CN103019740B - A kind of method and device obtaining importing table and relocation table - Google Patents
A kind of method and device obtaining importing table and relocation table Download PDFInfo
- Publication number
- CN103019740B CN103019740B CN201210587722.2A CN201210587722A CN103019740B CN 103019740 B CN103019740 B CN 103019740B CN 201210587722 A CN201210587722 A CN 201210587722A CN 103019740 B CN103019740 B CN 103019740B
- Authority
- CN
- China
- Prior art keywords
- data
- data rewriting
- rewrite
- information
- cryptor
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention discloses a kind of method and the device that obtain importing table and relocation table, the method comprises: record runs the data rewriting information produced in cryptor process, and described data rewriting information comprises data rewriting address, rewrite data and data rewriting time; After determining the entrance OEP of the original program that described cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined; Rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to described cryptor.The program decreases consuming time, improves efficiency.
Description
Technical field
The present invention relates to field of computer technology, espespecially a kind of method and device obtaining importing table and relocation table
Background technology
Adding shell is the abbreviation processed executable program resource, and be the conventional means of protection executable program, its principle utilizes particular algorithm, compresses the resource in executable program, encrypt.Cryptor directly can run on equipment, but can not obtain original program, just can will obtain through shelling.The process of shelling is mainly divided into following three steps: the first step, determines the entrance (Original Entry Point, OEP) of original program; Second step, repairs and imports table and relocation table; 3rd step, by the original program writing in files in internal memory, the new entry address of change program is OEP, and this step is commonly referred to dump (Dump).
Adding in the process of shell for program, sometimes importing table and the relocation table of original program is not destroyed completely, like this in the process running cryptor, the importing table of original program and relocation table can complete reproduction or part reappear in the data of internal memory record, such as, the data of importing table comprise A1, A2, A3, the data A1 write memory address x of table will be imported in the T1 moment, the data A2 write memory address x+d1 of table will be imported in the T2 moment, the data A3 write memory address x+d2 of table is imported in the T3 moment, A1, A2, A3 also can be called three kinds of internal storage states, so rewrite data A1A2A3 is carried out combination and just can obtain whole importing table.Visible, for the cryptor that importing table and relocation table are not totally disrupted, getting all data rewriting information of producing in cryptor operational process and after determining the OEP of the original program that cryptor is corresponding, if all internal storage states may can be combined reduction, just can obtain in the internal storage state after these combinations and import table and relocation table.
After the data rewriting information produced in the cryptor operational process got, for the ease of analyzing data rewriting information thus obtaining importing table and relocation table, data rewriting information can be recorded in a form, the data rewriting information of acquisition is supposed to be recorded in as in following table, wherein x, x+d1, x+d2 represents data rewriting address, T1, T2, T3 represents the data rewriting time, A1, A2, A3, B1, B2, B3, C1, C2, C3 represents rewrite data, so, the combination of rewrite data in 3*3*3=27 can be drawn according to the data rewriting information obtained.
| Memory address/time | T1 | T2 | T3 |
| x | A1 | A2 | A3 |
| x+d1 | B1 | B2 | B3 |
| x+d2 | C1 | C2 | C3 |
Illustrate only in upper table at T1, T2, these three moment of T3, memory address x, x+d1, x+d2 writes the situation of data, at this moment the combination of 27 kinds of rewrite data will be obtained, after actual motion cryptor, a large amount of data rewriting information may be obtained, also may occur that a memory address is recycled rewriting situation repeatedly, the quantity obtaining rewrite data so is also huge, then a large amount of rewrite data is combined, the combination of very many rewrite data will be obtained, then in the combination of the rewrite data obtained, importing table is obtained one by one and relocation table will be very consuming time, efficiency is also very low.
Summary of the invention
The embodiment of the present invention provides a kind of method and the device that obtain importing table and relocation table, in order to solve in prior art when obtaining the importing table and relocation table that are not totally disrupted, and length consuming time, inefficient problem.
Obtain a method for importing table and relocation table, comprising:
Record runs the data rewriting information produced in cryptor process, and described data rewriting information comprises data rewriting address, rewrite data and data rewriting time;
After determining the entrance OEP of the original program that described cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined;
Rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to described cryptor.
Obtain a device for importing table and relocation table, comprising:
Record cell, for recording the data rewriting information run and produce in cryptor process, described data rewriting information comprises data rewriting address, rewrite data and data rewriting time;
Assembled unit, for after determining the entrance OEP of the original program that described cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined;
Acquiring unit, for analyzing the rewrite data after combination one by one to obtain importing table and the relocation table of original program corresponding to described cryptor.
Beneficial effect of the present invention is as follows:
The acquisition importing table that the embodiment of the present invention provides and the method for relocation table and device, run the data rewriting information produced in cryptor process by record, described data rewriting information comprises data rewriting address, rewrite data and data rewriting time; After determining the OEP of the original program that described cryptor is corresponding, by the data rewriting information of record, data rewriting Time Continuous and rewrite data corresponding to the continuous print data rewriting information of data rewriting address combine; And/or by the data rewriting information of record, the rewrite data corresponding to data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle combines; Rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to described cryptor.The program is just by the data rewriting information of record, and data rewriting Time Continuous and rewrite data corresponding to the continuous print data rewriting information of data rewriting address combine; And/or, by in the data rewriting information of record, the rewrite data corresponding to data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle combines, then the rewrite data after analyzing combination one by one obtains importing table and resets table, relative to obtaining the mode importing table and relocation table in prior art in the combination of all possible rewrite data, decrease consuming time, improve efficiency.
Accompanying drawing explanation
Fig. 1 is the process flow diagram that in the embodiment of the present invention, the first obtains the method for importing table and relocation table;
Fig. 2 is the process flow diagram that in the embodiment of the present invention, the second obtains the method for importing table and relocation table;
Fig. 3 is the process flow diagram that in the embodiment of the present invention, the third obtains the method for importing table and relocation table;
Fig. 4 is the structural representation of the device obtaining importing table and relocation table in the embodiment of the present invention;
Fig. 5 is the structural representation of the device of a kind of preferred acquisition importing table and relocation table in the embodiment of the present invention.
Embodiment
For in prior art when obtaining the importing table that is not totally disrupted and relocation table, length consuming time, inefficient problem, the embodiment of the present invention provides three kinds of methods obtaining importing table and relocation table, and the flow process of first method as shown in Figure 1, performs step as follows:
S10: record runs the data rewriting information produced in cryptor process, and data rewriting information comprises data rewriting address, rewrite data and data rewriting time.
Virtual machine or debugger etc. can be used to run cryptor, and record the data rewriting information produced in operational process.
S11: after determining the OEP of the original program that cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines.
In cryptor operational process, a large amount of data rewriting information can be produced, these data rewriting information are relevant a bit, for acquisition importing table and relocation table be contributive, some is then discrete, contribution can not be had to acquisition importing table and relocation table, because importing table often appears at continuous bulk by the memory address rewritten, therefore, data rewriting information can be obtained continuous, and data rewriting address continuous print data rewriting information, after the rewrite data combination in these data rewriting information, just can greatly reduce the possibility of all rewrite data combination, thus the efficiency obtaining importing table and relocation table can be improved.
Illustrate with two instantiations below:
Example one: as shown in the table in the data rewriting information of these six continuous print moment records of T1, T2, T3, T4, T5, T6, A1, A2, B1, B2, C1, C2 represent the data write at corresponding memory address:
| Memory address/time | T1 | T2 | T3 | T4 | T5 | T6 |
| x | A1 | A2 | ||||
| x+d1 | B1 | B2 | ||||
| x+d2 | C1 | C2 |
As can be seen from the above table, the combination of total 2*2*2=8 kind rewrite data, but due to T1-T3 be continuous print, x-x+d2 is also continuous print, and this also just can be seen as a kind of combination of rewrite data, i.e. A1B1C1; In like manner, because T4-T6 is continuous print, x-x+d2 is also continuous print, also just can be seen as a kind of combination of rewrite data, i.e. A2B2C2.That is in fact above-mentioned six data rewriting information are the combination of two kinds of rewrite data.So just can reduce the quantity of the combination of rewrite data.
Example two: at T1, T2, T3 ... the data rewriting information that TN records during this period of time is as shown in the table, A1, B1 ... BN, C1 represent the data write at corresponding memory address:
| Memory address/time | T1 | T2 | T3 | …… | TN | Remarks |
| x | A1 | …… | A1 | All the time do not rewritten | ||
| x+d1 | B1 | B2 | B3 | …… | BN | A circulation, writes repeatedly |
| x+d2 | C1 | …… | All the time do not rewritten |
In the data rewriting address of record, can rewrite much scattered data rewriting address, can not consider that these rewrite the combination of the rewrite data formed, in fact above-mentioned 3N bar data rewriting information only have the combination of a kind of rewrite data: A1+B1+C1.
S12: the rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to cryptor.
After determining the combination of the rewrite data of importing table and the possible existence of relocation table, directly analyze the rewrite data after these combinations one by one, then just obtain importing table and relocation table.
The program is just by the data rewriting information of record, data rewriting Time Continuous and rewrite data corresponding to the continuous print data rewriting information of data rewriting address combine, then the rewrite data after analyzing combination one by one obtains importing table and resets table, relative to obtaining the mode importing table and relocation table in prior art in the combination of all possible rewrite data, decrease consuming time, improve efficiency.
The second obtains the method for importing table and relocation table as shown in Figure 2, performs step as follows:
S20: record runs the data rewriting information produced in cryptor process, and data rewriting information comprises data rewriting address, rewrite data and data rewriting time.
S21: after determining the OEP of the original program that cryptor is corresponding, in the data rewriting information of record, combines the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle.
In cryptor operational process, a large amount of data rewriting information can be produced, these data rewriting information are relevant a bit, for acquisition importing table and relocation table be contributive, some is then discrete, contribution can not be had to acquisition importing table and relocation table, because importing table often appears at continuous bulk by the address of rewriting, therefore, data rewriting information can be obtained continuous, after the rewrite data corresponding to data rewriting information of at least two continuous print data rewriting address cycle combines, just can greatly reduce the possibility of all rewrite data combination, thus the efficiency obtaining importing table and relocation table can be improved.
Illustrate with two instantiations below:
Example one: as shown in the table in the data rewriting information of these four continuous print moment records of T1, T2, T3, T4, E1T1, E2T2, E1T3, E2T4 represent the data write at corresponding memory address:
As can be seen from the above table, the combination of total 2*2=4 kind rewrite data, but due in these four continuous print moment of T1-T4, E1 first performs data rewriting to d1, then E2 is performing data rewriting to d1, then E1 performs data rewriting to d2 again, then E2 is performing data rewriting to d2, and this just can regard a circulation as, therefore in this time period of T1-T4, the combination of rewrite data only has two kinds: E1T1E1T3 and E2T2E2T4, so just can reduce the quantity of rewrite data combination.
Example two: as shown in the table in the data rewriting information of these four continuous print moment records of T1, T2, T3, T4, E1T1, E1T2, E2T3, E2T4 represent the data write at corresponding memory address:
As can be seen from the above table, the combination of total 2*2=4 kind rewrite data, but due in these four continuous print moment of T1-T4, E1 first performs twice data rewriting to d1, then E2 performs twice data rewriting to d2 again, and this just can regard a circulation as, therefore in this time period of T1-T4, the combination of rewrite data only has two kinds: E1T1E2T3 and E1T2E2T4, so just can reduce the quantity of rewrite data combination.
S22: the rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to cryptor.
The program is just by the data rewriting information of record, the rewrite data corresponding to data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle combines, then the rewrite data after analyzing combination one by one obtains importing table and resets table, relative to obtaining the mode importing table and relocation table in prior art in the combination of all possible rewrite data, decrease consuming time, improve efficiency.
The third obtains the method for importing table and relocation table as shown in Figure 3, performs step as follows:
S30: record runs the data rewriting information produced in cryptor process, and data rewriting information comprises data rewriting address, rewrite data and data rewriting time.
S31: after determining the OEP of the original program that cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines.
This step and S11 are identical.
S32: after determining the OEP of the original program that cryptor is corresponding, in the data rewriting information of record, combines the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle.
This step and S21 are identical.
S33: the rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to cryptor.
First S31 can be performed, at execution S32; Also first S32 can be performed, at execution S31; S31 and S32 can also be performed simultaneously.
The program is just in the data rewriting information of record, and the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined, then the rewrite data after analyzing combination one by one obtains importing table and resets table, relative to obtaining the mode importing table and relocation table in prior art in the combination of all possible rewrite data, decrease consuming time, improve efficiency.
Preferably, after above-mentioned S11, S21 and S32, also comprise: for the rewrite data after combination adds number information, and add in queue to be analyzed.
After rewrite data being combined, upper number information 1,2,3 can be added ..., then add in queue to be analyzed, queue for storing to be analyzed be the combination of rewrite data to be analyzed.
Concrete, rewrite data after the combination of analysis one by one in above-mentioned S12, S22 and S33 obtains importing table and the relocation table of original program corresponding to cryptor, specifically comprise: the rewrite data after taking out combination one by one from queue to be analyzed is also analyzed, and obtains the importing table of cryptor and relocation table to be selected.
Importing table and the relocation table that the rewrite data after combining obtains original program corresponding to cryptor can be obtained one by one from queue to be analyzed according to the number order of the rewrite data after combination.The process analyzed can adopt the method for prior art, repeats no more here.
Based on same inventive concept, the embodiment of the present invention provides a kind of device obtaining importing table and relocation table, and the structure of this device as shown in Figure 4, comprising:
Record cell 40, for recording the data rewriting information run and produce in cryptor process, data rewriting information comprises data rewriting address, rewrite data and data rewriting time.
Assembled unit 41, for after determining the OEP of the original program that cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined.
Acquiring unit 42, for analyzing the rewrite data after combination one by one to obtain importing table and the relocation table of original program corresponding to cryptor.
Preferably, above-mentioned acquisition imports the device of table and relocation table, as shown in Figure 5, also comprises adding device 43, for: for the rewrite data after combination adds number information, and add in queue to be analyzed.
Preferably, above-mentioned acquiring unit 42, specifically for: the rewrite data after taking out combination one by one from queue to be analyzed is also analyzed, and obtains the importing table of cryptor and relocation table to be selected.
Obviously, those skilled in the art can carry out various change and modification to the present invention and not depart from the spirit and scope of the present invention.Like this, if these amendments of the present invention and modification belong within the scope of the claims in the present invention and equivalent technologies thereof, then the present invention is also intended to comprise these change and modification.
Claims (6)
1. obtain a method for importing table and relocation table, it is characterized in that, comprising:
Record runs the data rewriting information produced in cryptor process, and described data rewriting information comprises data rewriting address, rewrite data and data rewriting time;
After determining the entrance OEP of the original program that described cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined;
Rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to described cryptor.
2. the method for claim 1, is characterized in that, also comprises:
For the rewrite data after combination adds number information, and add in queue to be analyzed.
3. method as claimed in claim 2, is characterized in that, the rewrite data after analyzing combination one by one obtains importing table and the relocation table of original program corresponding to described cryptor, specifically comprises:
Rewrite data after taking out combination one by one from described queue to be analyzed is also analyzed, and obtains the importing table of described cryptor and relocation table to be selected.
4. obtain a device for importing table and relocation table, it is characterized in that, comprising:
Record cell, for recording the data rewriting information run and produce in cryptor process, described data rewriting information comprises data rewriting address, rewrite data and data rewriting time;
Assembled unit, for after determining the entrance OEP of the original program that described cryptor is corresponding, in the data rewriting information of record, the rewrite data by data rewriting Time Continuous and corresponding to the continuous print data rewriting information of data rewriting address combines; And/or, in the data rewriting information of record, the rewrite data corresponding to the data rewriting information of data rewriting Time Continuous, at least two continuous print data rewriting address cycle is combined;
Acquiring unit, for analyzing the rewrite data after combination one by one to obtain importing table and the relocation table of original program corresponding to described cryptor.
5. device as claimed in claim 4, is characterized in that, also comprise adding device, for:
For the rewrite data after combination adds number information, and add in queue to be analyzed.
6. device as claimed in claim 5, is characterized in that, described acquiring unit, specifically for:
Rewrite data after taking out combination one by one from described queue to be analyzed is also analyzed, and obtains the importing table of described cryptor and relocation table to be selected.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210587722.2A CN103019740B (en) | 2012-12-28 | 2012-12-28 | A kind of method and device obtaining importing table and relocation table |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210587722.2A CN103019740B (en) | 2012-12-28 | 2012-12-28 | A kind of method and device obtaining importing table and relocation table |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103019740A CN103019740A (en) | 2013-04-03 |
| CN103019740B true CN103019740B (en) | 2015-08-19 |
Family
ID=47968378
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210587722.2A Active CN103019740B (en) | 2012-12-28 | 2012-12-28 | A kind of method and device obtaining importing table and relocation table |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103019740B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108229148B (en) * | 2016-12-21 | 2022-06-21 | 武汉安天信息技术有限责任公司 | Sandbox unshelling method and sandbox unshelling system based on Android virtual machine |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101414328A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Apparatus and method for exuviations of file |
| CN102004884A (en) * | 2009-08-28 | 2011-04-06 | 华为技术有限公司 | Method and device capable of acquiring executable file input table |
| CN102184103A (en) * | 2011-05-12 | 2011-09-14 | 电子科技大学 | Shell characteristic extracting method of software protection shell |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009075116A1 (en) * | 2007-12-12 | 2009-06-18 | Nec Corporation | Program debug method, program conversion method, and program debug device and program conversion device using the method, and storage medium |
-
2012
- 2012-12-28 CN CN201210587722.2A patent/CN103019740B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101414328A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Apparatus and method for exuviations of file |
| CN102004884A (en) * | 2009-08-28 | 2011-04-06 | 华为技术有限公司 | Method and device capable of acquiring executable file input table |
| CN102184103A (en) * | 2011-05-12 | 2011-09-14 | 电子科技大学 | Shell characteristic extracting method of software protection shell |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103019740A (en) | 2013-04-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20090094589A1 (en) | Optimizing heap memory usage | |
| CN106021985B (en) | A kind of genomic data compression method | |
| CN106611037A (en) | Method and device for distributed diagram calculation | |
| KR102061466B1 (en) | Conservative garbage collecting and tagged integers for memory management | |
| US8725461B2 (en) | Inferring effects of configuration on performance | |
| CN103019884A (en) | Memory page de-weight method and memory page de-weight device based on virtual machine snapshot | |
| CN106557307B (en) | Service data processing method and system | |
| CN105224534A (en) | A kind of method and device of asking response | |
| CN109033365B (en) | Data processing method and related equipment | |
| CN105677687A (en) | Data processing method and device | |
| US20120174076A1 (en) | Systems and methods for profiling servers | |
| CN103019740B (en) | A kind of method and device obtaining importing table and relocation table | |
| CN109189343A (en) | A kind of metadata rule method, apparatus, equipment and computer readable storage medium | |
| CN107220069B (en) | Shuffle method for nonvolatile memory | |
| DE102019103279A1 (en) | TECHNIQUES FOR INFORMATIONGRAPHIC COMPRESSION | |
| CN104598409A (en) | Method and device for processing input and output requests | |
| CN106503260B (en) | Method and device for improving effective storage space of database | |
| CN103019739B (en) | The restorative procedure of relocation table, program hulling method and relevant apparatus | |
| CN104657216A (en) | Resource allocation method and device for resource pool | |
| CN105279007A (en) | Multi-core processor simulation method and apparatus | |
| US9507794B2 (en) | Method and apparatus for distributed processing of file | |
| CN104252415B (en) | Method and system for redistributing data | |
| CN103210389B (en) | A kind for the treatment of method and apparatus of metadata | |
| CN111143182B (en) | Analysis method, device and storage medium for process behavior | |
| CN104731968A (en) | Cluster excavation method of large-scale data set of single machine |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100089 Beijing city Haidian District Road No. 4 North wa Yitai three storey building Patentee after: NSFOCUS Technologies Group Co.,Ltd. Patentee after: NSFOCUS TECHNOLOGIES Inc. Address before: 100089 Beijing city Haidian District Road No. 4 North wa Yitai three storey building Patentee before: NSFOCUS INFORMATION TECHNOLOGY Co.,Ltd. Patentee before: NSFOCUS TECHNOLOGIES Inc. |