CN106203072B - A kind of method, apparatus and electronic equipment for repairing driver - Google Patents
A kind of method, apparatus and electronic equipment for repairing driver Download PDFInfo
- Publication number
- CN106203072B CN106203072B CN201610509677.7A CN201610509677A CN106203072B CN 106203072 B CN106203072 B CN 106203072B CN 201610509677 A CN201610509677 A CN 201610509677A CN 106203072 B CN106203072 B CN 106203072B
- Authority
- CN
- China
- Prior art keywords
- driver
- repaired
- driving
- repair procedure
- repairing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Stored Programmes (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the present invention discloses a kind of method, apparatus and electronic equipment for repairing driver, is related to computer drives technical field, can repair the driver that Driver Entry is modified.The described method includes: starting the corresponding driving repair procedure of driver to be repaired；Whether modified by the Driver Entry that the driving repair procedure detects the driver to be repaired；If detecting, the Driver Entry of the driver to be repaired is modified, and the Driver Entry function of the driver to be repaired is actively called by the driving repair procedure.Described device and electronic equipment are equipped with the corresponding module for realizing the method.The present invention is suitable for repairing the operation of driver.
Description
Technical field
The present invention relates to computer drives technical field more particularly to a kind of method, apparatus and electricity for repairing driver
Sub- equipment.
Background technique
With the development of internet technology, the rogue programs technology such as virus, wooden horse emerges one after another, application program, for example, golden
Mountain poison despot, also needs correspondingly to realize technical update.Jinshan anti-virus software in use, may be by competition software or evil
Software of anticipating is intercepted, is destroyed.One of which destroys scene, when system process is when loading Jinshan anti-virus software driver, meeting
It is forced to lead to driver quilt plus exit instruction to modify the Driver Entry of driver by competition software or Malware
Software or Malware is competed to destroy so that driver can not normal use, thus, so that the various defence of Jinshan anti-virus software
Disabler, in this way, competition software or Malware can destroy alternative document, registration table in Jinshan anti-virus software and system etc.
Data.
Driver recovery scenario in the prior art be for driver registry data be deleted, pass through reparation
Driver registry data required when loading, reloads driver and comes into force by the driver of application program, the drive
The recovery scenario of dynamic program is not suitable for being forced to cause to answer plus exit instruction when the driver of application program is in load
The scene that can not work normally with the driver of program.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of method, apparatus and electronic equipment for repairing driver, to solve
Existing driver recovery scenario can not repair the problem of driver that Driver Entry is modified.
In a first aspect, the embodiment of the present invention provides a kind of method for repairing driver, comprising:
Start the corresponding driving repair procedure of driver to be repaired；
Whether modified by the Driver Entry that the driving repair procedure detects the driver to be repaired；
If detecting, the Driver Entry of the driver to be repaired is modified, actively by the driving repair procedure
Call the Driver Entry function of the driver to be repaired.
With reference to first aspect, in the first embodiment of first aspect, the starting driver to be repaired is corresponding
Driving repair procedure before, comprising:
The corresponding driving repair procedure of the driver to be repaired is installed.
The first embodiment with reference to first aspect, in second of embodiment of first aspect, the installation institute
State the corresponding driving repair procedure of driver to be repaired, comprising:
The configuration information inquired in the driving repair procedure configuration file that pre-saves whether be in can initiate mode,
In, one or more configuration information is preset in the driving repair procedure configuration file, every configuration information includes: the drive
Filename, the driving repair procedure of dynamic repair procedure are installed to the service key name of the driving on registration table and indicate when preceding article is matched
Whether launchable enabling indicates confidence breath；
If when preceding article configuration information be in can initiate mode, extract the driving repair procedure in the preceding article configuration information
Filename and the driving repair procedure are installed to the service key name of the driving on registration table；
While obtaining the specified file of the driving repair procedure filename and installed, the driving of extraction is taken
Registration table is written in business key name.
Second of embodiment with reference to first aspect, in the third embodiment of first aspect, the driving is repaired
The file format of multiple program configuration file is extensible markup language (Extensible Markup Language, english abbreviation
For xml) format；
Filename and driving repair procedure installation of the extraction when the driving repair procedure in preceding article configuration information
Driving on to registration table services key name, comprising:
The configuration information in the driving repair procedure configuration file is parsed using xml common class；
It extracts when the filename of the driving repair procedure in preceding article configuration information and the driving repair procedure are installed to note
Driving on volume table services key name.
With reference to first aspect, in the 4th kind of embodiment of first aspect, the starting driver to be repaired is corresponding
Driving repair procedure include:
Start the corresponding driving repair procedure of the driver to be repaired in a manner of starting service.
With reference to first aspect, described to be examined by the driving repair procedure in the 5th kind of implementation of first aspect
Survey the driver to be repaired Driver Entry whether by modification include:
Detect whether the driver to be repaired can be opened by the driving repair procedure；
If cannot open, judge whether the Driver Entry function that can get the driver to be repaired；
If the Driver Entry function of the driver to be repaired can be got, it is determined that the driver to be repaired
Driver Entry is modified.
The 5th kind of embodiment with reference to first aspect, it is described to get in the 6th kind of implementation of first aspect
The Driver Entry function of the driver to be repaired includes:
Obtain the driven object pointer for being directed toward the driver to be repaired；
According to the driven object pointer got, the Driver Entry function of the driver to be repaired is obtained.
The 5th kind of embodiment with reference to first aspect, in the 7th kind of embodiment of first aspect, the method is also
Include:
If the driver to be repaired cannot be opened, and can not get the Driver Entry of the driver to be repaired
Function then actively creates the registry boot item of the driver to be repaired, reloads the driver to be repaired.
The 7th kind of embodiment with reference to first aspect, in the 8th kind of embodiment of first aspect, the creation institute
The registry boot item for stating driver to be repaired includes:
Create the installation path of the driver to be repaired；
Create the starting type of the driver to be repaired.
Second aspect, the embodiment of the present invention provide a kind of device for repairing driver, comprising:
Starting module, for starting the corresponding driving repair procedure of driver to be repaired；
Detection module, for by it is described driving repair procedure detect the driver to be repaired Driver Entry whether
It is modified；
Repair module, if passing through the drive for detecting that the Driver Entry of the driver to be repaired is modified
Dynamic repair procedure actively calls the Driver Entry function of the driver to be repaired.
In conjunction with second aspect, in the first embodiment of second aspect, described device further include:
Module is installed, for installing the corresponding driving repair procedure of the driver to be repaired.
In conjunction with the first embodiment of second aspect, in second of embodiment of second aspect, the installation mould
Block includes:
Submodule is inquired, whether the configuration information for inquiring in the driving repair procedure configuration file pre-saved is in
It can initiate mode, wherein one or more configuration information is preset in the driving repair procedure configuration file, every is matched confidence
Breath includes: the filename of the driving repair procedure, the driving service key name for driving repair procedure to be installed on registration table
And it indicates when the whether launchable enabling mark of preceding article configuration information；
Extracting sub-module, if for when preceding article configuration information be in can initiate mode, extract in the preceding article configuration information
Driving repair procedure filename and the driving repair procedure be installed to the driving on registration table service key name；
Submodule is installed, it, will while installation for obtaining the specified file of the driving repair procedure filename
Registration table is written in the driving service key name extracted.
In conjunction with second of embodiment of second aspect, in the third embodiment of second aspect, the driving is repaired
The file format of multiple program configuration file is xml format；
The extracting sub-module includes:
Resolution unit, for parsing the configuration information in the driving repair procedure configuration file using xml common class；
Extraction unit is repaired for extracting the filename for working as the repair procedure of the driving in preceding article configuration information and the driving
Program is installed to the service key name of the driving on registration table.
In conjunction with second aspect, in the 4th kind of embodiment of second aspect, the starting module is specifically used for starting
The mode of service starts the corresponding driving repair procedure of the driver to be repaired.
In conjunction with second aspect, in the 5th kind of embodiment of second aspect, the detection module includes:
Detection sub-module, for detecting whether the driver to be repaired can be opened by the driving repair procedure；
Judging submodule, it is described for when the driver to be repaired cannot be opened, then judging whether get
The Driver Entry function of driver to be repaired；
Submodule is determined, for when the Driver Entry function of the driver to be repaired can be got, it is determined that institute
The Driver Entry for stating driver to be repaired is modified.
In conjunction with the 5th kind of embodiment of second aspect, in the 6th kind of embodiment of second aspect, the detection mould
Block further include: acquisition submodule；The acquisition submodule includes:
First acquisition unit, for obtaining the driven object pointer for being directed toward the driver to be repaired；
Second acquisition unit, for obtaining the driver to be repaired according to the driven object pointer got
Driver Entry function.
In conjunction with the 5th kind of embodiment of second aspect, in the 7th kind of embodiment of second aspect, described device is also
It include: creation module；
The creation module for that cannot open when the driver to be repaired, and can not be got described to be repaired
When the Driver Entry function of driver, then the registry boot item of the driver to be repaired is actively created, is reloaded
The driver to be repaired.
In conjunction with the 7th kind of embodiment of second aspect, in the 8th kind of embodiment of second aspect, the creation mould
Block includes:
First creation submodule, for creating the installation path of the driver to be repaired；
Second creation submodule, for creating the starting type of the driver to be repaired.
The third aspect, the embodiment of the present invention provide a kind of electronic equipment, and the electronic equipment includes: shell, processor, deposits
Reservoir, circuit board and power circuit, wherein circuit board is placed in the space interior that shell surrounds, processor and memory setting
On circuit boards；Power circuit, for each circuit or the device power supply for above-mentioned electronic equipment；Memory is for storing and can hold
Line program code；Processor is run and executable program code pair by reading the executable program code stored in memory
The program answered, the method for executing aforementioned any reparation driver.
A kind of method, apparatus and electronic equipment for repairing driver provided in an embodiment of the present invention, it is to be repaired by starting
The multiple corresponding driving repair procedure of driver；And the drive of the driver to be repaired is detected by the driving repair procedure
Whether dynamic entrance is modified；If detecting, the Driver Entry of the driver to be repaired is modified, and is repaired by the driving
Multiple program actively calls the Driver Entry function of the driver to be repaired.In this way, actively by the driving repair procedure
The Driver Entry function for calling the driver to be repaired is soft by competing when avoiding passing through system process load driver program
The Driver Entry of part or Malware modification driver, so that driving can not be repaired by solving existing driver recovery scenario
The problem of driver that entrance is modified.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of invention for those of ordinary skill in the art without creative efforts, can be with
Other attached drawings are obtained according to these attached drawings.
Fig. 1 is the method flow schematic diagram that the embodiment of the present invention repairs driver；
Fig. 2 is the method idiographic flow schematic diagram that the embodiment of the present invention repairs driver；
Fig. 3 is the apparatus structure schematic diagram that the embodiment of the present invention repairs driver；
Fig. 4 is the structural schematic diagram of electronic equipment one embodiment of the present invention.
Specific embodiment
The embodiment of the present invention is described in detail with reference to the accompanying drawing.
It will be appreciated that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.Base
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts it is all its
Its embodiment, shall fall within the protection scope of the present invention.
Fig. 1 is the method flow schematic diagram that the embodiment of the present invention repairs driver, as shown in Figure 1, the present embodiment
Method may include:
Step 101, the corresponding driving repair procedure of starting driver to be repaired.
In the present embodiment, the driver to be repaired is by taking the driver of Jinshan anti-virus software as an example, naturally it is also possible to be it
The driver of his application program, is not limited thereto.In the corresponding driving repair procedure of driver of starting Jinshan anti-virus software
Before, the corresponding driving repair procedure of Jinshan anti-virus software driver need to be installed.
It is described to start the corresponding driving repair procedure of driver to be repaired as an alternative embodiment in the present embodiment
Before, comprising:
The corresponding driving repair procedure of the driver to be repaired is installed.
It, can be by system after the corresponding driving repair procedure of installation Jinshan anti-virus software driver in the present embodiment
StartService function start the driving repair procedure.
It is described to start the corresponding driving reparation of driver to be repaired as an alternative embodiment in the embodiment of the present invention
Program includes:
Start the corresponding driving repair procedure of the driver to be repaired in a manner of starting service.
Whether step 102 is repaired by the Driver Entry that the driving repair procedure detects the driver to be repaired
Change.
In the present embodiment, since the driver of Jinshan anti-virus software is to be competed software or Malware has modified and is driven into
Mouthful, force upper exit instruction, the driver of Jinshan anti-virus software is allowed to fail, so the driving repair procedure first judges Kingsoft poison
Whether the driver of despot is working properly, specifically, CreateFile function can be called to open kisknl (Jinshan anti-virus software driving
The title of program), whether can open success, open and successfully illustrate that the driver of Jinshan anti-virus software is normal if seeing, open failure, say
The driver of bright Jinshan anti-virus software has failed, if the driver of Jinshan anti-virus software has failed, continues to determine whether to get
The Driver Entry function of Jinshan anti-virus software driver.
In the present embodiment, since the driver of Jinshan anti-virus software is to be competed software or Malware has modified Driver Entry
Data, but the starting item data of the registration table of Jinshan anti-virus software driver is not deleted, so registration table then, is tasted without repairing
Examination obtains the Driver Entry function of Jinshan anti-virus software driver, if the available Driver Entry to Jinshan anti-virus software driver
Function then illustrates that the driver of Jinshan anti-virus software has been loaded, and still, Driver Entry is modified.
It is described that the drive to be repaired is detected by the driving repair procedure as an alternative embodiment in the present embodiment
The Driver Entry of dynamic program whether by modification include:
Detect whether the driver to be repaired can be opened by the driving repair procedure；
If cannot open, judge whether the Driver Entry function that can get the driver to be repaired；
If the Driver Entry function of the driver to be repaired can be got, it is determined that the driver to be repaired
Driver Entry is modified.
In the present embodiment, the Driver Entry function of Jinshan anti-virus software driver is obtained, specifically, function can be called
ObReferenceObjectByName gets the driven object pointer for being directed toward kisknl, by the driven object for being directed toward kisknl
Pointer can navigate to the DriverInit (Driver Entry function) of kisknl.
In the present embodiment, as another alternative embodiment, the Driver Entry for getting the driver to be repaired
Function includes:
Obtain the driven object pointer for being directed toward the driver to be repaired；
According to the driven object pointer got, the Driver Entry function of the driver to be repaired is obtained.
If step 103 detects that the Driver Entry of the driver to be repaired is modified, repaired by the driving
Program actively calls the Driver Entry function of the driver to be repaired.
In the present embodiment, in order to better understand the present embodiment, process need to be loaded to normal driver and be illustrated:
Under normal circumstances, the driver of Jinshan anti-virus software is loaded by system process and calls Jinshan anti-virus software driver
Driver Entry function, when system process loads Jinshan anti-virus software driver, Kingsoft poison can be modified by competing software or Malware
Seize by force the Driver Entry (for example, adding exit instruction) of driver, that is to say, that the modification of Driver Entry is occurred each time
When load driver program, and when be the load driver program in a manner of system process, what is modified is internal storage data,
When load driver program again, Driver Entry loaded into memory is completely new data, on the Driver Entry modified is
The Driver Entry being once loaded.
In the present embodiment, by driving repair procedure to go directly initiatively (not passing through system process) Jinshan anti-virus software to be called to drive
The Driver Entry function of dynamic program, so that the Driver Entry of Jinshan anti-virus software driver is called again, due at this point, not passing through
System process loads Jinshan anti-virus software driver, and the drive of Jinshan anti-virus software driver can not just be modified by competing software or Malware
Dynamic entrance, also just can not be written exit instruction in the Driver Entry function of Jinshan anti-virus software driver, repair so as to reach
The purpose of multiple Jinshan anti-virus software driver, has positive effect to maintaining system safety.
A kind of method for repairing driver provided in this embodiment, by starting the corresponding driving of driver to be repaired
Repair procedure；And whether modified by the Driver Entry that the driving repair procedure detects the driver to be repaired；If
Detect that the Driver Entry of the driver to be repaired is modified, then actively called by the driving repair procedure described in
Repair the Driver Entry function of driver.In this way, actively calling the driving journey to be repaired by the driving repair procedure
The Driver Entry function of sequence, when avoiding passing through system process load driver program, by competition software or Malware modification driving
The Driver Entry of program, so that the driver that Driver Entry is modified can not be repaired by solving existing driver recovery scenario
The problem of.
In the present embodiment, if Jinshan anti-virus software driver cannot be successfully opened, and Jinshan anti-virus software drive cannot be got
The Driver Entry function of dynamic program, that is, illustrate, the driver of Jinshan anti-virus software is not to be modified Driver Entry, so cannot
It executes step 103 and repairs Jinshan anti-virus software driver, then need the registry boot item for actively creating Jinshan anti-virus software driver, so
After call corresponding kernel function, for example, ZwLoadDriver reloads the driver of Jinshan anti-virus software, repair gold to reach
The purpose of mountain poison despot's driver.
In the present embodiment, as an alternative embodiment, the method also includes:
If the driver to be repaired cannot be opened, and can not get the Driver Entry of the driver to be repaired
Function then actively creates the registry boot item of the driver to be repaired, reloads the driver to be repaired.
In the present embodiment, as another alternative embodiment, the registry boot of the creation driver to be repaired
Include:
Create the installation path of the driver to be repaired；
Create the starting type of the driver to be repaired.
In the present embodiment, the starting type at least may include: one of on-demand starting, the starting of BOOT type or more
Kind, this embodiment is not limited.
Fig. 2 is the method idiographic flow schematic diagram that the embodiment of the present invention repairs driver, as shown in Fig. 2, the present embodiment
Method may include:
Whether the configuration information in driving repair procedure configuration file that step 201, inquiry pre-save is in and can enable
State, wherein one or more configuration information, every configuration information packet are preset in the driving repair procedure configuration file
Include: the filename of the driving repair procedure, the driving repair procedure are installed to driving service key name and table on registration table
Show when the whether launchable enabling mark of preceding article configuration information.
In the present embodiment, for example, the content of the driving repair procedure configuration file is as follows:
In the driving repair procedure configuration file, name is used to record the filename of driving repair procedure, regname
Key name is serviced for recording the driving that the driving repair procedure is installed on registration table, enable is configured for indicating when preceding article
The whether launchable enabling mark of information, name, regname, enable of the driving repair procedure are configurable, by institute
Name, regname, the enable for stating driving repair procedure are configured in configuration file, are repaired when by the driving repair procedure
When multiple driver, it is not easy to be competed software or Malware discovery or deletes, even if being found, can also quickly update configuration text
Information in part, for example, regname information is updated, so that the driving repair procedure is permanently effective.
In the present embodiment, in actual use, it can extend according to the actual situation or modify the driving and repair journey
Configuration item in sequence configuration file can be improved the flexibility of driving repair procedure relevant information.
In the present embodiment, the fixkisknldriverinitial.sys in first configuration information is for repairing Kingsoft
The filename for the driving repair procedure that the Driver Entry of poison despot's driver is modified, fixkisknldriverinitial.sys
The key name for being loaded into registration table is abc, and this configuration information be in can initiate mode.In Article 2 configuration information
Fixkisknlstart.sys is to repair journey for repairing the driving that the registry boot item of Jinshan anti-virus software driver is modified
The filename of sequence, the key name that fixkisknlstart.sys is loaded into registration table is astart, and this configuration information is in not
It can initiate mode.
If step 202, when preceding article configuration information be in can initiate mode, the driving extracted in the preceding article configuration information repairs
The filename and the driving repair procedure of multiple program are installed to the service key name of the driving on registration table.
In the present embodiment, the configuration information in the driving repair procedure configuration file pre-saved, first configuration are inquired
Information be in can initiate mode, extract in first configuration information driving repair procedure filename and the driving reparation journey
Sequence is installed to the service key name of the driving on registration table.
In the present embodiment, as an alternative embodiment, the file format of the driving repair procedure configuration file is xml lattice
Formula；
Filename and driving repair procedure installation of the extraction when the driving repair procedure in preceding article configuration information
Driving on to registration table services key name, comprising:
The configuration information in the driving repair procedure configuration file is parsed using xml common class；
It extracts when the filename of the driving repair procedure in preceding article configuration information and the driving repair procedure are installed to note
Driving on volume table services key name.
While the specified file of step 203, the acquisition driving repair procedure filename is installed, by the institute of extraction
State driving service key name write-in registration table.
In the present embodiment, the specified file of the driving repair procedure filename is stored under specified catalogue, for example,
" system disk: Windows System32 drivers " under catalogue, during installation, to " system disk: Windows
System32 under drivers " catalogue, obtain the specified file of driving repair procedure filename in first configuration information
(fixkisknldriverinitial.sys) it is installed, while the driving of extraction service key name " abc " write-in being infused
Volume table.
In the present embodiment, when need to " system disk: Windows System32 drivers " under catalogue
When fixkisknldriverinitial.sys is updated, new fixkisknldriverinitial.sys file can be replaced
Original fixkisknldriverinitial.sys file.
Step 204, the corresponding driving repair procedure of starting driver to be repaired.
In the present embodiment, the process of step 204 is similar with the step 101 of above method embodiment, and details are not described herein again.
Whether step 205 is repaired by the Driver Entry that the driving repair procedure detects the driver to be repaired
Change.
In the present embodiment, the process of step 205 is similar with the step 102 of above method embodiment, and details are not described herein again.
If step 206 detects that the Driver Entry of the driver to be repaired is modified, repaired by the driving
Program actively calls the Driver Entry function of the driver to be repaired.
In the present embodiment, the process of step 206 is similar with the step 103 of above method embodiment, and details are not described herein again.
A kind of method, apparatus and electronic equipment for repairing driver provided in an embodiment of the present invention, it is to be repaired by starting
The multiple corresponding driving repair procedure of driver；And the drive of the driver to be repaired is detected by the driving repair procedure
Whether dynamic entrance is modified；If detecting, the Driver Entry of the driver to be repaired is modified, and is repaired by the driving
Multiple program actively calls the Driver Entry function of the driver to be repaired.In this way, actively by the driving repair procedure
The Driver Entry function for calling the driver to be repaired is soft by competing when avoiding passing through system process load driver program
The Driver Entry of part or Malware modification driver, so that driving can not be repaired by solving existing driver recovery scenario
The problem of driver that entrance is modified, and the filename for driving repair procedure, the driving being installed on registration table clothes
Business key name be it is configurable, be not easy to be competed software or Malware discovery or delete, even if being found, can also quickly update configuration
Information, so that the driving repair procedure is permanently effective.
Fig. 3 is the structural schematic diagram for the device that the present invention repairs driver, as shown in figure 3, the device of the present embodiment can
To include: starting module 11, detection module 12 and repair module 13, wherein
The starting module 11, for starting the corresponding driving repair procedure of driver to be repaired.
In the present embodiment, the driver to be repaired is by taking the driver of Jinshan anti-virus software as an example, naturally it is also possible to be it
The driver of his application program, is not limited thereto.In the corresponding driving repair procedure of driver of starting Jinshan anti-virus software
Before, the corresponding driving repair procedure of Jinshan anti-virus software driver need to be installed.
In the present embodiment, as an alternative embodiment, described device further include: installation module；
The installation module, for installing the corresponding driving repair procedure of the driver to be repaired.
It, can be by system after the corresponding driving repair procedure of installation Jinshan anti-virus software driver in the present embodiment
StartService function start the driving repair procedure.
In the embodiment of the present invention, as an alternative embodiment, the starting module 11, specifically for the side to start service
Formula starts the corresponding driving repair procedure of the driver to be repaired.
In the embodiment of the present invention, as an alternative embodiment, the installation module includes: inquiry submodule, extracts submodule
Block and installation submodule；
The inquiry submodule, whether the configuration information for inquiring in the driving repair procedure configuration file pre-saved
In can initiate mode, wherein be preset with one or more configuration information in the driving repair procedure configuration file, every is matched
Confidence breath includes: the filename of the driving repair procedure, the driving service for driving repair procedure to be installed on registration table
Key name and expression are when the whether launchable enabling mark of preceding article configuration information.
In the present embodiment, for example, the content of the driving repair procedure configuration file is as follows:
In the driving repair procedure configuration file, name is used to record the filename of driving repair procedure, regname
Key name is serviced for recording the driving that the driving repair procedure is installed on registration table, enable is configured for indicating when preceding article
The whether launchable enabling mark of information, name, regname, enable of the driving repair procedure are configurable, by institute
Name, regname, the enable for stating driving repair procedure are configured in configuration file, are repaired when by the driving repair procedure
When multiple driver, it is not easy to be competed software or Malware discovery or deletes, even if being found, can also quickly update configuration text
Information in part, for example, regname information is updated, so that the driving repair procedure is permanently effective.
In the present embodiment, in actual use, it can extend according to the actual situation or modify the driving and repair journey
Configuration item in sequence configuration file can be improved the flexibility of driving repair procedure relevant information.
In the present embodiment, the fixkisknldriverinitial.sys in first configuration information is for repairing Kingsoft
The filename for the driving repair procedure that the Driver Entry of poison despot's driver is modified, fixkisknldriverinitial.sys
The key name for being loaded into registration table is abc, and this configuration information be in can initiate mode.In Article 2 configuration information
Fixkisknlstart.sys is to repair journey for repairing the driving that the registry boot item of Jinshan anti-virus software driver is modified
The filename of sequence, the key name that fixkisknlstart.sys is loaded into registration table is astart, and this configuration information is in not
It can initiate mode.
The extracting sub-module, if for when preceding article configuration information be in can initiate mode, extract when preceding article configuration letter
The filename of driving repair procedure in breath and the driving repair procedure are installed to the service key name of the driving on registration table.
In the present embodiment, the configuration information in the driving repair procedure configuration file pre-saved, first configuration are inquired
Information be in can initiate mode, extract in first configuration information driving repair procedure filename and the driving reparation journey
Sequence is installed to the service key name of the driving on registration table.
In the present embodiment, as an alternative embodiment, the file format of the driving repair procedure configuration file is xml lattice
Formula；
The extracting sub-module includes:
Resolution unit, for parsing the configuration information in the driving repair procedure configuration file using xml common class；
Extraction unit is repaired for extracting the filename for working as the repair procedure of the driving in preceding article configuration information and the driving
Program is installed to the service key name of the driving on registration table.
The installation submodule, for obtain the specified file of the driving repair procedure filename installed it is same
When, registration table is written into the driving service key name of extraction.
In the present embodiment, the specified file of the driving repair procedure filename is stored under specified catalogue, for example,
" system disk: Windows System32 drivers " under catalogue, during installation, to " system disk: Windows
System32 under drivers " catalogue, obtain the specified file of driving repair procedure filename in first configuration information
(fixkisknldriverinitial.sys) it is installed, while the driving of extraction service key name " abc " write-in being infused
Volume table.
In the present embodiment, when need to " system disk: Windows System32 drivers " under catalogue
When fixkisknldriverinitial.sys is updated, new fixkisknldriverinitial.sys file can be replaced
Original fixkisknldriverinitial.sys file.
The detection module 12, for detecting being driven into for the driver to be repaired by the driving repair procedure
Whether mouth is modified.
In the present embodiment, since the driver of Jinshan anti-virus software is to be competed software or Malware has modified and is driven into
Mouthful, force upper exit instruction, the driver of Jinshan anti-virus software is allowed to fail, so the driving repair procedure first judges Kingsoft poison
Whether the driver of despot is working properly, specifically, CreateFile function can be called to open kisknl (Jinshan anti-virus software driving
The title of program), whether can open success, open and successfully illustrate that the driver of Jinshan anti-virus software is normal if seeing, open failure, say
The driver of bright Jinshan anti-virus software has failed, if the driver of Jinshan anti-virus software has failed, continues to determine whether to get
The Driver Entry function of Jinshan anti-virus software driver.
In the present embodiment, since the driver of Jinshan anti-virus software is to be competed software or Malware has modified Driver Entry
Data, but the starting item data of the registration table of Jinshan anti-virus software driver is not deleted, so registration table then, is tasted without repairing
Examination obtains the Driver Entry function of Jinshan anti-virus software driver, if the available Driver Entry to Jinshan anti-virus software driver
Function then illustrates that the driver of Jinshan anti-virus software has been loaded, and still, Driver Entry is modified.
In the present embodiment, as an alternative embodiment, the detection module 12 includes: detection sub-module, judging submodule
And determine submodule；
The detection sub-module, for detecting whether the driver to be repaired can be beaten by the driving repair procedure
It opens.
The judging submodule, for when the driver to be repaired cannot be opened, then judging whether to get
The Driver Entry function of the driver to be repaired.
The determining submodule, for when the Driver Entry function of the driver to be repaired can be got, then really
The Driver Entry of the fixed driver to be repaired is modified.
In the present embodiment, the Driver Entry function of Jinshan anti-virus software driver is obtained, specifically, function can be called
ObReferenceObjectByName gets the driven object pointer for being directed toward kisknl, by the driven object for being directed toward kisknl
Pointer can navigate to the DriverInit (Driver Entry function) of kisknl.
In the present embodiment, as another alternative embodiment, the detection module 12 further include: acquisition submodule；It is described to obtain
The submodule is taken to include:
First acquisition unit, for obtaining the driven object pointer for being directed toward the driver to be repaired；
Second acquisition unit, for obtaining the driver to be repaired according to the driven object pointer got
Driver Entry function.
Repair module 13, if for detecting that the Driver Entry of the driver to be repaired is modified, by described
Driving repair procedure actively calls the Driver Entry function of the driver to be repaired.
In the present embodiment, in order to better understand the present embodiment, process need to be loaded to normal driver and be illustrated:
Under normal circumstances, the driver of Jinshan anti-virus software is loaded by system process and calls Jinshan anti-virus software driver
Driver Entry function, when system process loads Jinshan anti-virus software driver, Kingsoft poison can be modified by competing software or Malware
Seize by force the Driver Entry (for example, adding exit instruction) of driver, that is to say, that the modification of Driver Entry is occurred each time
When load driver program, and when be the load driver program in a manner of system process, what is modified is internal storage data,
When load driver program again, Driver Entry loaded into memory is completely new data, on the Driver Entry modified is
The Driver Entry being once loaded.
In the present embodiment, by driving repair procedure to go directly initiatively (not passing through system process) Jinshan anti-virus software to be called to drive
The Driver Entry function of dynamic program, so that the Driver Entry of Jinshan anti-virus software driver is called again, due at this point, not passing through
System process loads Jinshan anti-virus software driver, and the drive of Jinshan anti-virus software driver can not just be modified by competing software or Malware
Dynamic entrance, also just can not be written exit instruction in the Driver Entry function of Jinshan anti-virus software driver, repair so as to reach
The purpose of multiple Jinshan anti-virus software driver, has positive effect to maintaining system safety.
A kind of device for repairing driver provided in this embodiment, by starting the corresponding driving of driver to be repaired
Repair procedure；And whether modified by the Driver Entry that the driving repair procedure detects the driver to be repaired；If
Detect that the Driver Entry of the driver to be repaired is modified, then actively called by the driving repair procedure described in
Repair the Driver Entry function of driver.In this way, actively calling the driving journey to be repaired by the driving repair procedure
The Driver Entry function of sequence, when avoiding passing through system process load driver program, by competition software or Malware modification driving
The Driver Entry of program, so that the driver that Driver Entry is modified can not be repaired by solving existing driver recovery scenario
The problem of.
In the present embodiment, if Jinshan anti-virus software driver cannot be successfully opened, and Jinshan anti-virus software drive cannot be got
The Driver Entry function of dynamic program, that is, illustrate, the driver of Jinshan anti-virus software is not to be modified Driver Entry, so cannot
Jinshan anti-virus software driver is repaired by repair module 13, then needs the registry boot for actively creating Jinshan anti-virus software driver
, corresponding kernel function is then called, for example, ZwLoadDriver reloads the driver of Jinshan anti-virus software, to reach
Repair the purpose of Jinshan anti-virus software driver.
In the present embodiment, as another alternative embodiment, described device further include: creation module；
The creation module for that cannot open when the driver to be repaired, and can not be got described to be repaired
When the Driver Entry function of driver, then the registry boot item of the driver to be repaired is actively created, is reloaded
The driver to be repaired.
In the present embodiment, as another alternative embodiment, the creation module includes:
First creation submodule, for creating the installation path of the driver to be repaired；
Second creation submodule, for creating the starting type of the driver to be repaired.
In the present embodiment, the starting type at least may include: one of on-demand starting, the starting of BOOT type or more
Kind, this embodiment is not limited.
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence " including one ... ", it is not excluded that
There is also other identical elements in the process, method, article or apparatus that includes the element.
Each embodiment in this specification is all made of relevant mode and describes, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.
For Installation practice, since it is substantially similar to the method embodiment, so the comparison of description is simple
Single, the relevent part can refer to the partial explaination of embodiments of method.
Expression or logic and/or step described otherwise above herein in flow charts, for example, being considered use
In the order list for the executable instruction for realizing logic function, may be embodied in any computer-readable medium, for
Instruction execution system, device or equipment (such as computer based system, including the system of processor or other can be held from instruction
The instruction fetch of row system, device or equipment and the system executed instruction) it uses, or combine these instruction execution systems, device or set
It is standby and use.For the purpose of this specification, " computer-readable medium ", which can be, any may include, stores, communicates, propagates or pass
Defeated program is for instruction execution system, device or equipment or the dress used in conjunction with these instruction execution systems, device or equipment
It sets.The more specific example (non-exhaustive list) of computer-readable medium include the following: there is the electricity of one or more wirings
Interconnecting piece (electronic device), portable computer diskette box (magnetic device), random access memory (RAM), read-only memory
(ROM), erasable edit read-only storage (EPROM or flash memory), fiber device and portable optic disk is read-only deposits
Reservoir (CDROM).In addition, computer-readable medium can even is that the paper that can print described program on it or other are suitable
Medium, because can then be edited, be interpreted or when necessary with it for example by carrying out optical scanner to paper or other media
His suitable method is handled electronically to obtain described program, is then stored in computer storage.
It should be appreciated that each section of the invention can be realized with hardware, software, firmware or their combination.
In the above-described embodiment, multiple steps or method can be with storages in memory and by suitable instruction execution
The software or firmware that system executes are realized.For example, in another embodiment, can be used if realized with hardware
Any one of following technology well known in the art or their combination are realized: being had for realizing logic function to data-signal
The discrete logic of the logic gates of energy, the specific integrated circuit with suitable combinational logic gate circuit, programmable gate
Array (PGA), field programmable gate array (FPGA) etc..
The embodiment of the present invention also provides a kind of electronic equipment.Fig. 4 is that the structure of electronic equipment one embodiment of the present invention is shown
It is intended to, the process of Fig. 1 of the present invention or 2 illustrated embodiments may be implemented, as shown in figure 4, above-mentioned electronic equipment may include: shell
41, processor 42, memory 43, circuit board 44 and power circuit 45, wherein circuit board 44 is placed in the space that shell 41 surrounds
Inside, processor 42 and memory 43 are arranged on circuit board 44；Power circuit 45, for each electricity for above-mentioned electronic equipment
Road or device power supply；Memory 43 is for storing executable program code；Processor 42 is stored by reading in memory 43
Executable program code runs program corresponding with executable program code, repairs described in aforementioned any embodiment for executing
The method of multiple driver.
Processor 42 to the specific implementation procedures of above-mentioned steps and processor 42 by operation executable program code come
The step of further executing may refer to the description of Fig. 1-3 illustrated embodiment of the present invention, and details are not described herein.
The electronic equipment exists in a variety of forms, including but not limited to:
(1) mobile communication equipment: the characteristics of this kind of equipment is that have mobile communication function, and to provide speech, data
Communication is main target.This Terminal Type includes: smart phone (such as iPhone), multimedia handset, functional mobile phone and low
Hold mobile phone etc..
(2) super mobile personal computer equipment: this kind of equipment belongs to the scope of personal computer, there is calculating and processing function
Can, generally also have mobile Internet access characteristic.This Terminal Type includes: PDA, MID and UMPC equipment etc., such as iPad.
(3) portable entertainment device: this kind of equipment can show and play multimedia content.Such equipment include: audio,
Video player (such as iPod), handheld device, e-book and intelligent toy and portable car-mounted navigation equipment.
(4) server: providing the equipment of the service of calculating, and the composition of server includes that processor, hard disk, memory, system are total
Line etc., server is similar with general computer architecture, but due to needing to provide highly reliable service, in processing energy
Power, stability, reliability, safety, scalability, manageability etc. are more demanding.
(5) other electronic equipments with data interaction function.
Those skilled in the art are understood that realize all or part of step that above-described embodiment method carries
It suddenly is that relevant hardware can be instructed to complete by program, the program can store in a kind of computer-readable storage medium
In matter, which when being executed, includes the steps that one or a combination set of embodiment of the method.
For convenience of description, description apparatus above is to be divided into various units/modules with function to describe respectively.Certainly, exist
Implement to realize each unit/module function in the same or multiple software and or hardware when the present invention.
As seen through the above description of the embodiments, those skilled in the art can be understood that the present invention can
It realizes by means of software and necessary general hardware platform.Based on this understanding, technical solution of the present invention essence
On in other words the part that contributes to existing technology can be embodied in the form of software products, the computer software product
It can store in storage medium, such as ROM/RAM, magnetic disk, CD, including some instructions are used so that a computer equipment
(can be personal computer, server or the network equipment etc.) executes the certain of each embodiment or embodiment of the invention
Method described in part.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with
Relevant hardware is instructed to complete by computer program, the program can be stored in a computer-readable storage medium
In, the program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, the storage medium can be magnetic
Dish, CD, read-only memory (Read-Only Memory, ROM) or random access memory (RandomAccess
Memory, RAM) etc..
The above description is merely a specific embodiment, but scope of protection of the present invention is not limited thereto, any
In the technical scope disclosed by the present invention, any changes or substitutions that can be easily thought of by those familiar with the art, all answers
It is included within the scope of the present invention.Therefore, protection scope of the present invention should be subject to the protection scope in claims.
Claims (19)
1. a kind of method for repairing driver characterized by comprising
Start the corresponding driving repair procedure of driver to be repaired；
Whether modified by the Driver Entry that the driving repair procedure detects the driver to be repaired；
If detecting, the Driver Entry of the driver to be repaired is modified, and is actively called by the driving repair procedure
The Driver Entry function of the driver to be repaired.
2. the method according to claim 1 for repairing driver, which is characterized in that the starting driver to be repaired
Before corresponding driving repair procedure, comprising:
The corresponding driving repair procedure of the driver to be repaired is installed.
3. the method according to claim 2 for repairing driver, which is characterized in that the installation driving to be repaired
The corresponding driving repair procedure of program, comprising:
Whether the configuration information inquired in the driving repair procedure configuration file that pre-saves is in can initiate mode, wherein institute
It states and is preset with one or more configuration information in driving repair procedure configuration file, every configuration information includes: that the driving is repaired
Filename, the driving repair procedure of multiple program are installed to the service key name of the driving on registration table and indicate when preceding article configuration letter
Whether launchable enabling indicates breath；
If when preceding article configuration information be in can initiate mode, extract the file of the driving repair procedure in the preceding article configuration information
Name and the driving repair procedure are installed to the service key name of the driving on registration table；
While obtaining the specified file of the driving repair procedure filename and installed, by the driving services key of extraction
Name write-in registration table.
4. the method according to claim 3 for repairing driver, which is characterized in that the driving repair procedure configuration text
The file format of part is xml format；
The extraction is installed to note when the filename of the driving repair procedure in preceding article configuration information and the driving repair procedure
Driving on volume table services key name, comprising:
The configuration information in the driving repair procedure configuration file is parsed using xml common class；
It extracts when the filename of the driving repair procedure in preceding article configuration information and the driving repair procedure are installed to registration table
On driving service key name.
5. the method according to claim 1 for repairing driver, which is characterized in that the starting driver to be repaired
Corresponding driving repair procedure includes:
Start the corresponding driving repair procedure of the driver to be repaired in a manner of starting service.
6. the method according to claim 1 for repairing driver, which is characterized in that described to repair journey by the driving
Sequence detect the driver to be repaired Driver Entry whether by modification include:
Detect whether the driver to be repaired can be opened by the driving repair procedure；
If cannot open, judge whether the Driver Entry function that can get the driver to be repaired；
If the Driver Entry function of the driver to be repaired can be got, it is determined that the driving of the driver to be repaired
Entrance is modified.
7. the method according to claim 6 for repairing driver, which is characterized in that described to get the drive to be repaired
The Driver Entry function of dynamic program includes:
Obtain the driven object pointer for being directed toward the driver to be repaired；
According to the driven object pointer got, the Driver Entry function of the driver to be repaired is obtained.
8. the method according to claim 6 for repairing driver, which is characterized in that the method also includes:
If the driver to be repaired cannot be opened, and can not get the Driver Entry letter of the driver to be repaired
Number, then actively create the registry boot item of the driver to be repaired, reload the driver to be repaired.
9. the method according to claim 8 for repairing driver, which is characterized in that the creation driving to be repaired
The registry boot item of program includes:
Create the installation path of the driver to be repaired；
Create the starting type of the driver to be repaired.
10. a kind of device for repairing driver characterized by comprising
Starting module, for starting the corresponding driving repair procedure of driver to be repaired；
Whether detection module, the Driver Entry for detecting the driver to be repaired by the driving repair procedure are repaired
Change；
Repair module, if being repaired for detecting that the Driver Entry of the driver to be repaired is modified by the driving
Multiple program actively calls the Driver Entry function of the driver to be repaired.
11. the device according to claim 10 for repairing driver, which is characterized in that described device further include:
Module is installed, for installing the corresponding driving repair procedure of the driver to be repaired.
12. the device according to claim 11 for repairing driver, which is characterized in that the installation module includes:
Submodule is inquired, whether the configuration information for inquiring in the driving repair procedure configuration file pre-saved is in and can open
With state, wherein be preset with one or more configuration information, every configuration information packet in the driving repair procedure configuration file
Include: the filename of the driving repair procedure, the driving repair procedure are installed to driving service key name and table on registration table
Show when the whether launchable enabling mark of preceding article configuration information；
Extracting sub-module, if for when preceding article configuration information be in can initiate mode, extract the drive in the preceding article configuration information
The filename and the driving repair procedure of dynamic repair procedure are installed to the service key name of the driving on registration table；
Submodule is installed, while installation for obtaining the specified file of the driving repair procedure filename, will be extracted
The driving service key name be written registration table.
13. the device according to claim 12 for repairing driver, which is characterized in that the driving repair procedure configuration
The file format of file is extensible markup language format；
The extracting sub-module includes:
Resolution unit, for parsing the configuration in the driving repair procedure configuration file using extensible markup language common class
Information；
Extraction unit, for extracting the filename and the driving repair procedure of working as the repair procedure of the driving in preceding article configuration information
The driving service key name being installed on registration table.
14. the device according to claim 10 for repairing driver, which is characterized in that the starting module is specific to use
In by start service in a manner of start the corresponding driving repair procedure of the driver to be repaired.
15. the device according to claim 10 for repairing driver, which is characterized in that the detection module includes:
Detection sub-module, for detecting whether the driver to be repaired can be opened by the driving repair procedure；
Judging submodule, for when the driver to be repaired cannot be opened, then judging whether to get described to be repaired
The Driver Entry function of multiple driver；
Submodule is determined, for when the Driver Entry function of the driver to be repaired can be got, it is determined that it is described to
The Driver Entry for repairing driver is modified.
16. the device according to claim 15 for repairing driver, which is characterized in that the detection module further include:
Acquisition submodule；The acquisition submodule includes:
First acquisition unit, for obtaining the driven object pointer for being directed toward the driver to be repaired；
Second acquisition unit, for obtaining the drive of the driver to be repaired according to the driven object pointer got
Dynamic entrance function.
17. the device according to claim 15 for repairing driver, which is characterized in that described device further include: creation
Module；
The creation module for that cannot open when the driver to be repaired, and can not get the driving to be repaired
When the Driver Entry function of program, then the registry boot item of the driver to be repaired is actively created, reloaded described
Driver to be repaired.
18. the device according to claim 17 for repairing driver, which is characterized in that the creation module includes:
First creation submodule, for creating the installation path of the driver to be repaired；
Second creation submodule, for creating the starting type of the driver to be repaired.
19. a kind of electronic equipment, which is characterized in that the electronic equipment includes: shell, processor, memory, circuit board and electricity
Source circuit, wherein circuit board is placed in the space interior that shell surrounds, and processor and memory setting are on circuit boards；Power supply
Circuit, for each circuit or the device power supply for above-mentioned electronic equipment；Memory is for storing executable program code；Processing
Device runs program corresponding with executable program code by reading the executable program code stored in memory, for holding
The method of driver is repaired described in the aforementioned any claim 1-9 of row.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610509677.7A CN106203072B (en) | 2016-06-30 | 2016-06-30 | A kind of method, apparatus and electronic equipment for repairing driver |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610509677.7A CN106203072B (en) | 2016-06-30 | 2016-06-30 | A kind of method, apparatus and electronic equipment for repairing driver |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106203072A CN106203072A (en) | 2016-12-07 |
| CN106203072B true CN106203072B (en) | 2019-05-03 |
Family
ID=57462874
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610509677.7A Active CN106203072B (en) | 2016-06-30 | 2016-06-30 | A kind of method, apparatus and electronic equipment for repairing driver |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106203072B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102831334A (en) * | 2011-06-15 | 2012-12-19 | 奇智软件（北京）有限公司 | Positioning method and positioning system for target address |
| CN102880488A (en) * | 2012-09-12 | 2013-01-16 | 北京奇虎科技有限公司 | Method, equipment and system for restoring drive program |
| CN104915209A (en) * | 2015-06-15 | 2015-09-16 | 上海斐讯数据通信技术有限公司 | Method for trace debugging and problem repairing of Linux kernels |
-
2016
- 2016-06-30 CN CN201610509677.7A patent/CN106203072B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102831334A (en) * | 2011-06-15 | 2012-12-19 | 奇智软件（北京）有限公司 | Positioning method and positioning system for target address |
| CN102880488A (en) * | 2012-09-12 | 2013-01-16 | 北京奇虎科技有限公司 | Method, equipment and system for restoring drive program |
| CN104915209A (en) * | 2015-06-15 | 2015-09-16 | 上海斐讯数据通信技术有限公司 | Method for trace debugging and problem repairing of Linux kernels |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106203072A (en) | 2016-12-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9177142B2 (en) | Identification of electronic documents that are likely to contain embedded malware | |
| CN102262574B (en) | Boot protecting method and device of operating system | |
| US10176327B2 (en) | Method and device for preventing application in an operating system from being uninstalled | |
| US20160142437A1 (en) | Method and system for preventing injection-type attacks in a web based operating system | |
| CN106126291B (en) | A kind of method, apparatus and electronic equipment for deleting malicious file | |
| CN103414866B (en) | The method of playing online audio/video, embedded multimedia equipments and TV | |
| CN106203069B (en) | A kind of hold-up interception method of dynamic link library file, device and terminal device | |
| US8701195B2 (en) | Method for antivirus in a mobile device by using a mobile storage and a system thereof | |
| CN106878525A (en) | A kind of incoming information reminds the display methods and device at interface | |
| CN106203092A (en) | Method and device for intercepting shutdown of malicious program and electronic equipment | |
| CN105550598A (en) | Safety management method and device of mobile storage equipment | |
| CN105824649B (en) | Determine driver application installation whether successful method, apparatus and electronic equipment | |
| CN103019906B (en) | A kind of method, Apparatus and system that plays window information display | |
| CN114282212A (en) | Rogue software identification method and device, electronic equipment and storage medium | |
| CN106201602A (en) | A kind of tag providing method, acquisition methods, server and electronic equipment | |
| CN106598568A (en) | Language text loading method and device | |
| CN106127029B (en) | A kind of the starting method, apparatus and electronic equipment of security application | |
| RU2009105127A (en) | CHANGES IN THE CONDITION OF THE ENVIRONMENT FOR CHANGE OF FUNCTIONAL CAPABILITIES | |
| CN106203072B (en) | A kind of method, apparatus and electronic equipment for repairing driver | |
| CN110262832A (en) | Application program permission judgment method and device and electronic equipment | |
| CN103198252B (en) | Device and method for the control information for managing the application program in portable terminal | |
| JP5736335B2 (en) | Application analysis apparatus, application analysis system, and program | |
| EP2728472A2 (en) | User terminal, reliability management server, and method and program for preventing unauthorized remote operation | |
| CN108804916A (en) | Detection method, device, electronic equipment and the storage medium of malicious file | |
| CN105787302B (en) | A kind of processing method of application program, device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20190116 Address after: 519031 Room 105-53811, No. 6 Baohua Road, Hengqin New District, Zhuhai City, Guangdong Province Applicant after: Zhuhai Leopard Technology Co.,Ltd. Address before: 100085 East District, Second Floor, 33 Xiaoying West Road, Haidian District, Beijing Applicant before: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |