CN104077523B - The method and apparatus that software is handled - Google Patents
The method and apparatus that software is handled Download PDFInfo
- Publication number
- CN104077523B CN104077523B CN201410293735.8A CN201410293735A CN104077523B CN 104077523 B CN104077523 B CN 104077523B CN 201410293735 A CN201410293735 A CN 201410293735A CN 104077523 B CN104077523 B CN 104077523B
- Authority
- CN
- China
- Prior art keywords
- function
- programs
- program
- preset content
- hook
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
Abstract
The present invention proposes a kind of method and apparatus handled software, which includes installation message hook；Execution preset content is redirected, the preset content makes the program normal use of the limited authority in the limited program of the software detection to be processed and/or binding authority according to the message hook；After executing preset content, the software to be processed, and the program of limited authority described in normal use are continued to execute.This method can be when some softwares limit certain programs, and limited program still can be used normally in user.
Description
Technical field
The present invention relates to field of communication technology more particularly to a kind of method and apparatus handled software.
Background technology
User can be surfed the Internet by client, be surfed the Internet for example, by using campus network client.Under some scenes
User may need using the function of being limited in client, for example, the limitation of campus network client uses Wi-Fi, but some scenes
Lower user needs to use Wi-Fi by campus network client.Therefore, required consideration for how under these scenes normal use some
The limitation function of software.
Invention content
The present invention is directed to solve at least some of the technical problems in related technologies.
For this purpose, an object of the present invention is to provide a kind of method handled software, this method can be one
When a little softwares limit certain programs, limited program still can be used normally in user.
It is another object of the present invention to propose a kind of device handled software.
In order to achieve the above objectives, the method that software is handled that first aspect present invention embodiment proposes, including：Peace
Fill message hook；According to the message hook, in the limited program of the software detection to be processed and/or binding authority,
Execution preset content is redirected, the preset content makes the program normal use of the limited authority；Executing preset content
Afterwards, the software to be processed, and the program of limited authority described in normal use are continued to execute.
The method handled software that first aspect present invention embodiment proposes, execution is redirected by the message hook
Preset content, the preset content make the program normal use of limited authority, therefore, the limitation work(of software can be used normally
Can, promote user experience.
In order to achieve the above objectives, the device that software is handled that second aspect of the present invention embodiment proposes, including：Peace
Die-filling piece, it is used for installation message hook；Jump module is used for according to the message hook, in the software detection to be processed
And/or when the limited program of binding authority, execution preset content is redirected, the preset content makes the program of the limited authority
Normal use；Processing module, for after having executed preset content, continuing to execute the software to be processed, and normal use
The program of the limited authority.
The device handled software that second aspect of the present invention embodiment proposes, execution is redirected by the message hook
Preset content, the preset content make the program normal use of limited authority, therefore, the limitation work(of software can be used normally
Can, promote user experience.
In order to achieve the above objectives, the client device that third aspect present invention embodiment proposes, including：Shell, processor,
Memory, circuit board and power circuit, wherein circuit board is placed in the space interior that shell surrounds, and processor and memory are set
It sets on circuit boards；Power circuit, for being each circuit or the device power supply of client device；Memory is for storing and can hold
Line program code；Processor is run and executable program code pair by reading the executable program code stored in memory
The program answered, for executing following steps：Installation message hook；According to the message hook, in the software to be processed
When the program that detection and/or binding authority are limited, execution preset content is redirected, the preset content makes the limited authority
Program normal use；After having executed preset content, continue to execute the software to be processed, and permission described in normal use by
The program of limit.
The client device that third aspect present invention embodiment proposes, execution preset content is redirected by the message hook,
The preset content makes the program normal use of limited authority, therefore, the limitation function of software can be used normally, promotes user
Experience.
The additional aspect of the present invention and advantage will be set forth in part in the description, and will partly become from the following description
Obviously, or practice through the invention is recognized.
Description of the drawings
Above-mentioned and/or additional aspect and advantage of the invention will become from the following description of the accompanying drawings of embodiments
Obviously and it is readily appreciated that, wherein：
Fig. 1 is the flow diagram for the method handled software that one embodiment of the invention proposes；
Fig. 2 is to execute preset content and after executing preset content according to message hook in the embodiment of the present invention, after
The flow diagram of the continuous former software of processing；
Fig. 3 is the flow diagram for the method handled software that another embodiment of the present invention proposes；
Fig. 4 is the flow diagram for the method handled software that another embodiment of the present invention proposes；
Fig. 5 is the structural schematic diagram for the device handled software that another embodiment of the present invention proposes.
Specific implementation mode
The embodiment of the present invention is described below in detail, examples of the embodiments are shown in the accompanying drawings, wherein from beginning to end
Same or similar label indicates same or similar element or element with the same or similar functions.Below with reference to attached
The embodiment of figure description is exemplary, and is only used for explaining the present invention, and is not considered as limiting the invention.On the contrary, this
The embodiment of invention includes all changes fallen within the scope of the spiritual and intension of attached claims, modification and is equal
Object.
Fig. 1 is the flow diagram for the method handled software that one embodiment of the invention proposes, this method includes：
S11：Installation message hook；
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：Application programming interface (Application Programming Interface,
API) inline (Inline) hook (hook), alternatively, address table (Import Address Table, IAT) hook is imported, or
Person exports address table (Export Address Table, EAT) hook.
S12：According to the message hook, in the limited program of the software detection to be processed and/or binding authority,
Execution preset content is redirected, the preset content makes the program normal use of the limited authority；
Wherein, software to be processed can specifically refer to campus network client.
The program of limited authority can refer to Wi-Fi programs.
Dynamic link library (Dynamic Link Library, DLL) can be injected into campus netter by message hook
Family end, so that campus network client executes preset content according to DLL.
S13：After having executed preset content, continue to execute the software to be processed, and permission described in normal use by
The program of limit.
Referring to Fig. 2, to execute preset content according to message hook and after executing preset content, continuing with former soft
The flow diagram of part.It can specifically include：
S21：It changes original function and instructs A, then make what original function should execute instruction A to jump to custom function, make by oneself
Adopted function MyFn function representations.
In the present embodiment, original function can be specifically the corresponding function of campus network client.
S22：The preset content defined in MyFn functions.
In the present embodiment, the preset content is for filtering Wi-Fi data；And/or the preset content is used for described
Campus network client returns to error value, so that the campus network client cannot stop the Wi-Fi programs.
S23：The instruction A that the original function replaced is executed in MyFn functions, to ensure that original function correctly executes.
S24：It is continued to execute in the instruction B executed at instruction A and then rebound original function, to ensure that original function executes
The continuity of flow.
Wherein, the ellipsis in Fig. 2 can indicate one section of instruction, can also remove and indicate hook function headers.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.
Fig. 3 is the flow diagram for the method handled software that another embodiment of the present invention proposes, this method packet
It includes：
S31：Installation message hook.
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：API Inline hook, alternatively, IAT hook, alternatively, EAT hook.
The present embodiment is by taking API Inline hook as an example.
S32：According to the message hook, when campus network client detects Wi-Fi programs, it is default interior to redirect execution first
Hold, the first preset content is for filtering Wi-Fi data.
Specifically, S32 may include：According to the message hook, in the campus network client call for detecting Wi-
When the function of Fi programs, hook is carried out to the function for detecting Wi-Fi programs, redirects and executes the first preset content.
Further, when the preset content is specifically used for what the filtering function for detecting Wi-Fi programs obtained
When data, the function for detecting Wi-Fi programs includes at least one in following item：
First function, the first function are used to obtain the information of the quantity and network interface card of the network interface card of current active；
Specifically, first function can be GetAdaptersInfo.
The many campus network clients of this function can all go the network interface card quantity and network interface card for calling it to go acquisition current active
Relevant information (includes the description name of network interface card, the IP etc. that current network interface card uses), once they find movable network interface cards be more than 2 with
All movable network interface cards that upper or discovery is got describe entitled " Microsoft virtual Wi-Fi miniport
Adapter ", " microsoft trustship network virtuals adapter ", " microsoft wi-fi direct virtual adapters ",
" microsoft hosted network virtual adapter " (it is calling system bearer network that these network interface cards, which describe name,
Mechanism creates hot spot, the equipment that system virtualization comes out) it then will disconnect current connection.
Corresponding solution, this implementation can carry out API HOOK to this function, then virtual comprising above system
The description name of equipment out filters out to return again to and goes to judge to campus network client entirely, and such campus network client just detects not
The equipment come is fictionalized to user, WI-FI can be used normally in user.
Second function, the second function are used to read the key assignments of registration table, and the key assignments of the registration table is for being shown to be
It is no there are multiple network interface cards or use IE browser proxy surfing.
Specifically, second function can be RegQueryValueExA.
This function can call RegQueryValueExA to go for inquiring registration table detection, most of campus network client
The value inside registration table is read, the presence for there are multiple movable network interface cards on active user's machine is detected with this, because new when have
Equipment can leave a trace when establishment inside registration table, and campus network client software is by detecting registration table HKEY_
LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-
BFC1-08002bE10318 } or HKEY_LOCAL_MACHINE Software Microsoft Windows
CurrentVersion such as " DhcpIPAddress " under Internet Settings, " IPAddress ",
" DHCPNameServer ", " EnableDHCP ", " DhcpSubnetMask ", " NameServer " etc. are to judge user with this
It is no there are multiple network interface cards or use IE browser proxy surfing.
Corresponding solution, the present embodiment is by carrying out API HOOK to RegQueryValueExA and judging campus network journey
Whether sequence can go to inquire registration table key assignments mentioned above, just filter these values if it is these value the present embodiment are inquired, make school
Garden net program gets the information of mistake, to judge that user is unsuccessfully allow to use WI-FI programs.
When the preset content belongs to the school specifically for what the filtering function for detecting Wi-Fi programs obtained
When data in the blacklist of garden net client, the function for detecting Wi-Fi programs includes at least one in following item
：
Third function, the third function are used to detect the DLL module names in current active process and the process；
Specifically, third function can be ZwQuerySystemInformation.
When campus network client limits Wi-Fi, active user can be detected and whether there is blacklist process, campus network program
By calling CreateToolhelp32Snapshot Process32First/Process32Next, Module32First/
Module32Next goes DLL modules existing for detection current active process and process the inside.If these process names and DLL modules
Name is inside the blacklist of campus network program, then campus network program will disconnect current network.
Corresponding solution, because this function enumeration process of CreateToolhelp32Snapshot is by more bottom
Function ZwQuerySystemInformation go to obtain, so the present embodiment to ZwQuerySystemInformation this
A function carries out HOOK, includes that consumer process data are all hidden what the function returned, while by Module32Next
It carries out HOOK to hide the DLL module informations of user, to make process and module information of the campus network Programmable detection less than user.
4th function, the 4th function are used to detect the window title of current active；
Specifically, the 4th function can be InternalFindWindowEx.
Wherein, campus network client goes to search current all movable window titles by FindWindow functions, then
This title is judged with the presence or absence of blacklist the inside, and if so, prompt and suspension.
Corresponding solution, due to FindWindow this function eventually calls arrive InternalFindWindowEx this
Inside a function, therefore the present embodiment directly hangs InternalFindWindowEx this function and filtering is gone to include user program mark
Then the data of autograph directly return to the detection around campus network client.
5th function, the 5th function are used to detect the information of the network interface card currently obtained.
Specifically, the 5th function can be pcap_findalldevs and PacketOpenAdapter.
Wherein, by calling third equation to go to detect, campus network client can call more famous network to cut packet hair
The interface pcap_findalldevs or PacketOpenAdapter of packet program Wincap goes to obtain and detect current all nets
The information of card.If it finds the description name of network interface card inside its blacklist, it can direct suspension.
Corresponding solution, the present embodiment carry out HOOK to pcap_findalldevs and PacketOpenAdapter, so
The data for the device-dependent description name that filtering and user's network interface card or system virtualization come out afterwards, to around campus network program
Detection.
S33：After executing preset content, campus network client, and normal use Wi-Fi programs are continued to execute.
Preset content is executed according to message hook and after executing preset content, the flow for continuing with former software is shown
Intention can be referring specifically to Fig. 2, and this embodiment is not repeated.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.This implementation
Example is by filtering Wi-Fi data so that campus network client can't detect user and use Wi-Fi, so as in campus netter
Normal use Wi-Fi in the end of family.
Fig. 4 is the flow diagram for the method handled software that another embodiment of the present invention proposes, this method packet
It includes：
S41：Installation message hook.
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：API Inline hook, alternatively, IAT hook, alternatively, EAT hook.
The present embodiment is by taking API Inline hook as an example.
S42：According to the message hook, when the campus network client call is used to limit the function of Wi-Fi programs,
To it is described for limit Wi-Fi programs function carry out hook, redirect execute the second preset content, the second preset content be used for
The campus network client returns to error value.
The function for limiting Wi-Fi programs includes at least one in following item：
6th function, for closing the service and/or driving that create hot spot；
Specifically, the 6th function can be ControlService.
Wherein, campus network client detects the service state of current system installation, quilt by QueryServiceStatus
The Service name of detection has " SharedAccess ", " RemoteAccess ", " WZCSVC ", " Wlansvc ", " ALG ",
" dot3svc ", " WwanSvc ", " mpssvc " etc., also other third parties drive name, if these service or drive at this time
Operating status is processing SERVER_RUNNING (indicating this service processing operating status), because these services are all created with system
Hot spot correlation is built, then campus network client can call ControlService that these services are closed, is made to limit user
Use WI-FI.
Corresponding solution, the present embodiment is by carrying out API HOOK to ControlService and judging that campus network interface card is
It is no to go to stop service mentioned above, if so the present embodiment just directly return a value to campus network program be allowed to for
These services have stopped.
7th function, it is shared for closing；
Specifically, the 7th function can be IWbemClassObject::Get and
INetSharingConfiguration::DisableSharing。
Wherein, campus network client detection current active network interface card shares state (opening ICS), and campus network program passes through tune
It is gone to inquire whether current locality connection activity network interface card has been switched on shared (the i.e. value of IsIcsPublics with the interface of system WMI
Whether be TRUE), also fictionalize come hot spot equipment whether be set (i.e. the value of IsIcsPrivate whether be
TRUE) if the two conditions of all meet the bearer network mechanism establishment hot spot online for illustrating that system is used in active user,
So it just will disconnect network.
Corresponding solution：The present embodiment is to campus network routine call IWbemClassObject::Shape is shared in Get detections
State this function HOOK, make its to current active network interface card share state misjudgment, while the present embodiment also
INetSharingConfiguration::This function of DisableSharing carries out HOOK, prevents it from this function being called to close
It is shared to close ICS.
8th function is used to open blacklist driving symbolic name；
Specifically, the 8th function is CreateFile.
Wherein, whether campus network client detection active user has the blacklist driving Symbolic Links of installation campus network, school
Garden net program successfully illustrates that the driving has been pacified by calling CreateFile to go to open blacklist driving symbolic name if opened
It installs.So campus network program will prompt simultaneously suspension.
Corresponding solution：The present embodiment is used by carrying out HOOK to CreateFile when campus network program attempts to open
The driving symbolic name at family just refuses it and opens the driving of user.
9th function, for detecting dhcp client port；
Specifically, the 9th function is GetUdpTable.
Wherein, campus network client whether there is 67 ports by the UDP of GetUdpTable function check active users,
The port is the client port of DHCP, is mainly used for DHCP and is responded to the broadcast of client request.Campus network passes through inspection
This port is surveyed it may determine that whether active user enables DHCP, will disconnect network connection once it finds that user enables.
Corresponding solution：The present embodiment carries out HOOK to GetUdpTable, changes the data of this function return, makes
Campus network client-side program is obtained less than 67 ports.To keep the program of user normal around the detection of campus network client
It uses.
Tenth function, for creating process, the process is for parsing IP address quantity.
Specifically, the tenth function is CreateProcess.
Wherein, campus network client by creating cmd.exe programs, then go to obtain relevant information by calling system order, has
A little campus network clients can go to create cmd.exe by CreateProcess and then this order is opened for parameter with ipconfig
As soon as dynamic process, then it the data that ipconfig this order returns parse once find multiple IP so it recognize
It surfs the Internet using multiple network interface cards for active user.Then it will disconnect the network connection of user.
Corresponding solution party decides on a verdict：The present embodiment links up with CreateProcess, then judges the parameter of this function
The inside returns to its establishment process that do not allow with the presence or absence of this order of ipconfig, if there is so direct.To bypass campus
The detection of net program.
S43：After executing preset content, campus network client, and normal use Wi-Fi programs are continued to execute.
Preset content is executed according to message hook and after executing preset content, the flow for continuing with former software is shown
Intention can be referring specifically to Fig. 2, and this embodiment is not repeated.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.This implementation
Example to the campus network client by returning to error value so that and campus network client thinks to have limited Wi-Fi, so as to
With the normal use Wi-Fi in campus network client.
Fig. 5 is the structural schematic diagram for the device handled software that another embodiment of the present invention proposes, the device 50
Including installation module 51, jump module 52 and processing module 53.
Module 51 is installed and is used for installation message hook；
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
The message hook includes：API Inline hooks；Alternatively, IAT hooks；Alternatively, EAT hooks.
Jump module 52 is used for according to the message hook, the software detection to be processed and/or binding authority by
When the program of limit, execution preset content is redirected, the preset content makes the program normal use of the limited authority；
Wherein, the software to be processed is campus network client, and the program of the limited authority is Wi-Fi programs.
Dynamic link library (Dynamic Link Library, DLL) can be injected into campus netter by message hook
Family end, so that campus network client executes preset content according to DLL.
In one embodiment, the preset content is for filtering Wi-Fi data.
When the preset content is for when filtering Wi-Fi data, the jump module 52 to be specifically used for：
According to the message hook, when the campus network client call is used to detect the function of Wi-Fi programs, to institute
It states the function for detecting Wi-Fi programs and carries out hook, redirect execution preset content.
Wherein, may include for filtering Wi-Fi data：It is obtained for filtering the function for detecting Wi-Fi programs
The data taken, and, belong to the black of the campus network client for filter that the function for detecting Wi-Fi programs obtains
Data in list.
In one embodiment, obtained when the preset content is specifically used for the filtering function for detecting Wi-Fi programs
When the data taken, the function for detecting Wi-Fi programs includes at least one in following item：
First function, the first function are used to obtain the information of the quantity and network interface card of the network interface card of current active；
Specifically, first function can be GetAdaptersInfo.
The many campus network clients of this function can all go the network interface card quantity and network interface card for calling it to go acquisition current active
Relevant information (includes the description name of network interface card, the IP etc. that current network interface card uses), once they find movable network interface cards be more than 2 with
All movable network interface cards that upper or discovery is got describe entitled " Microsoft virtual Wi-Fi miniport
Adapter ", " microsoft trustship network virtuals adapter ", " microsoft wi-fi direct virtual adapters ",
" microsoft hosted network virtual adapter " (it is calling system bearer network that these network interface cards, which describe name,
Mechanism creates hot spot, the equipment that system virtualization comes out) it then will disconnect current connection.
Corresponding solution, this implementation can carry out API HOOK to this function, then virtual comprising above system
The description name of equipment out filters out to return again to and goes to judge to campus network client entirely, and such campus network client just detects not
The equipment come is fictionalized to user, WI-FI can be used normally in user.
Second function, the second function are used to read the key assignments of registration table, and the key assignments of the registration table is for being shown to be
It is no there are multiple network interface cards or use IE browser proxy surfing.
Specifically, second function can be RegQueryValueExA.
This function can call RegQueryValueExA to go for inquiring registration table detection, most of campus network client
The value inside registration table is read, the presence for there are multiple movable network interface cards on active user's machine is detected with this, because new when have
Equipment can leave a trace when establishment inside registration table, and campus network client software is by detecting registration table HKEY_
LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-
BFC1-08002bE10318 } or HKEY_LOCAL_MACHINE Software Microsoft Windows
CurrentVersion such as " DhcpIPAddress " under Internet Settings, " IPAddress ",
" DHCPNameServer ", " EnableDHCP ", " DhcpSubnetMask ", " NameServer " etc. are to judge user with this
It is no there are multiple network interface cards or use IE browser proxy surfing.
Corresponding solution, the present embodiment is by carrying out API HOOK to RegQueryValueExA and judging campus network journey
Whether sequence can go to inquire registration table key assignments mentioned above, just filter these values if it is these value the present embodiment are inquired, make school
Garden net program gets the information of mistake, to judge that user is unsuccessfully allow to use WI-FI programs.
In one embodiment, obtained when the preset content is specifically used for the filtering function for detecting Wi-Fi programs
When data in the blacklist for belonging to the campus network client taken, the function for detecting Wi-Fi programs includes such as
At least one of in lower item：
Third function, the third function are used to detect the DLL module names in current active process and the process；
Specifically, third function can be ZwQuerySystemInformation.
When campus network client limits Wi-Fi, active user can be detected and whether there is blacklist process, campus network program
By calling CreateToolhelp32Snapshot Process32First/Process32Next, Module32First/
Module32Next goes DLL modules existing for detection current active process and process the inside.If these process names and DLL modules
Name is inside the blacklist of campus network program, then campus network program will disconnect current network.
Corresponding solution, because this function enumeration process of CreateToolhelp32Snapshot is by more bottom
Function ZwQuerySystemInformation go to obtain, so the present embodiment to ZwQuerySystemInformation this
A function carries out HOOK, includes that consumer process data are all hidden what the function returned, while by Module32Next
It carries out HOOK to hide the DLL module informations of user, to make process and module information of the campus network Programmable detection less than user.
4th function, the 4th function are used to detect the window title of current active；
Specifically, the 4th function can be InternalFindWindowEx.
Wherein, campus network client goes to search current all movable window titles by FindWindow functions, then
This title is judged with the presence or absence of blacklist the inside, and if so, prompt and suspension.
Corresponding solution, due to FindWindow this function eventually calls arrive InternalFindWindowEx this
Inside a function, therefore the present embodiment directly hangs InternalFindWindowEx this function and filtering is gone to include user program mark
Then the data of autograph directly return to the detection around campus network client.
5th function, the 5th function are used to detect the information of the network interface card currently obtained.
Specifically, the 5th function can be pcap_findalldevs and PacketOpenAdapter.
Wherein, by calling third equation to go to detect, campus network client can call more famous network to cut packet hair
The interface pcap_findalldevs or PacketOpenAdapter of packet program Wincap goes to obtain and detect current all nets
The information of card.If it finds the description name of network interface card inside its blacklist, it can direct suspension.
Corresponding solution, the present embodiment carry out HOOK to pcap_findalldevs and PacketOpenAdapter, so
The data for the device-dependent description name that filtering and user's network interface card or system virtualization come out afterwards, to around campus network program
Detection.
In one embodiment, the preset content is used to return to error value to the campus network client, so that described
Campus network client cannot stop the Wi-Fi programs.
When the preset content is used to return to error value to the campus network client, the jump module is specifically used
In：
According to the message hook, when the campus network client call is used to limit the function of Wi-Fi programs, to institute
It states the function for limiting Wi-Fi programs and carries out hook, redirect execution preset content.
The function for limiting Wi-Fi programs includes at least one in following item：
6th function, for closing the service and/or driving that create hot spot；
Specifically, the 6th function can be ControlService.
Wherein, campus network client detects the service state of current system installation, quilt by QueryServiceStatus
The Service name of detection has " SharedAccess ", " RemoteAccess ", " WZCSVC ", " Wlansvc ", " ALG ",
" dot3svc ", " WwanSvc ", " mpssvc " etc., also other third parties drive name, if these service or drive at this time
Operating status is processing SERVER_RUNNING (indicating this service processing operating status), because these services are all created with system
Hot spot correlation is built, then campus network client can call ControlService that these services are closed, is made to limit user
Use WI-FI.
Corresponding solution, the present embodiment is by carrying out API HOOK to ControlService and judging that campus network interface card is
It is no to go to stop service mentioned above, if so the present embodiment just directly return a value to campus network program be allowed to for
These services have stopped.
7th function, it is shared for closing；
Specifically, the 7th function can be IWbemClassObject::Get and
INetSharingConfiguration::DisableSharing。
Wherein, campus network client detection current active network interface card shares state (opening ICS), and campus network program passes through tune
It is gone to inquire whether current locality connection activity network interface card has been switched on shared (the i.e. value of IsIcsPublics with the interface of system WMI
Whether be TRUE), also fictionalize come hot spot equipment whether be set (i.e. the value of IsIcsPrivate whether be
TRUE) if the two conditions of all meet the bearer network mechanism establishment hot spot online for illustrating that system is used in active user,
So it just will disconnect network.
Corresponding solution：The present embodiment is to campus network routine call IWbemClassObject::Shape is shared in Get detections
State this function HOOK, make its to current active network interface card share state misjudgment, while the present embodiment also
INetSharingConfiguration::This function of DisableSharing carries out HOOK, prevents it from this function being called to close
It is shared to close ICS.
8th function is used to open blacklist driving symbolic name；
Specifically, the 8th function is CreateFile.
Wherein, whether campus network client detection active user has the blacklist driving Symbolic Links of installation campus network, school
Garden net program successfully illustrates that the driving has been pacified by calling CreateFile to go to open blacklist driving symbolic name if opened
It installs.So campus network program will prompt simultaneously suspension.
Corresponding solution：The present embodiment is used by carrying out HOOK to CreateFile when campus network program attempts to open
The driving symbolic name at family just refuses it and opens the driving of user.
9th function, for detecting dhcp client port；
Specifically, the 9th function is GetUdpTable.
Wherein, campus network client whether there is 67 ports by the UDP of GetUdpTable function check active users,
The port is the client port of DHCP, is mainly used for DHCP and is responded to the broadcast of client request.Campus network passes through inspection
This port is surveyed it may determine that whether active user enables DHCP, will disconnect network connection once it finds that user enables.
Corresponding solution：The present embodiment carries out HOOK to GetUdpTable, changes the data of this function return, makes
Campus network client-side program is obtained less than 67 ports.To keep the program of user normal around the detection of campus network client
It uses.
Tenth function, for creating process, the process is for parsing IP address quantity.
Specifically, the tenth function is CreateProcess.
Wherein, campus network client by creating cmd.exe programs, then go to obtain relevant information by calling system order, has
A little campus network clients can go to create cmd.exe by CreateProcess and then this order is opened for parameter with ipconfig
As soon as dynamic process, then it the data that ipconfig this order returns parse once find multiple IP so it recognize
It surfs the Internet using multiple network interface cards for active user.Then it will disconnect the network connection of user.
Corresponding solution party decides on a verdict：The present embodiment links up with CreateProcess, then judges the parameter of this function
The inside returns to its establishment process that do not allow with the presence or absence of this order of ipconfig, if there is so direct.To bypass campus
The detection of net program.
Processing module 53 is used for after having executed preset content, continues to execute the software to be processed, and normal use
The program of the limited authority.
Preset content is executed according to message hook and after executing preset content, the flow for continuing with former software is shown
Intention may refer to Fig. 2, and this embodiment is not repeated.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.
The embodiment of the present invention additionally provides a kind of client device, which includes shell, processor, storage
Device, circuit board and power circuit, wherein circuit board is placed in the space interior that shell surrounds, and processor and memory setting exist
On circuit board；Power circuit, for being each circuit or the device power supply of client device；Memory is for storing executable journey
Sequence code；Processor is corresponding with executable program code to run by reading the executable program code stored in memory
Program, for executing following steps：
S11：Installation message hook；
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：Application programming interface (Application Programming Interface,
API) Inline hooks (hook), alternatively, address table (Import Address Table, IAT) hook is imported, alternatively, export
Address table (Export Address Table, EAT) hook.
S12：According to the message hook, in the limited program of the software detection to be processed and/or binding authority,
Execution preset content is redirected, the preset content makes the program normal use of the limited authority；
Wherein, software to be processed can specifically refer to campus network client.
The program of limited authority can refer to Wi-Fi programs.
Dynamic link library (Dynamic Link Library, DLL) can be injected into campus netter by message hook
Family end, so that campus network client executes preset content according to DLL.
S13：After executing preset content, the software to be processed, and limited authority described in normal use are continued to execute
Program.
Referring to Fig. 2, to execute preset content according to message hook and after executing preset content, continuing with former soft
The flow diagram of part.It can specifically include：
S21：It changes original function and instructs A, then make what original function should execute instruction A to jump to custom function, make by oneself
Adopted function MyFn function representations.
In the present embodiment, original function can be specifically the corresponding function of campus network client.
S22：The preset content defined in MyFn functions.
In the present embodiment, the preset content is for filtering Wi-Fi data；And/or the preset content is used for described
Campus network client returns to error value, so that the campus network client cannot stop the Wi-Fi programs.
S23：The instruction A that the original function replaced is executed in MyFn functions, to ensure that original function correctly executes.
S24：It is continued to execute in the instruction B executed at instruction A and then rebound original function, to ensure that original function executes
The continuity of flow.
Wherein, the ellipsis in Fig. 2 can indicate one section of instruction, can also remove and indicate hook function headers.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.
In another embodiment, processor runs and can perform by reading the executable program code stored in memory
The corresponding program of program code, for executing following steps：
S31：Installation message hook.
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：API Inline hook, alternatively, IAT hook, alternatively, EAT hook.
The present embodiment is by taking API Inline hook as an example.
S32：According to the message hook, when campus network client detects Wi-Fi programs, it is default interior to redirect execution first
Hold, the first preset content is for filtering Wi-Fi data.
Specifically, S32 may include：According to the message hook, in the campus network client call for detecting Wi-
When the function of Fi programs, hook is carried out to the function for detecting Wi-Fi programs, redirects and executes the first preset content.
Further, when the preset content is specifically used for what the filtering function for detecting Wi-Fi programs obtained
When data, the function for detecting Wi-Fi programs includes at least one in following item：
First function, the first function are used to obtain the information of the quantity and network interface card of the network interface card of current active；
Specifically, first function can be GetAdaptersInfo.
The many campus network clients of this function can all go the network interface card quantity and network interface card for calling it to go acquisition current active
Relevant information (includes the description name of network interface card, the IP etc. that current network interface card uses), once they find movable network interface cards be more than 2 with
All movable network interface cards that upper or discovery is got describe entitled " Microsoft virtual Wi-Fi miniport
Adapter ", " microsoft trustship network virtuals adapter ", " microsoft wi-fi direct virtual adapters ",
" microsoft hosted network virtual adapter " (it is calling system bearer network that these network interface cards, which describe name,
Mechanism creates hot spot, the equipment that system virtualization comes out) it then will disconnect current connection.
Corresponding solution, this implementation can carry out API HOOK to this function, then virtual comprising above system
The description name of equipment out filters out to return again to and goes to judge to campus network client entirely, and such campus network client just detects not
The equipment come is fictionalized to user, WI-FI can be used normally in user.
Second function, the second function are used to read the key assignments of registration table, and the key assignments of the registration table is for being shown to be
It is no there are multiple network interface cards or use IE browser proxy surfing.
Specifically, second function can be RegQueryValueExA.
This function can call RegQueryValueExA to go for inquiring registration table detection, most of campus network client
The value inside registration table is read, the presence for there are multiple movable network interface cards on active user's machine is detected with this, because new when have
Equipment can leave a trace when establishment inside registration table, and campus network client software is by detecting registration table HKEY_
LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-
BFC1-08002bE10318 } or HKEY_LOCAL_MACHINE Software Microsoft Windows
CurrentVersion such as " DhcpIPAddress " under Internet Settings, " IPAddress ",
" DHCPNameServer ", " EnableDHCP ", " DhcpSubnetMask ", " NameServer " etc. are to judge user with this
It is no there are multiple network interface cards or use IE browser proxy surfing.
Corresponding solution, the present embodiment is by carrying out API HOOK to RegQueryValueExA and judging campus network journey
Whether sequence can go to inquire registration table key assignments mentioned above, just filter these values if it is these value the present embodiment are inquired, make school
Garden net program gets the information of mistake, to judge that user is unsuccessfully allow to use WI-FI programs.
When the preset content belongs to the school specifically for what the filtering function for detecting Wi-Fi programs obtained
When data in the blacklist of garden net client, the function for detecting Wi-Fi programs includes at least one in following item
：
Third function, the third function are used to detect the DLL module names in current active process and the process；
Specifically, third function can be ZwQuerySystemInformation.
When campus network client limits Wi-Fi, active user can be detected and whether there is blacklist process, campus network program
By calling CreateToolhelp32Snapshot Process32First/Process32Next, Module32First/
Module32Next goes DLL modules existing for detection current active process and process the inside.If these process names and DLL modules
Name is inside the blacklist of campus network program, then campus network program will disconnect current network.
Corresponding solution, because this function enumeration process of CreateToolhelp32Snapshot is by more bottom
Function ZwQuerySystemInformation go to obtain, so the present embodiment to ZwQuerySystemInformation this
A function carries out HOOK, includes that consumer process data are all hidden what the function returned, while by Module32Next
It carries out HOOK to hide the DLL module informations of user, to make process and module information of the campus network Programmable detection less than user.
4th function, the 4th function are used to detect the window title of current active；
Specifically, the 4th function can be InternalFindWindowEx.
Wherein, campus network client goes to search current all movable window titles by FindWindow functions, then
This title is judged with the presence or absence of blacklist the inside, and if so, prompt and suspension.
Corresponding solution, due to FindWindow this function eventually calls arrive InternalFindWindowEx this
Inside a function, therefore the present embodiment directly hangs InternalFindWindowEx this function and filtering is gone to include user program mark
Then the data of autograph directly return to the detection around campus network client.
5th function, the 5th function are used to detect the information of the network interface card currently obtained.
Specifically, the 5th function can be pcap_findalldevs and PacketOpenAdapter.
Wherein, by calling third equation to go to detect, campus network client can call more famous network to cut packet hair
The interface pcap_findalldevs or PacketOpenAdapter of packet program Wincap goes to obtain and detect current all nets
The information of card.If it finds the description name of network interface card inside its blacklist, it can direct suspension.
Corresponding solution, the present embodiment carry out HOOK to pcap_findalldevs and PacketOpenAdapter, so
The data for the device-dependent description name that filtering and user's network interface card or system virtualization come out afterwards, to around campus network program
Detection.
S33：After executing preset content, campus network client, and normal use Wi-Fi programs are continued to execute.
Preset content is executed according to message hook and after executing preset content, the flow for continuing with former software is shown
Intention can be referring specifically to Fig. 2, and this embodiment is not repeated.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.This implementation
Example is by filtering Wi-Fi data so that campus network client can't detect user and use Wi-Fi, so as in campus netter
Normal use Wi-Fi in the end of family.
In another embodiment, processor runs and can perform by reading the executable program code stored in memory
The corresponding program of program code, for executing following steps：
S41：Installation message hook.
Wherein it is possible to by system provide SetWindowsHookEx function installation message hooks, with reach injection or
Person handles related system information.
Message hook may include：API Inline hook, alternatively, IAT hook, alternatively, EAT hook.
The present embodiment is by taking API Inline hook as an example.
S42：According to the message hook, when the campus network client call is used to limit the function of Wi-Fi programs,
To it is described for limit Wi-Fi programs function carry out hook, redirect execute the second preset content, the second preset content be used for
The campus network client returns to error value.
The function for limiting Wi-Fi programs includes at least one in following item：
6th function, for closing the service and/or driving that create hot spot；
Specifically, the 6th function can be ControlService.
Wherein, campus network client detects the service state of current system installation, quilt by QueryServiceStatus
The Service name of detection has " SharedAccess ", " RemoteAccess ", " WZCSVC ", " Wlansvc ", " ALG ",
" dot3svc ", " WwanSvc ", " mpssvc " etc., also other third parties drive name, if these service or drive at this time
Operating status is processing SERVER_RUNNING (indicating this service processing operating status), because these services are all created with system
Hot spot correlation is built, then campus network client can call ControlService that these services are closed, is made to limit user
Use WI-FI.
Corresponding solution, the present embodiment is by carrying out API HOOK to ControlService and judging that campus network interface card is
It is no to go to stop service mentioned above, if so the present embodiment just directly return a value to campus network program be allowed to for
These services have stopped.
7th function, it is shared for closing；
Specifically, the 7th function can be IWbemClassObject::Get and
INetSharingConfiguration::DisableSharing。
Wherein, campus network client detection current active network interface card shares state (opening ICS), and campus network program passes through tune
It is gone to inquire whether current locality connection activity network interface card has been switched on shared (the i.e. value of IsIcsPublics with the interface of system WMI
Whether be TRUE), also fictionalize come hot spot equipment whether be set (i.e. the value of IsIcsPrivate whether be
TRUE) if the two conditions of all meet the bearer network mechanism establishment hot spot online for illustrating that system is used in active user,
So it just will disconnect network.
Corresponding solution：The present embodiment is to campus network routine call IWbemClassObject::Shape is shared in Get detections
State this function HOOK, make its to current active network interface card share state misjudgment, while the present embodiment also
INetSharingConfiguration::This function of DisableSharing carries out HOOK, prevents it from this function being called to close
It is shared to close ICS.
8th function is used to open blacklist driving symbolic name；
Specifically, the 8th function is CreateFile.
Wherein, whether campus network client detection active user has the blacklist driving Symbolic Links of installation campus network, school
Garden net program successfully illustrates that the driving has been pacified by calling CreateFile to go to open blacklist driving symbolic name if opened
It installs.So campus network program will prompt simultaneously suspension.
Corresponding solution：The present embodiment is used by carrying out HOOK to CreateFile when campus network program attempts to open
The driving symbolic name at family just refuses it and opens the driving of user.
9th function, for detecting dhcp client port；
Specifically, the 9th function is GetUdpTable.
Wherein, campus network client whether there is 67 ports by the UDP of GetUdpTable function check active users,
The port is the client port of DHCP, is mainly used for DHCP and is responded to the broadcast of client request.Campus network passes through inspection
This port is surveyed it may determine that whether active user enables DHCP, will disconnect network connection once it finds that user enables.
Corresponding solution：The present embodiment carries out HOOK to GetUdpTable, changes the data of this function return, makes
Campus network client-side program is obtained less than 67 ports.To keep the program of user normal around the detection of campus network client
It uses.
Tenth function, for creating process, the process is for parsing IP address quantity.
Specifically, the tenth function is CreateProcess.
Wherein, campus network client by creating cmd.exe programs, then go to obtain relevant information by calling system order, has
A little campus network clients can go to create cmd.exe by CreateProcess and then this order is opened for parameter with ipconfig
As soon as dynamic process, then it the data that ipconfig this order returns parse once find multiple IP so it recognize
It surfs the Internet using multiple network interface cards for active user.Then it will disconnect the network connection of user.
Corresponding solution party decides on a verdict：The present embodiment links up with CreateProcess, then judges the parameter of this function
The inside returns to its establishment process that do not allow with the presence or absence of this order of ipconfig, if there is so direct.To bypass campus
The detection of net program.
S43：After executing preset content, campus network client, and normal use Wi-Fi programs are continued to execute.
Preset content is executed according to message hook and after executing preset content, the flow for continuing with former software is shown
Intention can be referring specifically to Fig. 2, and this embodiment is not repeated.
The present embodiment redirects execution preset content by installation message hook, by the message hook, which makes
The program normal use of limited authority is obtained, therefore, the limitation function of software can be used normally, promote user experience.This implementation
Example to the campus network client by returning to error value so that and campus network client thinks to have limited Wi-Fi, so as to
With the normal use Wi-Fi in campus network client.
It should be noted that in the description of the present invention, term " first ", " second " etc. are used for description purposes only, without
It can be interpreted as indicating or implying relative importance.In addition, in the description of the present invention, unless otherwise indicated, the meaning of " multiple "
It is two or more.
Any process described otherwise above or method description are construed as in flow chart or herein, and expression includes
It is one or more for realizing specific logical function or process the step of executable instruction code module, segment or portion
Point, and the range of the preferred embodiment of the present invention includes other realization, wherein can not press shown or discuss suitable
Sequence, include according to involved function by it is basic simultaneously in the way of or in the opposite order, to execute function, this should be of the invention
Embodiment person of ordinary skill in the field understood.
It should be appreciated that each section of the present invention can be realized with hardware, software, firmware or combination thereof.Above-mentioned
In embodiment, software that multiple steps or method can in memory and by suitable instruction execution system be executed with storage
Or firmware is realized.It, and in another embodiment, can be under well known in the art for example, if realized with hardware
Any one of row technology or their combination are realized：With the logic gates for realizing logic function to data-signal
Discrete logic, with suitable combinational logic gate circuit application-specific integrated circuit, programmable gate array (PGA), scene
Programmable gate array (FPGA) etc..
Those skilled in the art are appreciated that realize all or part of step that above-described embodiment method carries
Suddenly it is that relevant hardware can be instructed to complete by program, the program can be stored in a kind of computer-readable storage medium
In matter, which includes the steps that one or a combination set of embodiment of the method when being executed.
In addition, each functional unit in each embodiment of the present invention can be integrated in a processing module, it can also
That each unit physically exists alone, can also two or more units be integrated in a module.Above-mentioned integrated mould
The form that hardware had both may be used in block is realized, can also be realized in the form of software function module.The integrated module is such as
Fruit is realized in the form of software function module and when sold or used as an independent product, can also be stored in a computer
In read/write memory medium.
Storage medium mentioned above can be read-only memory, disk or CD etc..
In the description of this specification, reference term " one embodiment ", " some embodiments ", " example ", " specifically show
The description of example " or " some examples " etc. means specific features, structure, material or spy described in conjunction with this embodiment or example
Point is included at least one embodiment or example of the invention.In the present specification, schematic expression of the above terms are not
Centainly refer to identical embodiment or example.Moreover, particular features, structures, materials, or characteristics described can be any
One or more embodiments or example in can be combined in any suitable manner.
Although the embodiments of the present invention has been shown and described above, it is to be understood that above-described embodiment is example
Property, it is not considered as limiting the invention, those skilled in the art within the scope of the invention can be to above-mentioned
Embodiment is changed, changes, replacing and modification.
Claims (15)
1. a kind of method handled software, which is characterized in that including：
Installation message hook；
It is default to redirect execution in the limited program of software detection to be processed and/or binding authority according to the message hook
Content, the preset content make the program normal use of the limited authority；
After having executed preset content, the software to be processed, and the program of limited authority described in normal use are continued to execute；
Wherein, the software to be processed is campus network client, and the program of the limited authority is Wi-Fi programs；It is described pre-
If content is for filtering Wi-Fi data, wherein the Wi-Fi data filtered out include that network interface card describes name；With the preset content
For returning to error value to the campus network client, so that the campus network client cannot stop the Wi-Fi programs.
2. according to the method described in claim 1, it is characterized in that, described according to the message hook, described to be processed
When the program that software detection and/or binding authority are limited, execution preset content is redirected, including：
According to the message hook, when the campus network client call is used to detect the function of Wi-Fi programs, to the use
Hook is carried out in the function of detection Wi-Fi programs, redirects execution preset content.
3. according to the method described in claim 2, it is characterized in that, when the preset content is specifically used for described in filtering for examining
When surveying the data of function acquisition of Wi-Fi programs, the function for detecting Wi-Fi programs includes at least one in following item
：
First function, the first function are used to obtain the information of the quantity and network interface card of the network interface card of current active；
Second function, the second function are used to read the key assignments of registration table, and the key assignments of the registration table is for indicating whether to deposit
In multiple network interface cards or use IE browser proxy surfing.
4. according to the method described in claim 2, it is characterized in that, when the preset content is specifically used for described in filtering for examining
It is described for detecting Wi- when surveying the data in the blacklist for belonging to the campus network client of the function acquisition of Wi-Fi programs
The function of Fi programs includes at least one in following item：
Third function, the third function are used to detect the DLL module names in current active process and the process；
4th function, the 4th function are used to detect the window title of current active；
5th function, the 5th function are used to detect the information of the network interface card currently obtained.
5. according to the method described in claim 1, it is characterized in that, described according to the message hook, described to be processed
When the program of software detection limited authority, execution preset content is redirected, including：
According to the message hook, when the campus network client call is used to limit the function of Wi-Fi programs, to the use
Hook is carried out in the function of limitation Wi-Fi programs, redirects execution preset content.
6. according to the method described in claim 5, it is characterized in that, the function for limiting Wi-Fi programs includes as follows
At least one of in：
6th function, for closing the service and/or driving that create hot spot；
7th function, it is shared for closing；
8th function is used to open blacklist driving symbolic name；
9th function, for detecting dhcp client port；
Tenth function, for creating process, the process is for parsing IP address quantity.
7. method according to any one of claims 1 to 6, which is characterized in that the message hook includes：
The inline hooks of API；Alternatively,
IAT hooks；Alternatively,
EAT hooks.
8. a kind of device handled software, which is characterized in that including：
Module is installed, installation message hook is used for；
Jump module is used for according to the message hook, in the limited program of software detection to be processed and/or binding authority
When, execution preset content is redirected, the preset content makes the program normal use of the limited authority；
Processing module, for after having executed preset content, continuing to execute the software to be processed, and weighed described in normal use
The limited program of limit；
Wherein, the software to be processed is campus network client, and the program of the limited authority is Wi-Fi programs；It is described pre-
If content is for filtering Wi-Fi data, wherein the Wi-Fi data filtered out include that network interface card describes name；With the preset content
For returning to error value to the campus network client, so that the campus network client cannot stop the Wi-Fi programs.
9. device according to claim 8, which is characterized in that the jump module is specifically used for：
According to the message hook, when the campus network client call is used to detect the function of Wi-Fi programs, to the use
Hook is carried out in the function of detection Wi-Fi programs, redirects execution preset content.
10. device according to claim 9, which is characterized in that when the preset content is specifically used for being used for described in filtering
When detecting the data that the functions of Wi-Fi programs obtains, the function for detecting Wi-Fi programs include in following item at least
One：
First function, the first function are used to obtain the information of the quantity and network interface card of the network interface card of current active；
Second function, the second function are used to read the key assignments of registration table, and the key assignments of the registration table is for indicating whether to deposit
In multiple network interface cards or use IE browser proxy surfing.
11. device according to claim 9, which is characterized in that when the preset content is specifically used for being used for described in filtering
It is described for detecting when detecting the data in the blacklist for belonging to the campus network client of the function acquisition of Wi-Fi programs
The function of Wi-Fi programs includes at least one in following item：
Third function, the third function are used to detect the DLL module names in current active process and the process；
4th function, the 4th function are used to detect the window title of current active；
5th function, the 5th function are used to detect the information of the network interface card currently obtained.
12. device according to claim 8, which is characterized in that the jump module is specifically used for：
According to the message hook, when the campus network client call is used to limit the function of Wi-Fi programs, to the use
Hook is carried out in the function of limitation Wi-Fi programs, redirects execution preset content.
13. device according to claim 12, which is characterized in that the function for limiting Wi-Fi programs includes such as
At least one of in lower item：
6th function, for closing the service and/or driving that create hot spot；
7th function, it is shared for closing；
8th function is used to open blacklist driving symbolic name；
9th function, for detecting dhcp client port；
Tenth function, for creating process, the process is for parsing IP address quantity.
14. according to claim 8 to 13 any one of them device, which is characterized in that the message hook includes：
The inline hooks of API；Alternatively,
IAT hooks；Alternatively,
EAT hooks.
15. a kind of client device, which is characterized in that including shell, processor, memory, circuit board and power circuit,
In, circuit board is placed in the space interior that shell surrounds, and processor and memory setting are on circuit boards；Power circuit is used for
It powers for each circuit or device of client device；Memory is for storing executable program code；Processor passes through reading
The executable program code stored in memory runs program corresponding with executable program code, for executing following step
Suddenly：
Installation message hook；
It is default to redirect execution in the limited program of software detection to be processed and/or binding authority according to the message hook
Content, the preset content make the program normal use of the limited authority；
After having executed preset content, the software to be processed, and the program of limited authority described in normal use are continued to execute；
Wherein, the software to be processed is campus network client, and the program of the limited authority is Wi-Fi programs；It is described pre-
If content is for filtering Wi-Fi data, wherein the Wi-Fi data filtered out include that network interface card describes name；With the preset content
For returning to error value to the campus network client, so that the campus network client cannot stop the Wi-Fi programs.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410293735.8A CN104077523B (en) | 2014-06-25 | 2014-06-25 | The method and apparatus that software is handled |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410293735.8A CN104077523B (en) | 2014-06-25 | 2014-06-25 | The method and apparatus that software is handled |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104077523A CN104077523A (en) | 2014-10-01 |
| CN104077523B true CN104077523B (en) | 2018-10-16 |
Family
ID=51598773
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410293735.8A Active CN104077523B (en) | 2014-06-25 | 2014-06-25 | The method and apparatus that software is handled |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104077523B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1624617A (en) * | 2003-12-03 | 2005-06-08 | 株式会社因卡网络 | Method for blocking illegal access to game process and operating game process |
| CN103077332A (en) * | 2012-12-28 | 2013-05-01 | 飞天诚信科技股份有限公司 | Method and device for running packer application with self-checking |
| CN103632087A (en) * | 2012-08-21 | 2014-03-12 | 腾讯科技（深圳）有限公司 | Method and device for protecting process |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050091558A1 (en) * | 2003-10-28 | 2005-04-28 | International Business Machines Corporation | System, method and program product for detecting malicious software |
| CN101980160B (en) * | 2010-10-28 | 2013-02-13 | 飞天诚信科技股份有限公司 | Implementing method for encrypted .NET program |
-
2014
- 2014-06-25 CN CN201410293735.8A patent/CN104077523B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1624617A (en) * | 2003-12-03 | 2005-06-08 | 株式会社因卡网络 | Method for blocking illegal access to game process and operating game process |
| CN103632087A (en) * | 2012-08-21 | 2014-03-12 | 腾讯科技（深圳）有限公司 | Method and device for protecting process |
| CN103077332A (en) * | 2012-12-28 | 2013-05-01 | 飞天诚信科技股份有限公司 | Method and device for running packer application with self-checking |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104077523A (en) | 2014-10-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105704066B (en) | Networking control method and device, system, security gateway, mobile terminal | |
| CN102355667B (en) | Application program network connection control method and system in mobile intelligent terminal system | |
| US20200319925A1 (en) | Technologies for implementing consolidated device infrastructure systems | |
| CN104796957B (en) | Multi-card multi-standby mobile terminal and its Subscriber Identity Module switching method and apparatus | |
| CN104902547B (en) | WiFi network connection method and device | |
| CN105630587A (en) | Method, device and system for migrating application program data between terminals | |
| CN108737327A (en) | Intercept method, apparatus, system, processor and the memory of malicious websites | |
| CN109981403A (en) | Virtual machine network data traffic monitoring method and device | |
| CN103051617A (en) | Method, device and system for identifying network behaviors of program | |
| CN104317648B (en) | A kind of method and apparatus of monitoring advertisement | |
| CN105426761B (en) | A kind of recognition methods of illegal application and mobile terminal | |
| CN104918225B (en) | The implementation method and device of the bilateral function of double card single-pass terminal | |
| CN105095749B (en) | The adapting method and device of status bar notice | |
| CN104469970B (en) | A kind of method and apparatus reconnecting data network | |
| US20220121471A1 (en) | Device virtualization security layer | |
| US10200239B2 (en) | Normalized management network | |
| CN109240796A (en) | Virtual machine information acquisition methods and device | |
| CN105353958A (en) | Terminal application control method and apparatus | |
| CN107526601A (en) | A kind of mobile terminal method of adjustment, mobile terminal and storage medium | |
| CN112019506A (en) | Phishing mail detection method based on behavior recognition, electronic device and medium | |
| JP5374648B2 (en) | Data filtering for communication devices | |
| CN104601561B (en) | Register method, registration equipment and the domestic network system of network | |
| CN109410900A (en) | Sound effect treatment method, device and electronic equipment | |
| CN109041267A (en) | A kind of network connectivity fai_lure processing method, device and electronic equipment | |
| CN108390795A (en) | Household appliance and its monitoring method, intelligent domestic system and readable storage medium storing program for executing |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20181212 Address after: 519030 Room 105-53811, No. 6 Baohua Road, Hengqin New District, Zhuhai City, Guangdong Province Patentee after: Zhuhai Seal Interest Technology Co., Ltd. Address before: 519070, six level 601F, 10 main building, science and technology road, Tangjia Bay Town, Zhuhai, Guangdong. Patentee before: Zhuhai Juntian Electronic Technology Co.,Ltd. |