detecting the preset kernel execution flow tampering point, and restoring the original value of the kernel execution flow tampering point when the original value of the kernel execution flow tampering point changes;

Using the registry function call logic, call the corresponding registry function.

Preferably, the method also includes:

After the function of the registry is called, the original value of the kernel execution flow tampering point is changed back to the changed value.

Preferably, the preset kernel execution flow tampering points include:

Registry object parsing routine hook;

The Cm* registry implements the CmpCallBack callback mechanism when the routine calls the third-party driver;

Cm* registry function inline hooks;

HvpGetCellPaged/HvpGetCellMapped object routine hooks.

Preferably, the step of detecting the preset kernel execution flow tampering point, and restoring the original value of the tampering point when the original value of the kernel execution flow tampering point changes specifically includes:

Sub-step S1, detecting whether the original value hooked by the registry object parsing routine has changed, if so, execute sub-step S2, otherwise, execute sub-step S3;

Sub-step S2, restore the original value hooked by the registry object parsing routine, rotor step S3;

Sub-step S3, calling the Cm* registry implementation routine to detect whether the original value of the Cm* registry function inline hook has changed, if so, execute sub-step S4, otherwise, execute sub-step S5;

Sub-step S4, restore the original value of the Cm* registry function inline hook, rotor step S5;

Sub-step S5, blocking the CmpCallBack callback mechanism, rotor step S6;

Sub-step S6, detecting whether the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine has changed, if so, execute sub-step S7, otherwise end;

Sub-step S7, restore the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine.

Preferably, the original value of the kernel execution flow tampering point is obtained during initialization, and the change value of the kernel execution flow tampering point is cached in the kernel memory.

Preferably, before obtaining the registry operation request, it also includes:

The caller initiates a registry operation request, and calls the corresponding registry operation interface routine; wherein, the request includes caller input parameters;

Construct the kernel state structural parameters according to the type of the system platform, generate corresponding registry operation control codes according to the kernel state structural parameters, and send them to the operating system kernel state.

Preferably, each registry operation interface routine includes a narrow character routine and a wide character routine, and before building the kernel mode structure parameter, the method also includes:

The registry operation interface narrow character routine converts the ANSI related parameters in the caller input parameters into UNICODE type, and calls the corresponding registry operation interface wide character routine.

Preferably, before setting the registry kernel to execute the logic, the method also includes:

Verifying the input parameters of the caller according to the registry operation request, and if the verification is passed, then execute the step of setting the registry core execution logic.

Preferably, the caller input parameter has a user mode address; before setting the registry kernel execution logic, the method also includes:

Reconstructing the user mode address to the kernel mode memory space.

Preferably, the method also includes:

If calling the function of the registry is successful, then return the corresponding handle;

If calling the function of the registry fails, an error code is generated and the user state is returned.

Preferably, the registry operation interface routine is consistent with the WINDOWS standard API, including: registry key creation routine BRegCreateKey, registry enhancement key creation routine BRegCreateKeyEx, registry key opening routine BRegOpenKey, registry enhancement key opening Routine BRegOpenKeyEx, registry enhanced query value routine BRegQueryValueEx, registry set value routine BRegSetValueEx, registry enumeration key routine BRegEnumKey, registry enhanced enumeration key routine BRegEnumKeyEx, registry enumeration value routine BRegEnumValue, register Table delete key routine BRegDeleteKey, registry enhanced delete key routine BRegDeleteKeyEx, registry delete value routine BRegDeleteValue, and/or registry close handle routine BRegCloseKey.

Preferably, the control codes include: registry creation control code REGCTL_CREATE_KEY, registry opening control code REGCTL_OPEN_KEY, registry query value control code REGCTL_QUERY_VALUE_KEY, registry setting value control code REGCTL_SET_VALUE_KEY, registry enumeration key control code REGCTL_ENUMERATE_KEY, registration Table enumeration value control code REGCTL_ENUMERATE_VALUE_KEY, registry delete key control code REGCTL_DELETE_KEY and/or registry delete value control code REGCTL_DELETE_VALUE_KEY.

The embodiment of the present invention also discloses a registry operation execution device, including:

The request obtaining module is used to obtain a registry operation request, and the request includes caller input parameters;

The core execution logic setting module is used to set the registry core execution logic according to the caller input parameters, and the kernel execution logic includes: tampering point detection and repair logic and registry function call logic;

The tamper point detection and repair logic execution module is used to execute the tamper point detection and repair logic, specifically, to detect the preset kernel execution flow tamper point, and when the original value of the kernel execution flow tamper point changes, restore all The original value of the kernel execution flow tampering point;

The registry function call logic execution module is used to use the registry function call logic to call the corresponding registry function.

Preferably, the device also includes:

The tampering point write-back module is used to change the original value of the kernel execution flow tampering point back to a changed value after the function of the registry is called.

Preferably, the preset kernel execution flow tampering points include:

Registry object parsing routine hook;

The Cm* registry implements the CmpCallBack callback mechanism when the routine calls the third-party driver;

Cm* registry function inline hooks;

HvpGetCellPaged/HvpGetCellMapped object routine hooks.

Preferably, the original value of the kernel execution flow tampering point is obtained during initialization, and the change value of the kernel execution flow tampering point is cached in the kernel memory.

Preferably, the device also includes:

A user state request sending module, configured to initiate a registry operation request and call a corresponding registry operation interface routine; wherein, the request includes caller input parameters;

The control code sending module is used to construct kernel state structural parameters according to the type of the system platform, generate corresponding registry operation control codes according to the kernel state structural parameters, and send them to the operating system kernel state.

Preferably, the device also includes:

The parameter verification module is used to verify the input parameters of the caller according to the registry operation request, and if the verification is passed, call the kernel to execute the logic setting module.

Preferably, the caller input parameter has a user mode address; the device also includes:

The address reconstruction module is used to reconstruct the user mode address to the kernel mode memory space.

Preferably, the device also includes:

The handle return module is used to return the corresponding handle when calling the function of the registry successfully;

The error code return module is used to generate an error code and return to the user state when calling the function of the registry fails.

Compared with the prior art, the present application has the following advantages:

The present invention builds a trusted environment for registry operations based on the full life cycle of registry behaviors, fully implements a set of registry operation call libraries in the user state interface of the operating system, and kernel state drivers receive and verify requests from user state, and pass their own Simulate the behavior of the kernel execution layer, detect/recover object parsing hooks, block the kernel registry callback mechanism and other methods, so that the third-party driver can be penetrated (or called bypass, bypass), so as to ensure the integrity of the registry operation request environment Authentic and believable. Moreover, the kernel synchronous call returns the user mode handle information and call status. The present invention proposes an overall solution for the penetration operation of the registry, which not only provides the attack and defense of the user state of the operating system, but also further provides the attack and defense of the kernel state of the operating system. On the one hand, this solution can effectively avoid It may lead to the potential incompatibility between security software; on the other hand, this solution can effectively enhance the ability to resist the attack and defense of driver-level malicious programs.

Description of drawings

FIG. 1 is a schematic diagram of an operating system registry operation execution process;

Fig. 2 is a flow chart of the steps of Embodiment 1 of an execution method of a registry operation of the present invention;

Fig. 3 is a flow chart of the steps of detection/recovery kernel execution flow tampering point in the present invention;

FIG. 4 is a flow chart of the steps of Embodiment 2 of an execution method of a registry operation of the present invention;

Fig. 5 is a structural block diagram of an embodiment of a registry operation execution device of the present invention.

Detailed ways

In order to make the above objects, features and advantages of the present invention more comprehensible, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

One of the core concepts of the embodiments of the present invention is to build a trusted environment for registry operations based on the entire life cycle of registry behaviors, and implement a set of registry operation call libraries in the user mode interface of the operating system. Inspect the request from the user state, simulate the behavior of the kernel execution layer, detect/recover the object resolution hook, block the kernel registry callback mechanism, etc., so that the third-party driver can be penetrated (or called bypass, bypass) , so as to ensure the authenticity and credibility of the registry operation request environment. Moreover, the kernel synchronous call returns the user mode handle information and call status. The present invention proposes an overall solution for the penetration operation of the registry, which not only provides the attack and defense of the user state of the operating system, but also further provides the attack and defense of the kernel state of the operating system. On the one hand, this solution can effectively avoid It may lead to the potential incompatibility between security software; on the other hand, this scheme can effectively enhance the ability to resist the attack and defense of driver-level malicious programs.

Referring to FIG. 2 , it shows a flow chart of the steps of Embodiment 1 of a registry operation execution method of the present invention, which may specifically include the following steps:

Step 201, obtain a registry operation request, the request includes caller input parameters;

Step 202, setting the registry kernel execution logic according to the caller input parameters, the kernel execution logic includes: tamper point detection and repair logic and registry function call logic;

In the specific implementation, when the registry operation request is obtained, the caller input parameters contained in the request will be verified. If the verification is passed, the registry function call logic can be set by constructing the _PARSE_CONTEXT (context analysis) structure , and, set the tamper point detection and repair logic executed before the registry function call. In this embodiment, by actively "simulating" the kernel execution layer, the _PARSE_CONTEXT structure is constructed by itself, and then the underlying functions of the system are called.

In another preferred embodiment of the present invention, it is also possible to map the kernel file on the disk to the memory by "falsifying" the kernel, and after combining relocation, completely extract the relevant execution layer functions (because it is a complete extraction) , so its interior includes "build_PARSE_CONTEXT structure").

Of course, the above method for setting the execution logic of the registry kernel is only used as an example, and it is feasible for those skilled in the art to set the execution logic of the registry kernel in any way according to the actual situation, and the present invention is not limited thereto.

Step 203, execute the tamper point detection and repair logic, specifically, detect the preset kernel execution flow tampering point, and restore the kernel execution flow tampering point when the original value of the kernel execution flow tampering point changes Original value;

In a specific implementation, the preset kernel execution flow tampering point may include: registry object parsing routine hooking; link hook; and, HvpGetCellPaged/HvpGetCellMapped object routine hook. The original value of the execution flow tampering point of each kernel can be obtained during system initialization.

Certainly, the above kernel execution flow tampering point is only used as an example, and the preset kernel execution flow tampering point can be set arbitrarily by those skilled in the art according to actual needs, and the present invention does not need to limit this.

Referring to FIG. 3, in a preferred embodiment of the present invention, the step of detecting the preset kernel execution flow tampering point and restoring the original value of the tampering point when the original value of the kernel execution flow tampering point changes is specific The following sub-steps can be included:

Sub-step S1, detecting whether the original value hooked by the registry object parsing routine has changed, if so, execute sub-step S2, otherwise, execute sub-step S3;

Sub-step S2, restore the original value hooked by the registry object parsing routine, rotor step S3;

Sub-step S3, calling the Cm* registry implementation routine to detect whether the original value of the Cm* registry function inline hook has changed, if so, execute sub-step S4, otherwise, execute sub-step S5;

Sub-step S4, restore the original value of the Cm* registry function inline hook, rotor step S5;

Sub-step S5, blocking the CmpCallBack callback mechanism, rotor step S6;

Sub-step S6, detecting whether the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine has changed, if so, execute sub-step S7, otherwise end;

Sub-step S7, restore the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine.

In a specific implementation, if it is detected that a certain kernel execution flow tampering point changes, the changed value can be recorded in the kernel state memory space, so that it can be written back after the registry function call is completed.

Certainly, the detection and repair method of the above-mentioned tampering point is only used as an example, and it is feasible for those skilled in the art to arbitrarily set the detection and repairing operation process of the tampering point according to actual needs. The tampering points are restored uniformly, which is not limited by the present invention.

Step 204, using the registry function call logic to call the corresponding registry function.

In a specific implementation, the embodiment of the present invention may also include the following steps:

Step 205 , after the function of the registry is called, the original value of the tampering point of the kernel execution flow is changed back to a changed value.

In practice, some kernel execution flow tampering points are changed because they are rewritten by other security software. Therefore, after the implementation function call of the registry at the bottom of the system is completed, in order to ensure the normal operation of other security software, it is necessary to modify the kernel Execution flow tampering points are written back. Specifically, the changed value saved in the process of restoring the original value can be extracted from the kernel state memory space, and the corresponding kernel execution flow tampering point is written back to the changed value.

After the registry function call is completed, the registry operation execution flow will continue to call the registry analysis routine, and then the registry analysis routine will call the Cm* registry implementation routine, and the Cm* registry implementation routine will directly call HvpGetCellPaged/HvpGetCellMapped Object routines; since the CmpCallBack callback mechanism is blocked, the Cm* registry implementation routine will no longer call third-party drivers, thus allowing third-party drivers (other security software, driver-level malicious programs) to be penetrated.

Referring to FIG. 4 , it shows a flow chart of the steps of Embodiment 2 of a registry operation execution method of the present invention, which may specifically include:

Step 401, load the registry operation interface routine, and obtain the original value of the preset kernel execution flow tampering point;

As is well known, a routine is a collection of functional interfaces or services provided by a certain system. For example, APIs and services of the operating system are routines.

As an example of a specific application, the registry operation interface routine may include: registry key creation routine BRegCreateKey, registry enhancement key creation routine BRegCreateKeyEx, registry key opening routine BRegOpenKey, registry enhancement key opening routine The routine BRegOpenKeyEx, the registry enhanced query value routine BRegQueryValueEx, the registry set value routine BRegSetValueEx, the registry enumeration key routine BRegEnumKey, the registry enhanced enumeration key routine BRegEnumKeyEx, the registry enumeration value routine BRegEnumValue, the registry The delete key routine BRegDeleteKey, the registry enhanced delete key routine BRegDeleteKeyEx, the registry delete value routine BRegDeleteValue, and/or the registry close handle routine BRegCloseKey. The settings of the registry operation interface routine, such as calling conventions and calling parameters, are consistent with the corresponding WINDOWS standard API. Each of the above routines includes narrow character routines and wide character routines. For example, for BRegCreateKey, it includes narrow character routines BRegCreateKeyA and wide character routines BRegCreateKeyW. BRegCreateKeyA will convert input parameters to UNICODE types, and BRegCreateKeyW will actually complete parameter conversion and control code communication, etc.

Step 402, the caller initiates a registry operation request, and calls the corresponding registry operation interface routine; wherein, the request includes caller input parameters;

Step 403, if the registry operation interface routine is a narrow character routine, then convert the ANSI related parameters in the caller input parameters to UNICODE type, and call the corresponding registry operation interface wide character routine;

It is well known that characters in ANSI use 8 bits, while characters in UNICODE use 16 bits. (For characters, ANSI stores English characters in single bytes, and Chinese characters in double bytes, while under Unicode, both English and Chinese characters are stored in double bytes).

Of course, if the wide-character routine is directly called in practice, this step does not need to be performed.

Step 404, constructing kernel state structural parameters according to the type of the system platform, generating corresponding registry operation control codes according to the kernel state structural parameters, and sending them to the operating system kernel state;

The types of the system platform include 32-bit, 64-bit and 32-bit compatibility modes. As an example of a specific application of the present invention, the control codes corresponding to the registry operation interface routine include: registry creation control code REGCTL_CREATE_KEY, registry opening control code REGCTL_OPEN_KEY, registry query value control code REGCTL_QUERY_VALUE_KEY, registry setting Value control code REGCTL_SET_VALUE_KEY, registry enumeration key control code REGCTL_ENUMERATE_KEY, registry enumeration value control code REGCTL_ENUMERATE_VALUE_KEY, registry deletion key control code REGCTL_DELETE_KEY, and/or registry deletion value control code REGCTL_DELETE_VALUE_KEY. The control code defines a unified identification when the operating system user state and the kernel state driver communicate.

In practice, the input and output buffers can be transmitted in the METHOD_BUFFERED mode when the operating system user mode communicates with the kernel mode driver. The METHOD_BUFFERED method is: allocate a buffer first, and then copy data from this buffer. The size of the buffer is the one with the larger space between the input buffer and the output buffer. The read buffer is copied to the new buffer. Just copy the return value to the same buffer before returning. The return value is put into IO_STATUS_BLOCK, and the IO manager copies the data to the output buffer.

Step 405, the operating system kernel state obtains the registry operation request, checks the caller input parameters, and reconstructs (Captured) the user state address to the kernel state memory space;

Step 406, if the input parameter verification is passed, construct a _PARSE_CONTEXT structure according to the caller input parameters to set the registry function call logic, and set the registry kernel execution logic;

Step 407: Execute the tampering point detection and repair logic, specifically, detect the preset kernel execution flow tampering point, and restore the kernel execution flow tampering point when the original value of the kernel execution flow tampering point changes Original value;

Step 408, using the registry function call logic to call the corresponding registry function; if the call is successful, then perform step 409; if the call fails, then perform step 410;

Step 409, return the corresponding handle;

Step 410, generating an error code and returning to the user state;

In a specific implementation, if the call fails, the user mode interface can set a corresponding error code, so that the caller thread can obtain detailed error information through the GetLastError routine.

Step 411 , after the function of the registry is called, the original value of the tampering point of the kernel execution flow is changed back to a changed value.

In order to enable those skilled in the art to better understand the present invention, the present invention will be described in detail below by taking the registry creation process as an example.

(1) The caller process initiates a BRegCreateKeyA registry creation request;

(2) BRegCreateKeyA routine converts ANSI related parameters to UNICODE type and calls BRegCreateKeyW routine;

(3) The BRegCreateKeyW routine judges the system platform (32-bit, 64-bit or 32-bit compatibility mode) to build structure parameters, sends the control code REGCTL_CREATE_KEY and waits for the return synchronously;

(4) The kernel part of the BRegCreateKeyW routine receives the user mode request, verifies the input parameters, and sends the captured address to the kernel memory;

(5) The BRegCreateKeyW routine constructs the _PARSE_CONTEXT structure and calls the underlying system registry implementation function; perform the following tampering point detection and repair operations before calling:

A1. Detect and restore potential registry object parsing routine hooking problems;

A2. Detect and restore potential CmpCallback kernel callback problems;

A3. Detect and recover potential Cm*-level registry function inline hooking issues;

A4. Detect and restore potential HvpGetCellPaged/HvpGetCellMapped object routine hooking problems.

(6) If the call is successful, the corresponding handle will be returned; if the routine call is wrong, the driver will return the corresponding error code in the user mode.

(7) The synchronous request returns. If the call fails, the user mode interface sets the corresponding error code, so that the caller thread can obtain detailed error information through the GetLastError routine.

It should be noted that, for the method embodiment, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action order, because according to this According to the invention, certain steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Referring to FIG. 5 , it shows a structural block diagram of an implementation device embodiment of a registry operation of the present invention, which may specifically include the following modules:

A request obtaining module 51, configured to obtain a registry operation request, the request including caller input parameters;

Kernel execution logic setting module 52 is used to set the registry kernel execution logic according to the caller input parameters, and the kernel execution logic includes: tampering point detection repair logic and registry function call logic;

The tamper point detection and repair logic execution module 53 is used to execute the tamper point detection and repair logic, specifically, to detect the preset kernel execution flow tamper point, and when the original value of the kernel execution flow tamper point changes, restore the raw value of the kernel execution flow tamper point;

The registry function call logic execution module 54 is configured to use the registry function call logic to call the corresponding registry function.

In a specific implementation, the device may also include the following modules:

The tampering point write-back module 55 is configured to change the original value of the kernel execution flow tampering point back to a changed value after the function of the registry is called.

In a preferred embodiment of the present invention, the preset kernel execution flow tampering point may include:

Registry object parsing routine hook;

The Cm* registry implements the CmpCallBack callback mechanism when the routine calls the third-party driver;

Cm* registry function inline hooks;

HvpGetCellPaged/HvpGetCellMapped object routine hooks.

In practice, the original value of the kernel execution flow tampering point can be obtained during initialization, and the changed value of the kernel execution flow tampering point can be cached in the kernel memory.

In a preferred embodiment of the present invention, the device may also include the following modules:

A user state request sending module, configured to initiate a registry operation request and call a corresponding registry operation interface routine; wherein, the request includes caller input parameters;

The control code sending module is used to construct kernel state structural parameters according to the type of the system platform, generate corresponding registry operation control codes according to the kernel state structural parameters, and send them to the operating system kernel state.

In a specific implementation, the device may also include the following modules:

The parameter verification module is used to verify the input parameters of the caller according to the registry operation request, and if the verification is passed, call the kernel to execute the logic setting module.

As an example of a specific application, the caller input parameter has a user mode address; the device may also include the following modules:

The address reconstruction module is used to reconstruct the user mode address to the kernel mode memory space.

In a specific implementation, the device may also include the following modules:

The handle return module is used to return the corresponding handle when calling the function of the registry successfully;

The error code return module is used to generate an error code and return to the user state when calling the function of the registry fails.

Since the device embodiment basically corresponds to the method embodiment shown in Figure 2 and Figure 4 above, for details not described in this embodiment, you can refer to the relevant description in the previous embodiment, and will not go into details here .

The invention is applicable to numerous general purpose and special purpose computing system environments or configurations. Examples: personal computers, server computers, handheld or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, including A distributed computing environment for any of the above systems or devices, etc.

The invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

Above, a kind of execution method of registry operation and a kind of execution device of registry operation provided by the present invention have been introduced in detail. In this paper, specific examples have been used to illustrate the principle and implementation of the present invention. The above embodiments The description is only used to help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary , the contents of this specification should not be construed as limiting the present invention.

Claims (20)

1. An execution method of a registry operation, characterized in that, comprising: Obtaining a registry operation request, the request including caller input parameters; Registry kernel execution logic is set according to the input parameters of the caller, and the kernel execution logic includes: tampering point detection and repair logic and registry function call logic; Executing the tampering point detection and repair logic, specifically, detecting the preset kernel execution flow tampering point, and restoring the original value of the kernel execution flow tampering point when the original value of the kernel execution flow tampering point changes; Using the registry function call logic, call the corresponding registry function. 2. The method of claim 1, further comprising: After the function of the registry is called, the original value of the kernel execution flow tampering point is changed back to the changed value. 3. The method according to claim 1 or 2, wherein the preset kernel execution flow tampering point comprises: Registry object parsing routine hook; The Cm* registry implements the CmpCallBack callback mechanism when the routine calls the third-party driver; Cm* registry function inline hooks; HvpGetCellPaged/HvpGetCellMapped object routine hooks. 4. The method according to claim 3, wherein the step of detecting the preset kernel execution flow tampering point, and restoring the original value of the tampering point when the original value of the kernel execution flow tampering point changes is specific include: Sub-step S1, detecting whether the original value hooked by the registry object parsing routine has changed, if so, execute sub-step S2, otherwise, execute sub-step S3; Sub-step S2, restore the original value hooked by the registry object parsing routine, rotor step S3; Sub-step S3, calling the Cm* registry implementation routine to detect whether the original value of the Cm* registry function inline hook has changed, if so, execute sub-step S4, otherwise, execute sub-step S5; Sub-step S4, restore the original value of the Cm* registry function inline hook, rotor step S5; Sub-step S5, blocking the CmpCallBack callback mechanism, rotor step S6; Sub-step S6, detecting whether the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine has changed, if so, execute sub-step S7, otherwise end; Sub-step S7, restore the original value hooked by the HvpGetCellPaged/HvpGetCellMapped object routine. 5. The method according to claim 4, wherein the original value of the kernel execution flow tampering point is obtained during initialization, and the change value of the kernel execution flow tampering point is cached in the kernel memory. 6. The method according to claim 1 or 2, wherein, before obtaining the registry operation request, further comprising: The caller initiates a registry operation request, and calls the corresponding registry operation interface routine; wherein, the request includes caller input parameters; Construct the kernel state structural parameters according to the type of the system platform, generate corresponding registry operation control codes according to the kernel state structural parameters, and send them to the operating system kernel state. 7. The method according to claim 6, wherein each registry operation interface routine includes a narrow character routine and a wide character routine, and before building the kernel mode structure parameter, the described method also includes: The registry operation interface narrow character routine converts the ANSI related parameters in the caller input parameters into UNICODE type, and calls the corresponding registry operation interface wide character routine. 8. The method according to claim 7, wherein, before setting the registry kernel execution logic, the method also includes: Verifying the input parameters of the caller according to the registry operation request, and if the verification is passed, then execute the step of setting the registry core execution logic. 9. The method according to claim 8, wherein the caller's input parameter has a user state address; before the registry kernel execution logic is set, the method also includes: Reconstructing the user mode address to the kernel mode memory space. 10. The method of claim 7, 8 or 9, further comprising: If calling the function of the registry is successful, then return the corresponding handle; If calling the function of the registry fails, an error code is generated and the user state is returned. 11. method as claimed in claim 10 is characterized in that, described registry operation interface routine is consistent with WINDOWS standard API, comprises: registry key creates routine BRegCreateKey, registry enhanced key creates routine BRegCreateKeyEx, registry Key open routine BRegOpenKey, registry enhanced key open routine BRegOpenKeyEx, registry enhanced query value routine BRegQueryValueEx, registry set value routine BRegSetValueEx, registry enumeration key routine BRegEnumKey, registry enhanced enumeration key routine BRegEnumKeyEx , a registry enumeration value routine BRegEnumValue, a registry delete key routine BRegDeleteKey, a registry enhanced delete key routine BRegDeleteKeyEx, a registry delete value routine BRegDeleteValue, and/or a registry close handle routine BRegCloseKey. 12. The method according to claim 11, wherein the control codes include: registry creation control code REGCTL_CREATE_KEY, registry opening control code REGCTL_OPEN_KEY, registry query value control code REGCTL_QUERY_VALUE_KEY, registry setting value control code REGCTL_SET_VALUE_KEY , registry enumeration key control code REGCTL_ENUMERATE_KEY, registry enumeration value control code REGCTL_ENUMERATE_VALUE_KEY, registry deletion key control code REGCTL_DELETE_KEY and/or registry deletion value control code REGCTL_DELETE_VALUE_KEY. 13. An execution device for registry operation, characterized in that, comprising: The request obtaining module is used to obtain a registry operation request, and the request includes caller input parameters; The core execution logic setting module is used to set the registry core execution logic according to the caller input parameters, and the kernel execution logic includes: tampering point detection and repair logic and registry function call logic; The tamper point detection and repair logic execution module is used to execute the tamper point detection and repair logic, specifically, to detect the preset kernel execution flow tamper point, and when the original value of the kernel execution flow tamper point changes, restore all The original value of the kernel execution flow tampering point; The registry function call logic execution module is used to use the registry function call logic to call the corresponding registry function. 14. The apparatus of claim 13, further comprising: The tampering point write-back module is used to change the original value of the kernel execution flow tampering point back to a changed value after the function of the registry is called. 15. The device according to claim 13 or 14, wherein the preset kernel execution stream tampering points include: Registry object parsing routine hook; The Cm* registry implements the CmpCallBack callback mechanism when the routine calls the third-party driver; Cm* registry function inline hooks; HvpGetCellPaged/HvpGetCellMapped object routine hooks. 16. The device according to claim 15, wherein the original value of the kernel execution flow tampering point is obtained during initialization, and the change value of the kernel execution flow tampering point is cached in a kernel memory. 17. The device of claim 13 or 14, further comprising: A user state request sending module, configured to initiate a registry operation request and call a corresponding registry operation interface routine; wherein, the request includes caller input parameters; The control code sending module is used to construct kernel state structural parameters according to the type of the system platform, generate corresponding registry operation control codes according to the kernel state structural parameters, and send them to the operating system kernel state. 18. The apparatus of claim 17, further comprising: The parameter verification module is used to verify the input parameters of the caller according to the registry operation request, and if the verification is passed, call the kernel to execute the logic setting module. 19. The device according to claim 18, wherein the caller input parameter has a user mode address; the device further comprises: The address reconstruction module is used to reconstruct the user mode address to the kernel mode memory space. 20. The device of claim 18 or 19, further comprising: The handle return module is used to return the corresponding handle when calling the function of the registry successfully; The error code return module is used to generate an error code and return to the user state when calling the function of the registry fails.

Images