KR20010092079A - The method to modify the executable file which is stored in a storage deivce, while it is running under multi-tasking OS - Google Patents

Abstract

PURPOSE: A method for modifying a storage by an executed program on a multi-tasking operating system environment is provided to modify an original program by a process of a copy. CONSTITUTION: A copy of an original program is created in a storage(502). The original program requests that the currently used operating system will execute the copy program after that time and is terminated(503). The copy program connects to an update server(504) and judges whether a self-update is necessary or not through a version comparing operation(505). If a self-update is not necessary, the copy program is executed normally. If a self-update is necessary, the original program is updated(507) and an execution of the original file is requested to the currently used operating system(508).

Description

The method to modify the executable file which is stored in a storage deivce, while it is running under multi-tasking OS}

The present invention relates to a method for modifying a storage area in which a program running under a multitasking operating system environment is stored. More particularly, the present invention relates to a write prohibition characteristic of a corresponding program in a storage area when a program is running. The present invention relates to a method of modifying (hereinafter abbreviated as self-modifying) an area in which the original program is stored by using a copy of a program running on an operating system.

Until the mid 90's, single-tasking and simple memory management systems such as MS-DOS have been installed and used on personal computers. The use of such multitasking operating systems is spreading rapidly. Such a multitasking operating system supports multitasking (multitask) function that allows two or more tasks to run at the same time, and has the function of operating a program larger than the actual memory size using virtual memory.

Under MS-DOS, running programs can easily be self-modified. This is because the operating system provides write permission so that the running program can modify itself. MS-DOS loads and executes the entire program when it is loaded into memory to execute the program. Therefore, even if the corresponding program stored in the storage device is modified during execution, the writing operation is not affected. It is designed to be possible.

As shown in FIG. 1, MS-DOS-based applications have a feature that enables simple self-modification as necessary.

In the conventional MS-DOS-based self-correction method of FIG. 1, when a self-correction request 101 of a corresponding program is requested by a user, the program is modified 102 and then normally executed 103. When there is no modification request 101, it is simply made by the method of performing a normal program 103.

However, due to the proliferation of multitasking operating systems in recent years, self-modification is not possible with the above-described applications. The reason is that when the operating system loads into the memory to execute the execution program, the program is executed by the dynamic loading method which loads only the necessary area at the point in time without loading the entire program. If a modification is possible, the write access to the storage area is prohibited for the running program because its effect is on the running process (called the process).

2 is a flow diagram showing a conventional self-modification method under the multitasking operating system as described above, in which an application program operating under the above-mentioned operating system needs to update itself and is only responsible for updating / modifying program A ( So-called updater, etc.) and program B to actually perform the operation. According to the above configuration, when a user requests a self-correction, the program A is modified by program A, and then program B is executed. However, even in this case, when A needs to be updated, there is no corrective method. So there is a problem.

In particular, anti-virus programs (Vaccine or Vaccine program below) should be equipped with functions to diagnose their own infection and to correct themselves during treatment in preparation for the possibility of being infected with a virus. If the conventional method is applied, the vaccine program is divided into a program that performs a normal vaccine operation and a program that diagnoses and treats the program, and then operates a program that diagnoses and treats the program first. Then run it. However, there is a problem that the countermeasures against the virus infection of the program that diagnoses / cures itself have to be reestablished, and thus the vaccine programs have not solved the problem yet.

As such, in order to solve such problems under the current situation, which is not yet developed, a new program modification method capable of self-correction to the running program itself is urgently required.

The present inventor proposes a method of modifying an original program using a copy process as a way to overcome the limitations of the above-described conventional program under a multitasking operating system.

An object of the present invention is to provide a method of overcoming the limitations coming from the operating system by modifying the program contents of the original program in the process of copying,

Another object of the present invention is to enable the diagnosis and treatment of viruses for the vaccine program itself by this method.

In addition, another object of the present invention is to maintain a safe system environment even after the automatic deletion of the copy after the modification of the original program.

1 is a flow diagram illustrating a conventional self-correction method under a single tasking operating system.

2 is a flow diagram illustrating a conventional self-correction method under a multitasking operating system.

3 is an explanatory diagram of a 'program sharing rule' under a multitasking operating system.

4 is a process flow diagram illustrating a method of the present invention.

5 is a flow diagram showing a self-update method by self-correction according to the present invention.

Figure 6 is an explanatory diagram showing the self-diagnosis and treatment method of the vaccine program according to the present invention.

7 is a flow diagram showing the self-diagnosis and treatment of the vaccine program against a computer virus according to the present invention.

8 is a flow diagram showing a virus diagnosis and treatment process in the operating system without the delete setting function after the execution of the program in accordance with the present invention.

So-called "program sharing rules" are applied to operating systems that support multitasking environments, including Windows and Unix. The program sharing rule means that the own process created based on the original program is not given write access to the original program.

Accordingly, under the operating system, only read permission is given to the program and no write permission is given to the program, thereby making it impossible to edit or modify the program.

3 shows a program sharing rule under a so-called multitasking operating system.

When the user selects a program in the storage device (including clicking with a mouse) for execution, the operating system reads the program from the storage device into the memory area and creates a process of the program in the memory area. It has an interface structure to make it and execute it. In the drawing, when the user selects the original program 302 stored in the storage device 301, the process 304 of the original program is generated in the memory area 303 and then executed. However, since the process 304 is not given write permission for its original program, editing, modification, etc. are impossible (b).

The present invention relates to a method for modifying a storage area in which a program running under a multitasking operating system environment is stored.

(1) executing the original program and creating a copy program of the original;

(2) executing the copy program generated by the above step and terminating the original program being executed.

The term 'execution of the copy program' of the term used in the step (2) is used to mean writing (self-correction) to the original program. Hereinafter will be used in the same sense as above.

The copy program executed through the above process is given a write permission for the original program, so that self-modification is possible. Therefore, it will be apparent to those skilled in the art that the program to which the present invention is applicable includes all programs having the necessity of self-modification, that is, the need for write permission.

4 is a flowchart illustrating the method of the present invention, wherein execution of the original program 401 is typically performed by a keyboard operation or as a click event using a mouse and generates a copy program of the original program in a storage device. And step 402. The storage device may be a read / write storage medium including a magnetic storage medium such as a hard disk, a floppy disk, a ROM, or an optical reading and recording device such as a CD or a DVD. The copy program is allocated and stored in a predetermined area of the storage device.

In this case, the copy program may take measures such as designating a program name differently from the original so that the copy program is recognized as a separate program from the original program. Specifically, the measure is preferably performed by passing an argument indicating that the copy program is a copy.

In the present invention, after the step 402 of generating the copy program, the execution of the copy program 403 is performed in the memory as in the execution of a normal program, and then the original program is terminated (404) and the original by the copy program. Implementing program writes.

In addition, the present invention preferably adds a step of deleting from the storage device itself with the termination of the copy program in order to maintain an efficient computing environment.

The present invention also includes a self-update method by self-modification of a program under a multitasking operating system. The self-update method,

(1) executing the original program and creating a copy program of the original;

(2) terminating the original program after executing the copy program generated by the above step;

(3) updating the original by modifying the original program by executing the copy program, and then executing the original program.

The steps of (1) and (2) are as described above, and the step of executing the original program of (3) is to update the original program by the copy program executed through the step of (2), and then the copy program is At the end of the process, the updated original program is executed.

In addition, the step (3) preferably includes a modification to the latest update program via the Internet. In order to update to the latest update program through the Internet, the latest version is checked by checking the version of the update program provided up to now and the program currently used by the user by accessing a web server provided by the supplier of the program on the Internet. Including the process of modifying the program. In the above case, the user is automatically equipped with the latest version of the program even with a single event of executing the original program, which is very effective.

5 is a flow diagram illustrating a self-update method by self-correction of the program.

When the program user starts the original program, the program corresponds to the original rather than the copy (result of determining whether the program is a copy in step 501), and thus creates a copy program for the original in the storage device (502). The original program then preferably includes the process of terminating the original program itself while requesting (503) the operating system currently in use for the copy program to execute it.

In this step, when the execution request of the copy program is requested to the operating system, it is preferable to pass an argument indicating that the called program is a copy. In this case, it is preferable that the argument includes information that forms the program name of the copy different from the original program name.

If there is a request to execute the copy program by the above step, the copy program performs the same process as the original program, and thus undergoes the same process as the initial execution step of the original program. In operation 504, the self-correction operation may be determined through a version comparison operation 505. If the file on the server is up-to-date by comparing the version of the original file installed on the PC with the version of the same file registered on the server, self-correction is necessary. The update server includes a system or a storage device on a network that stores the latest version of the file in a storage device and can supply the latest version of the file upon request from a remote PC on the network or a PC that can read the storage device. If it is determined that there is no need for self-correction at this stage, the program can be executed normally. If the self-correction is necessary, the original program is updated (updated) (507). It is desirable to include the process of requesting the current operating system 508 and causing its copy program to terminate.

When executing the original in the execution request step 508 of the original, it is preferable to include an argument indicating that the called program is the original.

Also, it is desirable to set the program itself so that the copy is deleted from the storage device when the execution of the copy ends. It can be set to be automatically deleted by the operating system when execution of the copy is finished. Even if the operating system cannot delete the copy program as described above, the initial execution by the user always starts from the original, so it is always up to date. It seems to work with the version. In addition, if the deletion program for the copy program is not possible after the execution of the copy program as described above, it is possible to delete the copy program by passing an argument to delete the copy program.

In addition, a method for modifying a storage area in which a program running in a multitasking operating system environment according to the present invention is stored includes a method for self-diagnosis and treatment of a vaccine program against a computer virus.

A computer virus is a program that performs self-replicating, infecting, and destroying operations. It is executed in the memory of a computer like a general program. Computer viruses continue to multiply the same virus as themselves, infecting other systems in series, and sometimes destroying the system by formatting diskettes or damaging the original program.

Such a computer virus may be classified according to various criteria, but may be classified into a form resident in a storage location and a form not resident according to an operation principle. In the case of non-resident viruses, when an infected program is executed, its code is executed first to infect other programs. However, in the case of a resident virus, the infected program is executed once and then resides in a memory to continue the programs that are subsequently executed. Infect it.

Vaccine programs are programs that can prevent, diagnose, or treat computer viruses. These programs are also called computer storage and are read and executed. Therefore, in case of non-resident virus, the infected program is not executed, but there is no concern about infecting the vaccine program that detects it. However, if the virus already resides in the memory, the vaccine program that is executed to cure the virus may also be infected. .

If the vaccine program is infected with a virus, it should diagnose and repair itself, but if its own program is already running, the virus can be diagnosed but not cured because only read and write rights are given to the original program. .

The present invention includes the following steps as a method for self-diagnosis and treatment of a vaccine program against computer viruses.

(1) running the original antivirus program and creating a copy program of the original;

(2) terminating the original antivirus program after executing the copy program generated by the above step.

By the above steps, since the copy program is authorized to write to the original vaccine program, it is possible to diagnose and treat the original vaccine program.

Execution of the original vaccine program is usually performed by a keyboard operation or a click event using a mouse and the like, and includes generating a copy program of the original vaccine program in a storage device.

In this case, the copy program may receive an argument that is recognized and operated as a separate program from the original vaccine program.

According to the present invention, after the step of generating the copy program, the execution of the copy program is performed in the memory as in the execution of a conventional program. Then, the step of terminating the original vaccine program and diagnosing and treating the original vaccine program by the copy program is performed. It includes.

In addition, the present invention preferably further comprises the step of allowing the copy program to be deleted from the storage device itself with the termination of the program execution. The copy program is only a 'copy' derived from the original antivirus program, but this is also a program stored in a specific area of the storage device and may be infected with a virus. For this reason, it is desirable to maintain a clean computing environment by leaving the copy program unattended from storage with the termination of the program.

Figure 6 is a schematic of the vaccine program self-diagnosis and treatment method of the present invention,

An original vaccine program 603 located in a specific area on the storage device 601 and a process (hereinafter, referred to as 'A process') 607 which is executed in the memory area 605 and the original vaccine program The execution relationship of the copy program (hereinafter referred to as 'B process') 609 is shown.

As shown in the figure above, if the original vaccine program (virus is indicated by the letter 'V' in the drawing) infected with a virus, first check whether there is a virus residing in the memory area and then remove it if it exists. A process is formed and executed in the memory area (step a), and at the same time, the memory area and the contents of the selected drive are searched to diagnose and treat virus infection. At this time, process A does not have the right to write the program according to the 'program sharing rule'. As a result, process A cannot cure the original vaccine program infected with the virus. At this time, a copy program of the original antivirus program is created in the storage device (step b), the copy program is loaded into the memory area and executed (step c), and the process A is terminated (step d). Since write permission is granted, virus diagnosis and treatment of the vaccine program is possible (step e).

7 is a flow diagram illustrating a self-diagnosis and treatment process of a vaccine program against a computer virus using the present invention.

When the program user starts the original antivirus program, the program corresponds to the original rather than the copy (determining whether the original is in step 701). Therefore, the program is diagnosed and cleaned with the execution (703), and the copy of the original is stored in the storage device. Generate a program (705). The original antivirus program then includes the process of terminating the original program itself while requesting (707) the operating system currently in use for the copy program.

When creating a copy in the above step, it is preferable to configure the program name of the copy different from the original program name. When the copy program is requested to be executed to the operating system, it is desirable to pass an argument indicating that the called program is a copy and to delete the copy from the storage device after the copy is finished.

If there is a request to execute the copy program according to the above step, the copy program performs the same process as the original program, and thus undergoes the same process as the initial execution step of the original program. It is possible to diagnose and treat (709). After the diagnosis and treatment of the original program by the copy program is performed, the copy program operates as a normal vaccine-specific program, and at the end of the program, the copy program is deleted from the storage device.

The self-diagnosis and treatment method of the vaccine program does not require a request step of original execution after the original modification (treatment of a virus) unlike the program update process shown in FIG. The reason is that the above-mentioned update process always requires the latest program to be run at the request of the user, while the self-diagnosis and repair process of the vaccine program is performed by the virus, which is "independent of the operation of the program". After removal, it does not affect the operation of the program, so it is enough to operate the normal execution area of the copy without recalling the original.

The meaning of 'not related to the operation of the program' in the above means that the virus's infection action changes its execution flow so that it is operated first at the time of initial execution, and because it sticks to the corresponding program, it removes the virus part and returns to the original execution flow. In this case, it is used to mean that the area itself normally does not deform.

As described above, depending on the operating system, there is a case where there is no delete setting function after the execution of the program. In this case, the copy deletion function should be given to the original. This function should be performed after the entire program execution of the virus diagnosis and treatment program is completed.

FIG. 8 illustrates a virus diagnosis and treatment process in an operating system without a deletion setting function after termination of the program as another embodiment of the present invention.

The initial execution process of the original program is already the same as described above, and since the original program is not a copy, a process of "no" is performed at the request for deleting a copy (802). Then, the steps of creating a copy program in a predetermined area of the storage device (803), requesting execution of the copy (804), and terminating the original program itself are the same as before. However, since the deletion setting after the end of the program is impossible in the request step of executing the copy, only the argument passing that informs the copy is possible when the program is called.

The program executed after the termination of the original program corresponds to the copy (801), so that the original vaccine program is diagnosed and repaired (805), and after the copy program is normally executed, the request for execution of the original (806) is performed. Pass the copy delete request argument to the operating system along with an argument indicating that it is the original program.

Since the program executed after the above process is the original antivirus program and not the copy program, the copy can be deleted (807) according to the copy deletion request (802).

The self-diagnosis and treatment process of the vaccine program described above occurs in an instant so as not to be felt by the user using the vaccine program, so that the user can conveniently use the same as before.

It can be seen that the modification method of the own program according to the present invention can be applied to all programs requiring write permission for the own program under the multitasking environment as described above. However, specific embodiments to be applied depending on the operating system may be somewhat different, but this is only a matter of choice for those skilled in the art, and does not deviate from the scope of the present invention.

According to the present invention, it is possible to modify the original program (program) by the process of copying. In addition, the present invention can be applied to a program that requires self-update, and in particular, it becomes possible to diagnose and treat a vaccine program itself infected with a virus. In addition, it is possible to provide a clean computing environment by deleting the copy program after diagnosis and treatment of viruses by copy.

Claims (23)

In a method for executing a program running under a multitasking operating system environment to modify the storage area is stored, Creating a copy program of the original after executing the original program; And terminating the original program after executing the copy program generated by the step, thereby modifying the original program by the copy. The method of claim 1, further comprising the step of causing the copy program to be deleted at the end of execution of the copy program. The method of claim 1 or 2, wherein a copy program identical to the original program is created in a storage device. 4. The method of claim 3, wherein the storage device is a magnetic storage medium, an optical reading and writing device. The method of claim 1 or 2, wherein the original program is a program that requires write permission for its own program. 3. The method of claim 1 or 2, wherein the original program is terminated after the copy program is generated. The method of claim 1, wherein an argument indicating that the copy program is requested to be executed is passed together. The method of claim 1, wherein the original program is a computer antivirus program. 9. The method of claim 8, further comprising the step of causing the copy program to be deleted at the end of execution of the copy program. 10. The method of claim 8 or 9, wherein a copy program identical to the original program is created in a storage device. 10. The method of claim 8 or 9, wherein the storage device is a magnetic storage medium, an optical reading and recording device. 10. The method of claim 8 or 9, wherein the original program is terminated after the copy program is generated. 10. The method of claim 8 or 9, wherein an argument indicating that the copy program is requested to be executed is passed together. In the self-modification method of the program for self-update under the multitasking operating system, Creating a copy program of the original after executing the original program; Terminating the original program after executing the copy program generated by the above step; And updating the original by modifying the original program by executing the copy program, and then executing the original program. 15. The method of claim 14, further comprising the step of causing the copy program to be deleted at the end of execution of the copy program. 16. The method of claim 14 or 15, wherein a copy program identical to the original program is created in a storage device. 16. The method of claim 14 or 15, wherein the storage device is a magnetic storage medium, an optical reading and recording device. 16. The method of claim 14 or 15, wherein an argument informing that the copy program is a copy is passed along with the execution request of the copy program. 16. The method of claim 14 or 15, wherein after the original is updated, when the original is requested to be executed, an argument indicating that the called program is the original is passed together. 16. The method of claim 14 or 15, wherein the update information of the original program is provided via a network from a web server that provides the program. 21. The method of claim 20, wherein said network is the Internet. The method according to claim 8 or 14, wherein in the case where the deletion setting for the copy program is impossible after completion of execution of the copy program, And terminating the copy program and executing the original program to delete the copy. 23. The method of claim 22, wherein the request for deletion of the copy program is transmitted together with the execution request of the original program.