TW202129505A - Console application control management method and system - Google Patents

Abstract

A console application control management method includes the following steps: injecting a dynamic link library to a first process; executing the dynamic link library injected to the first process to determine whether the first process belongs to one of a plurality of console applications; hooking a particular function of the first process, which is used to output a character content on a window, when the first process belongs to one of the plurality of console applications; recording the character content output on the window of the first process when the hooked particular function of the first process outputs the character content on the window of the first process.

Description

Control management method and system of console program

The invention relates to a control and management method of a computer program, in particular to a control and management method of a console application (Console Appilcation) and a control and management system of the console application.

The console program is a computer program with a text interface. Because it does not require a complicated graphical user interface, it can simplify the process. For the development, maintenance, and management of computer-related products, the console program is very commonly used and functional Powerful tool. But also because of this, console programs are often used by hackers or data stealers to attack or steal data. Therefore, how to provide a control management method for a console program is a subject that the field of information security attaches great importance to.

The invention provides a control and management method of a console program, which can record the content of characters output in the window of the console program.

The present invention also provides a control management system of a console program, which can record the content of characters output in the window of the console program.

The control management method of the console program provided by the present invention includes the following steps: Inject a dynamic-link library (DLL) to the first process (Process); Execute the dynamic link library injected into the first process to determine whether the first process belongs to one of the multiple console programs. When it is determined that the first process belongs to one of the console programs, the specific included in the first process The function performs hooking programming (Hooking), and the specific function included in the first stroke is used to output character content in the window of the first stroke; and When the specific function included in the first stroke that has been hook-programmed is called and the character content is output in the window of the first stroke, the character content output by the window of the first stroke is recorded.

In an embodiment of the present invention, the control management method of the above-mentioned console program further includes the following steps: Perform hook programming on the creation stroke function included in the first stroke; When the first trip executes the create trip function that has been hook-programmed to create the second trip, inject the dynamic link library to the second trip; Execute the dynamic link library injected into the second stroke to determine whether the second stroke belongs to one of the console programs. When it is determined that the second stroke belongs to the console program, perform hook programming on the specific functions included in the second stroke, The specific function included in the second stroke is used to output character content in the window of the second stroke; and When the specific function included in the second course that has been hook-programmed is called and the character content is output in the window of the second course, the character content output by the window of the second course is recorded.

In the control management method of an embodiment of the present invention, the above-mentioned specific function includes an Application Programming Interface (API) function.

In the control management method of an embodiment of the present invention, the above-mentioned console program includes a command-line interface (Command-Line Interface, CLI) program.

In the control management method of an embodiment of the present invention, the above-mentioned step of injecting the dynamic link library into the first process includes Remote Thread Injection, wherein the remote thread injection includes the following steps: Get the control code (handle) of the first trip; Apply for allocation of memory address space in the memory address space of the first trip; Load the dynamic link library into the allocated memory address space; and Create a thread in the first process and load the dynamic link library through the thread.

In the control management method of an embodiment of the present invention, the step of hook programming the specific function included in the first stroke includes: converting the first instruction in the memory address corresponding to the specific function into a jump instruction, wherein The jump instruction points to the allocated memory address space where the dynamic link library is written.

The control management system of the console program provided by the present invention includes a computer, and the computer includes A processor and a storage unit, wherein the processor executes instructions stored in the storage unit to perform the following steps: Inject the dynamic link library to the first stroke; Execute the dynamic link library injected into the first process to determine whether the first process belongs to one of the multiple console programs. When it is determined that the first process belongs to one of the console programs, the specific included in the first process The function performs hook programming, and the specific function included in the first stroke is used to output character content in the window of the first stroke; and When the specific function included in the first stroke that has been hook-programmed is called and the character content is output in the window of the first stroke, the character content output by the window of the first stroke is recorded.

In the control management system of an embodiment of the present invention, the above-mentioned processor further executes the following steps: Perform hook programming on the creation stroke function included in the first stroke; When the first trip executes the create trip function that has been hook-programmed to create the second trip, inject the dynamic link library to the second trip; Execute the dynamic link library injected into the second stroke to determine whether the second stroke belongs to one of the console programs. When it is determined that the second stroke belongs to the console program, perform hook programming on the specific functions included in the second stroke, The specific function included in the second stroke is used to output character content in the window of the second stroke; and When the specific function included in the second course that has been hook-programmed is called and the character content is output in the window of the second course, the character content output by the window of the second course is recorded.

In the control management system of an embodiment of the present invention, the above-mentioned step of injecting the dynamic link library into the first process includes remote thread injection, wherein the remote thread injection includes the following steps: Get the control code of the first trip; Apply for allocation of memory address space in the memory address space of the first trip; Load the dynamic link library into the allocated memory address space; and Create a thread in the first process and load the dynamic link library through the thread.

In the control management system of an embodiment of the present invention, the above step of hook programming the specific function included in the first stroke includes: converting the first instruction in the memory address corresponding to the specific function into a jump instruction, wherein The jump instruction points to the allocated memory address space where the dynamic link library is written.

When the console program calls the above-mentioned specific function to output character content in the window of the console program, the control management method and control management system provided by the present invention can record the content of the characters output by the window of the console program, so the console can be retained The process of the program calling the above-mentioned specific function can be used to obtain potentially malicious content and realize the control and management of the console program.

In order to make the above and other objects, features and advantages of the present invention more comprehensible, the following specific examples are given in conjunction with the accompanying drawings, which are described in detail as follows.

FIG. 1 is a schematic diagram of a control management system of a console program according to an embodiment of the present invention. In one embodiment, the present invention provides a control management system of a console program. The control management system includes a computer 10, such as a personal computer, a tablet computer, a server, etc., but is not limited to this. The computer 10 includes a processor 11 and a storage unit 12. The processor 11 is electrically connected to the storage unit 12. The storage unit 12 is, for example, a memory or a hard disk. The processor 11 executes the instructions stored in the storage unit 12 to execute the control and management method of the console program. The console program can include Command-Line Interface (CLI) programs, such as COMMAND.COM, command prompt (cmd.exe), Windows PowerShell, Bash Shell, etc. The console program can also be CygWin, MSys, etc. .

2 is a schematic flowchart of a control management method of a console program according to an embodiment of the present invention, which includes steps S101 to S105. The steps will be further explained below.

Step S101: Inject the dynamic link library to the first process. For example, step S101 is to inject a pre-designed dynamic link library into the first process through remote thread injection, for example, call the CreateRemoteThread function to create a thread in the first process, and let the thread call the LoadLibrary function To load the dynamic link library. Please refer to FIG. 3, which is a schematic flowchart of step S101 according to an embodiment of the present invention. In detail, step S101 may include the following steps: obtain the control code of the first stroke (step S1011), the control code is used to locate the memory address space of the first stroke; apply for memory allocation in the memory address space of the first stroke Body address space (step S1013), the size of the allocated memory address space is, for example, the size required by the dynamic link library; load the dynamic link library into the aforementioned allocated memory address space (step S1015); and create and execute Thread in the first process and load the dynamic link library through the thread (step S1017). In addition, in step S101, the first itinerary can be one or multiple itineraries. For example, all the existing itineraries can be regarded as the first itinerary, and in step S101, the dynamic link function is injected into all the existing itineraries.式库。 Style library.

Please refer to Figure 2 again. After the dynamic link library is loaded in the first process, step S103 is executed: execute the dynamic link library injected into the first process to determine whether the first process belongs to one of the multiple console programs. When it is determined that the first stroke belongs to one of the console programs, hook programming is performed on the specific function included in the first stroke, wherein the specific function included in the first stroke is used to output character content in the window of the first stroke. For example, functions such as GetConsoleWindow can be called to determine whether the first stroke belongs to a console program. By only performing hook programming of specific functions on the console program, system computing resources can be effectively saved. In detail, specific functions can include application programming interface functions, such as WriteConsole, ReadConsole, ReadConsoleInput, WriteConsoleInput, etc. in the Windows Console API function; or ReadFile, WriteFile, etc. in the File API function; or in the C Runtime Library API function fprintf, fgets, printf, wprintf, _getch, fputwc, _write, etc. The step of hook programming includes converting the first instruction in the memory address corresponding to the specific function into a jump instruction, where the jump instruction points to the allocated memory address space where the dynamic link library is written. That is, when the specific function that is hooked programming is executed, the content of the corresponding specific function in the dynamic link library will be executed first.

Step S105: When the specific function included in the first stroke that has been hook-programmed is called and the character content is output in the window of the first stroke, the character content output by the window of the first stroke is recorded. For example, the specific function that has been hooked is the WriteConsole function in the Windows Console API function. When the WriteConsole is called in the first stroke, it will jump to the corresponding WriteConsole function in the dynamic link library that is injected into the first stroke. Content. For example, after storing the character content or a string composed of multiple characters output to the window by the WriteConsole function, execute the function of the WriteConsole function, or execute the function of the WriteConsole function first, and then Save the character content or string output to the window. The method of recording the character content is, for example, storing the character content completely, but it is not limited to this, and the character content can also be stored after adjusting the character content according to requirements. In other embodiments, the character content may be sent out via the Internet, or stored in the storage unit 12 in a file format, or a storage medium such as an external hard disk.

In this way, it is possible to retain the history of calling the above-mentioned specific function in the first trip as a console program, so as to obtain the potentially malicious content in the first trip, and realize the control and management of the first trip. If all the existing trips are regarded as the first trip, the protection can be more perfect.

FIG. 4 is a schematic flowchart of a control management method part of a console program according to an embodiment of the present invention. In an embodiment of the present invention, the above-mentioned control and management method of the console program may further include the following steps S201 to S207. The steps will be further explained below.

Step S201: Perform hook programming on the creation stroke function included in the first stroke. Step S201 may be performed after step S101. For example, in step S103, when the dynamic link library injected into the first stroke is executed, hook programming is performed on the creation stroke function included in the first stroke. The way of hook programming for creating a stroke function can be the same as the way of hook programming for a specific function described above, and will not be repeated here. The creation process functions are, for example, functions such as CreateProcess, CreateProcessAsUser, CreateProcessWithLogon.

Step S203: When the first trip executes the create trip function that has been hook-programmed to create the second trip, inject the dynamic link library into the second trip. For example, when the creation of the second process is completed, the dynamic link library is injected into the second process. The dynamic link library injected into the first stroke and the second stroke can be the same or different. Furthermore, the method of injecting the dynamic link library into the second process can be the same as or different from that of step S101, and will not be repeated here.

Step S205: Execute the dynamic link library injected into the second stroke to determine whether the second stroke belongs to one of the console programs. When it is determined that the second stroke belongs to the console program, perform the specific function included in the second stroke In hook programming, the specific function included in the second stroke is used to output character content in the window of the second stroke. The first stroke and the second stroke can be different types of control panel programs, which means that various types of control panel programs can be judged by executing the designed dynamic link library. Step S205 may be the same as step S103, and will not be repeated here.

Step S207: When the specific function included in the second stroke that has been hook-programmed is called and the character content is output in the window of the second stroke, the content of the character output by the window of the second stroke is recorded. Step S207 may be the same as step S105, and will not be repeated here.

Through steps S201 to S207, it is possible to further execute the control management method of the present invention on other trips (second trips) created by the trips (first trips) injected into the dynamic link library.

By analogy, when the second itinerary creates the third itinerary, the relationship between the second itinerary and the third itinerary can be regarded as the relationship between the first itinerary and the second itinerary. Steps S201 to S207 are also executed during the three strokes. In this way, after the dynamic link library is injected in step S101, there is no need to manually inject it, and the dynamic link library is injected for any newly created schedule to execute the control management method of the present invention.

When the console program calls the above-mentioned specific function to output character content in the window of the console program, the control management method and control management system provided by the present invention can record the content of the characters output by the window of the console program, so the console can be retained The process of the program calling the above-mentioned specific function can be used to obtain potentially malicious content and realize the control and management of the console program.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Those with ordinary knowledge in the technical field of the present invention can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to those defined by the attached patent application scope.

10: Computer 11: processor 12: storage unit S101, S103, S105, S1011, S1013, S1015, S1017, S201, S203, S205, S207: steps

FIG. 1 is a schematic diagram of a control management system of a console program according to an embodiment of the present invention. 2 is a schematic flowchart of a control management method of a console program according to an embodiment of the present invention. FIG. 3 is a schematic diagram of a flow of injecting a dynamic link library according to an embodiment of the present invention. FIG. 4 is a schematic flowchart of a control management method part of a console program according to an embodiment of the present invention.

S101, S103, S105: steps

Claims (10)

A control and management method of a console program is applied to a computer. The computer includes a processor and a storage unit. The processor is used to execute instructions stored in the storage unit to execute the control management method. The control management method includes The following steps: Inject the dynamic link library to a first stroke; Execute the dynamic link library injected into the first process to determine whether the first process belongs to one of the multiple console programs. When it is determined that the first process belongs to one of the console programs, the Hook programming is performed on a specific function included in the first stroke, and the specific function included in the first stroke is used to output a character content in a window of the first stroke; and When the specific function included in the first stroke that has been hook-programmed is called and the character content is output in the window of the first stroke, the character content output by the window of the first stroke is recorded. The control management method of the console program as described in claim 1, further includes the following steps: Perform hook programming on a creation stroke function included in the first stroke; When the first stroke executes the stroke creation function that has been hook-programmed to create a second stroke, inject a dynamic link library into the second stroke; Execute the dynamic link library injected into the second process to determine whether the second process belongs to one of the console programs. When it is determined that the second process belongs to one of the console programs, the Hook programming is performed on a specific function included in the second stroke, and the specific function included in the second stroke is used to output a character content in a window of the second stroke; and When the specific function included in the second process that has been hook-programmed is called and the content of the character is output in the window of the second process, the content of the character output by the window of the second process is recorded to the Storage unit. The control and management method for a console program according to claim 1, wherein the specific functions include application program interface functions. The control management method of a control panel program according to claim 1, wherein the control panel program includes a command line interface program. The control management method of a console program according to claim 1, wherein the step of injecting the dynamic link library into the first process includes remote thread injection, wherein the remote thread injection includes the following steps: Obtain a control code of the first itinerary; Apply for an allocation of memory address space in the memory address space of the first process; Write the dynamic link library into the allocated memory address space; and Create a thread in the first process and load the dynamic link library through the thread. The control and management method of the console program according to claim 1, wherein the step of hook programming the specific function included in the first stroke includes: converting the first instruction in the memory address corresponding to the specific function into a A jump instruction, where the jump instruction points to an allocated memory address space where the dynamic link library is written. A control management system of a console program, including: A computer including: A processor; and A storage unit; The processor executes the instructions stored in the storage unit to perform the following steps: Inject a dynamic link library to a first stroke; Execute the dynamic link library injected into the first process to determine whether the first process belongs to one of the multiple console programs. When it is determined that the first process belongs to one of the console programs, the Hook programming is performed on a specific function included in the first stroke, and the specific function included in the first stroke is used to output a character content in a window of the first stroke; and When the specific function included in the first stroke that has been hook-programmed is called and the content of the character is output in the window of the first stroke, the content of the character output by the window of the first stroke is recorded to the Storage unit. The control management system of the console program according to claim 7, wherein the processor further executes the following steps: Perform hook programming on a creation stroke function included in the first stroke; When the first stroke executes the stroke creation function that has been hook-programmed to create a second stroke, inject a dynamic link library into the second stroke; Execute the dynamic link library injected into the second process to determine whether the second process belongs to one of the console programs. When it is determined that the second process belongs to one of the console programs, the Hook programming is performed on a specific function included in the second stroke, and the specific function included in the second stroke is used to output a character content in a window of the second stroke; and When the specific function included in the second process that has been hook-programmed is called and the character content is output in the window of the second process, the character content output by the window of the second process is recorded. The control management system for a console program according to claim 7, wherein the step of injecting the dynamic link library into the first process includes remote thread injection, wherein the remote thread injection includes the following steps: Obtain a control code of the first itinerary; Apply for an allocation of memory address space in the memory address space of the first process; Write the dynamic link library into the allocated memory address space; and Create a thread in the first process and load the dynamic link library through the thread. The control management system of the console program according to claim 7, wherein the step of hook programming the specific function included in the first stroke includes: converting the first instruction in the memory address corresponding to the specific function into a A jump instruction, where the jump instruction points to an allocated memory address space where the dynamic link library is written.

Images