CN116382715A - Windows driver unloading method and device - Google Patents
Windows driver unloading method and device Download PDFInfo
- Publication number
- CN116382715A CN116382715A CN202310280922.1A CN202310280922A CN116382715A CN 116382715 A CN116382715 A CN 116382715A CN 202310280922 A CN202310280922 A CN 202310280922A CN 116382715 A CN116382715 A CN 116382715A
- Authority
- CN
- China
- Prior art keywords
- driver
- drive
- unloading
- driving
- function
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 42
- 230000026676 system process Effects 0.000 claims abstract description 35
- 230000006870 function Effects 0.000 claims description 99
- 238000004140 cleaning Methods 0.000 claims description 11
- 238000004590 computer program Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 6
- 238000003860 storage Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
- G06F8/62—Uninstallation
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Abstract
The invention discloses a Windows driver unloading method and device, comprising the following steps: unloading the driver to be unloaded in the System process context; acquiring a drive uninstall function field in a drive program to be uninstalled, and judging whether the drive uninstall function field is empty; if not, executing codes in the drive uninstall function field in the System process context; if the code is empty, judging that no code can be executed, and skipping the step of executing the code; executing the obDerefenceobject function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished. The System process context is used for unloading the driver to be unloaded, whether the field of the driver unloading function is empty or not is judged, the driver is skipped if the field of the driver unloading function is empty, and the driver unloading function is executed if the field of the driver unloading function is not empty, so that the driver is unloaded, and the safety of the System is improved.
Description
Technical Field
The invention relates to the technical field of software uninstallation, in particular to a Windows driver uninstallation method and device.
Background
Some Windows drivers are self-protecting, especially some drivers of security software or malicious software, and in order to prevent malicious uninstallation by conventional methods, some technologies for preventing the driver from being uninstalled are used, especially the drivers cannot be uninstalled by stopping services, uninstalling services, zwUnloadDriver, and the like. After some security software or malicious software such as loading a driver, some driver anti-unloading techniques are used to prevent the driver from being easily unloaded by a person, which results in software failure. If the malicious software uses a drive anti-unloading technology, the virus Trojan horse can not be cleaned up, which brings great hidden trouble to the system safety and the users.
The existing method for unloading the drive includes stopping the drive service (for example, using sc stop command), deleting the drive service (for example, using sc delete command), directly calling ZwUnloadDriver function to unload the drive, but the method has the following drawbacks:
1. the method is application-layer biased and easily bypassed, e.g., hook NtUnloadDriver functions in the kernel of security software or malware can easily prevent the above drive-off scheme.
2. If the driver un load field of the driver object corresponding to the driver of the security software or the malware is intentionally set to NULL, all the above schemes cannot uninstall the driver.
3. If the rights of the program of the uninstalled driver are not sufficient, especially without SeLoadDriverPriv ilege rights, the existing solution of uninstalled driver is also rendered ineffective.
Disclosure of Invention
The embodiment of the invention aims to provide a method and a device for unloading a Windows driver, which are used for unloading the driver to be unloaded through a System process context, judging whether a field of a driver unloading function is empty, skipping if the field is empty, and executing the driver unloading function if the field is not empty, so that the unloading of the driver to be unloaded is realized, the self-protection or anti-unloading technology of the driver to be unloaded can be avoided, the permission of the driver to be unloaded is not required to be acquired, the effective unloading of the driver is realized, and some unnecessary drivers can be unloaded by the method, thereby improving the safety of a System.
In order to solve the above technical problems, a first aspect of the embodiments of the present invention provides a method for uninstalling a Windows driver, including the following steps:
unloading the driver to be unloaded in the System process context;
acquiring a drive uninstall function field in the drive program to be uninstalled, and judging whether the drive uninstall function field is empty or not;
if the driving unloading function field is not null, executing codes in the driving unloading function field in the System process context;
if the drive uninstallation function field is empty, judging that no code can be executed in the drive uninstallation function field, and skipping the step of executing the code;
executing an obDerefenceobject function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished.
Further, before the executing the obDereferenceObjectfunction on the driving object, the method further includes:
and executing an IopCleanupNotification function on the to-be-offloaded driver, and deleting the container session notification associated with the driver object.
Further, before the executing the obDereferenceObjectfunction on the driving object, the method further includes:
executing an obmakeTemporaryObject function on the to-be-offloaded driver, and cleaning system resources occupied by the driver object.
Further, the unloading the to-be-unloaded driver in the System process context includes:
and unloading the driver to be unloaded in the System process context through a System thread or a working thread.
Further, the parameters received by the uninstall function in the preset driver include: a drive object, drive name, or drive service name;
when the parameter is the drive name or the drive service name, the drive name or the drive service name is converted into a drive object corresponding to the drive program to be unloaded, and then the drive program to be unloaded is unloaded based on the system process context.
Accordingly, a second aspect of the embodiment of the present invention provides a device for uninstalling a Windows driver, including:
the unloading context control module is used for unloading the driver to be unloaded in the System process context;
the driving unloading field empty judging module is used for acquiring the resource release function field in the driving program to be unloaded and judging whether the resource release function field is empty or not;
a driver offload control module configured to execute code in the driver offload function field in the System process context when the resource release function field is not empty;
the driving unloading control module is further configured to determine that no code is executable in the driving unloading function field when the driving unloading function field is empty, and skip the step of executing the code;
and the reference count updating module is used for executing ObDereferenceObje ct function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished.
Further, the Windows driver uninstaller further includes:
and the session deleting module is used for executing IopCleanupNotif ications functions on the to-be-uninstalled driver and deleting the container session notification associated with the driver object.
Further, the Windows driver uninstaller further includes:
and the resource cleaning module is used for executing ObMakeTemporary Object functions on the to-be-unloaded driver and cleaning system resources occupied by the driver objects.
Further, the unloading context control module unloads the driver to be unloaded in the System process context through a System thread or a working thread.
Further, the parameters received by the uninstall function in the preset driver include: a drive object, drive name, or drive service name;
when the parameter is the driving name or the driving service name, the unloading context control module converts the driving name or the driving service name into a driving object corresponding to the driving program to be unloaded, and then unloads the driving program to be unloaded based on the System process context.
Accordingly, a third aspect of the embodiment of the present invention provides an electronic device, including: at least one processor; and a memory coupled to the at least one processor; the memory stores instructions executable by the one processor, and the instructions are executed by the one processor, so that the at least one processor executes the Windows driver unloading method.
Accordingly, a fourth aspect of embodiments of the present invention provides a computer-readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the above-described Windows driver uninstalling method.
The technical scheme provided by the embodiment of the invention has the following beneficial technical effects:
the System process context is used for unloading the to-be-unloaded driver, judging whether the field of the drive unloading function is empty, skipping if the field of the drive unloading function is empty, and executing the drive unloading function if the field of the drive unloading function is not empty, so that the to-be-unloaded driver is unloaded, the self-protection or anti-unloading technology of the to-be-unloaded driver can be avoided, the permission of the to-be-unloaded driver is not required to be acquired, the effective unloading of the driver is realized, and unnecessary drivers can be unloaded by the method, so that the safety of a System is improved.
Drawings
FIG. 1 is a flowchart of a Windows driver uninstallation method according to an embodiment of the present invention;
fig. 2 is a block diagram of a Windows driver uninstaller according to an embodiment of the present invention.
Reference numerals:
1. unloading context control module, 2, driving unloading field empty judging module, 3, driving unloading function executing module, 4, reference count updating module, 5, session deleting module, 6, resource cleaning module.
Detailed Description
The objects, technical solutions and advantages of the present invention will become more apparent by the following detailed description of the present invention with reference to the accompanying drawings. It should be understood that the description is only illustrative and is not intended to limit the scope of the invention. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the present invention.
Referring to fig. 1, a first aspect of the embodiment of the present invention provides a method for uninstalling a Windows driver, including the following steps:
and step S100, unloading the to-be-unloaded driver in the System process context.
Step S200, a driving unloading function field in a driving program to be unloaded is obtained, and whether the driving unloading function field is empty is judged;
step S310, if the drive offload function field is not null, executing the code in the drive offload function field in the System process context;
step S320, if the driving offload function field is empty, determining that no code is executable in the driving offload function field, and skipping the step of executing the code;
in step S400, an obDerefenceobject function is executed on the driving object, the driving object reference count is released once, and when the object reference count is changed to a preset value, the driving object is released, and the unloading process is ended.
According to the scheme, the System process context is used for unloading the to-be-unloaded driver, whether the field of the drive unloading function is empty or not is judged, the drive unloading function is skipped if the field of the drive unloading function is empty, and the drive unloading function is executed if the field of the drive unloading function is not empty, so that the to-be-unloaded driver is unloaded, the self-protection or anti-unloading technology of the to-be-unloaded driver can be avoided, the permission of the to-be-unloaded driver is not required to be acquired, the effective unloading of the driver is realized, and the safety of the System is improved.
Specifically, when the object reference count is changed to 0, the driving object is released, and the unloading process ends.
Further, before executing the obDereferenceObjectfunction on the driving object, the method further includes:
step S330, executing the IopCleanupNotification function on the to-be-offloaded driver, and deleting the container session notification associated with the driver object.
The iopc lanuptNotification function is a file which is not exported in the kernel file ntoskrnl and needs to be obtained by dynamic search. By executing the iopc lanuptNotification function, the container session (Container session) notification associated with the drive object is deleted, which if not done may cause problems with the system after the drive is uninstalled.
Further, executing an obDereferenceObjectfunction on the drive object further includes:
step S340, executing the obmakeTemporaryObject function to the to-be-offloaded driver, and cleaning up the system resources occupied by the driver object.
The obmakeytemporaryobject function cleans up a portion of the system resources occupied by the driver object (driveobject), such as the cleaning object name.
Specifically, in step S100, unloading the driver to be unloaded in the System process context includes: and unloading the driver to be unloaded in the System process context through the System thread or the working thread.
In addition, parameters received by the uninstall function in the preset driver include: a drive object, drive name, or drive service name; when the parameter is the drive name or the drive service name, the drive name or the drive service name is converted into a drive object corresponding to the drive program to be unloaded, and then the drive program to be unloaded is unloaded based on the System process context.
Accordingly, referring to fig. 2, a second aspect of the present invention provides a device for uninstalling a Windows driver, which uninstalls a driver to be uninstalled based on a preset driver including an uninstalling function, including:
the unloading context control module 1 is used for unloading the driver to be unloaded in the System process context;
the driving unloading field empty judging module 2 is used for acquiring a driving unloading function field in the driving program to be unloaded and judging whether the driving unloading function field is empty or not;
a driver offload function execution module 3, configured to execute the code in the driver offload function field in the System process context when the driver offload function field is not empty;
the driving offload function executing module 3 is further configured to determine that no code is executable in the driving offload function field and skip the step of executing the code when the driving offload function field is empty;
and the reference count updating module 4 is used for executing ObDereferenceObj ect function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished.
Further, the Windows driver uninstaller further includes:
a session deletion module 5 for executing IopCleanupNotifica tions functions on the driver to be uninstalled, deleting container session notifications associated with the driver objects.
Further, the Windows driver uninstaller further includes:
and the resource cleaning module 6 is used for executing ObMakeTemporaryObj ect functions on the to-be-unloaded driver and cleaning system resources occupied by the driver objects.
Further, the unloading context control module 1 unloads the driver to be unloaded in the Syste m process context through the system thread or the working thread.
Further, the parameters received by the uninstall function in the preset driver include: a drive object, drive name, or drive service name; when the parameter is a drive name or a drive service name, the unloading context control module 1 converts the drive name or the drive service name into a drive object corresponding to the drive program to be unloaded, and then unloads the drive program to be unloaded based on the System process context.
Accordingly, a third aspect of the embodiment of the present invention provides an electronic device, including: at least one processor; and a memory coupled to the at least one processor; the memory stores instructions executable by a processor, the instructions being executable by the processor to cause at least one processor to perform the Windows driver offload method.
Accordingly, a fourth aspect of embodiments of the present invention provides a computer-readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the above-described Windows driver uninstalling method.
The embodiment of the invention aims to protect a Windows driver unloading method and device, wherein the method comprises the following steps: unloading the driver to be unloaded in the System process context; acquiring a drive uninstall function field in a drive program to be uninstalled, and judging whether the drive uninstall function field is empty; if the drive offload function field is not null, executing code in the drive offload function field in a System process context; if the driving unloading function field is empty, judging that no code can be executed in the driving unloading function field, and skipping the step of executing the code; and executing ObDerefer enceObject function on the driving object, releasing the driving object reference count once, and when the object reference count is changed to a preset value, releasing the driving object, and ending the unloading process. The technical scheme has the following effects:
the System process context is used for unloading the to-be-unloaded driver, judging whether the field of the drive unloading function is empty, skipping if the field of the drive unloading function is empty, and executing the drive unloading function if the field of the drive unloading function is not empty, so that the to-be-unloaded driver is unloaded, the self-protection or anti-unloading technology of the to-be-unloaded driver can be avoided, the permission of the to-be-unloaded driver is not required to be acquired, the effective unloading of the driver is realized, and the safety of the System is improved.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
Finally, it should be noted that: the above embodiments are only for illustrating the technical aspects of the present invention and not for limiting the same, and although the present invention has been described in detail with reference to the above embodiments, it should be understood by those of ordinary skill in the art that: modifications and equivalents may be made to the specific embodiments of the invention without departing from the spirit and scope of the invention, which is intended to be covered by the claims.
Claims (10)
1. The Windows driver uninstallation method is characterized by comprising the following steps:
unloading the driver to be unloaded in the System process context;
acquiring a drive uninstall function field in the drive program to be uninstalled, and judging whether the drive uninstall function field is empty or not;
if the driving unloading function field is not null, executing codes in the driving unloading function field in the System process context;
if the driving unloading function field is empty, judging that no code in the driving unloading function field can be executed, and skipping the step of executing the driving unloading function code;
executing an obDerefenceobject function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished.
2. The method for uninstalling a Windows driver according to claim 1, further comprising, before executing the obDereference object function on the driver object:
and executing an IopCleanupNotification function on the to-be-offloaded driver, and deleting the container session notification associated with the driver object.
3. The Windows driver uninstalling method according to claim 1 or 2, further comprising, before executing the obDereferejectObjectfunction on the driver object:
executing an obmakeTemporaryObject function on the to-be-offloaded driver, and cleaning system resources occupied by the driver object.
4. The method for uninstalling a Windows driver according to claim 1 or 2, wherein the uninstalling the driver to be uninstalled in the System process context comprises:
and unloading the driver to be unloaded in the System process context through a System thread or a working thread.
5. The Windows driver uninstalling method according to claim 1 or 2, wherein,
the parameters received by the uninstallation function in the preset driver include: a drive object, drive name, or drive service name;
when the parameter is the drive name or the drive service name, the drive name or the drive service name is converted into a drive object corresponding to the drive program to be unloaded, and then the drive program to be unloaded is unloaded based on the system process context.
6. A windows driver uninstallation apparatus, comprising:
the unloading context control module is used for unloading the driver to be unloaded in the System process context;
the drive unloading field empty judging module is used for acquiring a drive unloading function field in the to-be-unloaded drive program and judging whether the drive unloading function field is empty or not;
a driver offload function execution module configured to execute, in the System process context, code in the driver offload function field when the driver offload function field is not empty;
the driving offload function execution module is further configured to determine that no code is executable in the driving offload function field when the driving offload function field is empty, and skip the step of executing the code;
and the reference count updating module is used for executing ObDereferenceObje ct function on the driving object, releasing the driving object reference count once, and releasing the driving object when the object reference count is changed to a preset value, so that the unloading process is finished.
7. The Windows driver uninstaller according to claim 6, further comprising:
and the session deleting module is used for executing IopCleanupNotif ications functions on the to-be-uninstalled driver and deleting the container session notification associated with the driver object.
8. The Windows driver uninstaller according to claim 6 or 7, further comprising:
and the resource cleaning module is used for executing ObMakeTemporary Object functions on the to-be-unloaded driver and cleaning system resources occupied by the driver objects.
9. The Windows driver offload device according to claim 6 or 7, wherein,
and the unloading context control module unloads the driver to be unloaded in the System process context through a System thread or a working thread.
10. The Windows driver offload device according to claim 6 or 7, wherein,
the parameters received by the uninstallation function in the preset driver include: a drive object, drive name, or drive service name;
when the parameter is the driving name or the driving service name, the unloading context control module converts the driving name or the driving service name into a driving object corresponding to the driving program to be unloaded, and then unloads the driving program to be unloaded based on the System process context.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310280922.1A CN116382715B (en) | 2023-03-21 | 2023-03-21 | Windows driver unloading method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310280922.1A CN116382715B (en) | 2023-03-21 | 2023-03-21 | Windows driver unloading method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116382715A true CN116382715A (en) | 2023-07-04 |
| CN116382715B CN116382715B (en) | 2023-09-08 |
Family
ID=86979899
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310280922.1A Active CN116382715B (en) | 2023-03-21 | 2023-03-21 | Windows driver unloading method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116382715B (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1809057A (en) * | 2005-01-18 | 2006-07-26 | 英业达股份有限公司 | System and method of alleviating load on host computers by means of device unloading |
| CN102662882A (en) * | 2012-03-30 | 2012-09-12 | 奇智软件（北京）有限公司 | Method and device for unloading mobile storage equipment |
| US20120255002A1 (en) * | 2011-03-31 | 2012-10-04 | Mcafee, Inc. | System and method for below-operating system trapping of driver loading and unloading |
| CN102841785A (en) * | 2011-06-24 | 2012-12-26 | 奇智软件（北京）有限公司 | File handle closuring operation method and device |
| CN105049937A (en) * | 2015-08-17 | 2015-11-11 | 青岛海信电器股份有限公司 | Method and device for unloading external storage equipment from Android system smart television |
| CN106709285A (en) * | 2016-11-23 | 2017-05-24 | 北京小米移动软件有限公司 | Application lock interface display method and application lock interface display device |
| CN106896990A (en) * | 2015-12-18 | 2017-06-27 | 北京奇虎科技有限公司 | The discharging method and device of a kind of application program |
| US20190304505A1 (en) * | 2018-03-27 | 2019-10-03 | Canon Kabushiki Kaisha | Information processing apparatus, control method thereof and storage medium |
-
2023
- 2023-03-21 CN CN202310280922.1A patent/CN116382715B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1809057A (en) * | 2005-01-18 | 2006-07-26 | 英业达股份有限公司 | System and method of alleviating load on host computers by means of device unloading |
| US20120255002A1 (en) * | 2011-03-31 | 2012-10-04 | Mcafee, Inc. | System and method for below-operating system trapping of driver loading and unloading |
| CN102841785A (en) * | 2011-06-24 | 2012-12-26 | 奇智软件（北京）有限公司 | File handle closuring operation method and device |
| CN102662882A (en) * | 2012-03-30 | 2012-09-12 | 奇智软件（北京）有限公司 | Method and device for unloading mobile storage equipment |
| CN105049937A (en) * | 2015-08-17 | 2015-11-11 | 青岛海信电器股份有限公司 | Method and device for unloading external storage equipment from Android system smart television |
| CN106896990A (en) * | 2015-12-18 | 2017-06-27 | 北京奇虎科技有限公司 | The discharging method and device of a kind of application program |
| CN106709285A (en) * | 2016-11-23 | 2017-05-24 | 北京小米移动软件有限公司 | Application lock interface display method and application lock interface display device |
| US20190304505A1 (en) * | 2018-03-27 | 2019-10-03 | Canon Kabushiki Kaisha | Information processing apparatus, control method thereof and storage medium |
Non-Patent Citations (5)
| Title |
|---|
| JQDY: "windows服务程序的安装和卸载函数", Retrieved from the Internet <URL:《https://www.cnblogs.com/jqdy/p/15079152.html》> * |
| WATSAMON NAKHARIN 等: "The design of load/unload algorithm for 2.5″ hard disk drive in SSTW process", 《2012 7TH IEEE CONFERENCE ON INDUSTRIAL ELECTRONICS AND APPLICATIONS》, pages 1478 - 1481 * |
| 冯浩: "车联网中内容驱动的计算任务卸载与资源分配算法研究", 《中国优秀硕士学位论文全文数据库 工程科技Ⅱ辑》, no. 1, pages 034 - 1402 * |
| 王静 等: "Windows2000下基于EPP模式的并口数据采集的驱动设计和实现", 《电子机械工程》, no. 6, pages 37 - 40 * |
| 胥霜霞 等: "嵌入式Linux下Z85C30芯片设备驱动程序设计", 《电子科技》, vol. 27, no. 5, pages 116 - 118 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116382715B (en) | 2023-09-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9785774B2 (en) | Malware removal | |
| US9910989B2 (en) | Malware removal method and system, and computer storage medium | |
| CN105335184B (en) | Application installation method and device | |
| US8112745B2 (en) | Apparatus and method for capabilities verification and restriction of managed applications in an execution environment | |
| CN105426751A (en) | Method and device for preventing system time from being tampered | |
| CN116382715B (en) | Windows driver unloading method and device | |
| CN114707150A (en) | Malicious code detection method and device, electronic equipment and storage medium | |
| CN103067246B (en) | The method that the file received based on instant messaging business is processed and device | |
| CN113946825B (en) | Memory horse processing method and system | |
| CN101667236A (en) | Method and device for controlling driver installation | |
| KR20040090373A (en) | Method for realtime monitoring/detecting/curing virus on wireless terminal | |
| CN106843917B (en) | Driver loading method and device | |
| CN106503540B (en) | Program installation package installation and operation method and system | |
| KR20060117664A (en) | Method for booting of mobile communication set and apparatus thereof | |
| CN108647516B (en) | Method and device for defending against illegal privilege escalation | |
| CN111783087A (en) | Method and device for detecting malicious execution of executable file, terminal and storage medium | |
| CN115758353A (en) | Application program protection method, device, equipment and storage medium | |
| KR100613126B1 (en) | Method and apparatus for deleting virus code, and information storage medium storing a program thereof | |
| CN113688384A (en) | Program detection method, device, electronic equipment and medium | |
| CN106022125A (en) | Client repair method and device | |
| CN103034806B (en) | Process method and the terminal of operation | |
| CN110990874A (en) | Safety protection method and system for Android file | |
| KR101895836B1 (en) | Method for Treating and Deleting Malware Having Self-Protection Function | |
| CN112286736B (en) | Method for recovering equipment infected by suspicious application and related equipment | |
| CN115828246B (en) | Offline malicious program and behavior monitoring method, device, medium and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |