WO2018108051A1 - 一种系统管理方法及装置、存储介质 - Google Patents

一种系统管理方法及装置、存储介质 Download PDF

Info

Publication number
WO2018108051A1
WO2018108051A1 PCT/CN2017/115488 CN2017115488W WO2018108051A1 WO 2018108051 A1 WO2018108051 A1 WO 2018108051A1 CN 2017115488 W CN2017115488 W CN 2017115488W WO 2018108051 A1 WO2018108051 A1 WO 2018108051A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
file system
preset
electronic device
target application
Prior art date
Application number
PCT/CN2017/115488
Other languages
English (en)
French (fr)
Inventor
胡训国
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018108051A1 publication Critical patent/WO2018108051A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system

Definitions

  • the present invention relates to device management technologies in the field of information processing, and in particular, to a system management method and apparatus, and a storage medium.
  • the virus for survival and anti-softening methods are more and more concealed, many viruses through the automatic disappearance, automatic deformation, automatic resurrection and other technologies to avoid anti-virus software killing, and face For these technologies, traditional killing techniques often fail to accurately locate viruses and kill them.
  • the existing freezing technology cannot handle the writing of the system data before the file system driver is loaded, or after the file system driver is loaded, and the virus sample started before the killing driver is loaded, so that the electronic device cannot be fully guaranteed. Security issues.
  • the embodiment of the invention provides a system management method and device, and a storage medium, which can solve at least the above problems existing in the prior art.
  • An embodiment of the present invention provides a system management method, where the method includes:
  • N is an integer greater than or equal to 2;
  • the performing, by the target application, the writing process at least for the file system or the application includes: determining that the file system in the Nth boot sequence is the default file system, or the application is a preset application, The target application prohibits a write operation for the preset file system or a preset application.
  • An embodiment of the present invention provides a system management apparatus, where the electronic device includes:
  • An initial unit configured to acquire an activation sequence of at least one application of the electronic device and at least one file system after the electronic device is started;
  • a processing unit configured to load a target application in a first boot order based on the boot sequence; sequentially start a file system or an application in an Nth boot sequence, and perform write processing on the file system or application based on the target application
  • N is an integer greater than or equal to 2;
  • the processing unit is further configured to: after determining that the file system in the Nth boot sequence is the preset file system, or the application is a preset application, prohibiting, by the target application, the preset file system or the pre- Set the write operation of the application.
  • the system management method and device and the storage medium provided in the embodiments of the present invention ensure that after the electronic device is started, the loading target application is directly determined according to the startup sequence in the electronic device, and then the file system or application for the Nth startup sequence is determined based on the target application. Write processing is performed. In this way, it is possible to avoid the problem that the partial driving of the electronic device or the partial file system is first turned on before the target application is started, and the problem that the writing process cannot be fully performed is improved, thereby improving the security of the electronic device.
  • 1-1 is a schematic flowchart 1 of a system management method according to an embodiment of the present invention.
  • FIG. 1-2 are schematic flowcharts of a system management method according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart 3 of a system management method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of system processing according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart 4 of a system management method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a system management apparatus according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of hardware of a system management apparatus according to an embodiment of the present invention.
  • An embodiment of the present invention provides a system management method, as shown in Figure 1-1, including:
  • Step 101 After the electronic device is started, acquire an activation sequence of at least one application and at least one file system in the electronic device.
  • Step 102 Load a target application in a first startup sequence based on the startup sequence
  • Step 103 sequentially start a file system or an application in an Nth boot sequence, and perform write processing on the file system or application based on the target application; where N is an integer greater than or equal to 2;
  • the performing, by the target application, the writing process at least for the file system or the application includes: determining that the file system in the Nth boot sequence is the default file system, or the application is a preset application, The target application prohibits a write operation for the preset file system or a preset application.
  • step 101 may be specifically: acquiring, after the electronic device is started, a startup sequence of at least one application and at least one file system in the electronic device; or When the child device is started, that is, the time of starting, that is, the startup sequence of at least one application and at least one file system in the electronic device is acquired.
  • the file system in the Nth boot sequence is a preset file system, or the application is a preset application
  • writing to the preset file system or a preset application is prohibited by the target application.
  • the operation can be specifically as follows:
  • the write operation for the preset file system or the preset application is prohibited by the target application;
  • the write operation for the preset file system or the preset application is prohibited by the target application.
  • the processing method provided in this embodiment may be implemented by using a device, which may be a device disposed in the electronic device, or a device capable of being flexibly connected or disconnected from the electronic device, such as a USB flash drive. It is within the scope of protection of the present embodiment as long as it is possible to control the system startup sequence and the like in the electronic device.
  • the electronic device may be in a state in which hardware startup has just been completed. It can be understood that the startup of the electronic device can be divided into two parts: hardware startup and software startup. First, the hardware startup and then the software startup are completed, and the hardware startup is completed before the step 101, that is, the embodiment.
  • the electronic device of step 101 in the startup is mainly for the processing in the software startup.
  • the hardware startup may include an operation of detecting that the power switch is pressed after the motherboard is plugged in, and then notifying the south bridge to generate a PS-ON (power on) signal, and details are not described herein again.
  • the initial state of the embodiment is a state in which the electronic device does not perform loading of any system data.
  • the method may include: determining that the electronic device is If the hardware startup is completed, if yes, go to step 101.
  • the killing related driver is preemptively started at the earliest point in the system loading (before the file system and all viruses), how to preempt, and the earliest startup after the restart is guaranteed, which will be explained later.
  • the foregoing step 101 may be implemented by acquiring at least one service packet in the electronic device, and determining a startup sequence of the at least one application and the at least one file system based on a startup sequence corresponding to the at least one service group.
  • the order of the driver loading is improved, so that the target application (the killing application) is first loaded before the file system is started, and the file system change notification is registered, and when the change notification is received at the first time, the mount is performed.
  • the file system filters the driver, starts freezing the system, and prohibits the registry or file data from being written.
  • the implementation of the foregoing step 101 may also be: extracting a startup sequence list, and acquiring, by the startup sequence list, a startup sequence of at least one application and at least one file system.
  • the boot sequence list may include a boot sequence including only applications, a boot sequence of the file system, and a boot sequence for all applications and file systems in the electronic device.
  • the target application in the above startup sequence is set in the first startup sequence.
  • the target application may be an application capable of writing control to other file systems or applications, for example, may be an antivirus application.
  • the target application in the first startup sequence is loaded based on the startup sequence.
  • the target application in the first startup sequence may be acquired from the startup sequence, and then the target application is started. Further, after the above target application is started, other file systems or applications can be processed correspondingly at startup.
  • the method further includes:
  • the filtering parameter may be a filtering callback function by calling a system (CM) API function: NTSTATUS CmRegisterCallback (_In_PEX_CALLBACK_FUNCTION Function, _In_opt_PVOID Context, _Out_PLARGE_INTEGER Cookie); (for notification before the object is called, and after the call) The specific modification content is notified; the incoming filter callback function as a parameter can be: NTSTATUS RegistryCallback (_In_PVOID CallbackContext, _In_opt_PVOID Argument1, _In_opt_PVOID Argument2) (for describing the format).
  • CM system
  • control of the registry and the processing of step 103 may be simultaneous operations, or may be performed by first setting the filtering parameters for the registry, and then performing step 103, for the preset file system or the preset application. While detecting and disabling write operations, control against the registry is maintained based on filtering parameters for the registry.
  • sequentially starting the file system or application in the Nth boot sequence may be based on the boot sequence, detecting the boot sequence of the last booted file system or application; when determining the boot sequence of the last booted file system or application
  • the method may further include: determining whether there is a file system or an application of the Nth boot sequence, and if yes, starting the file system or application in the Nth boot sequence; otherwise, ending the process.
  • the method further includes:
  • Configuring a file system change parameter to an operating system of the electronic device wherein the file system change parameter is used to indicate that the feedback file system or application is in a loaded state after the operating system loads the file system or the application.
  • the feedback file system is indicated after the operating system loads the file system or application
  • the loading state of the application can be specifically:
  • the file system or application is in a loaded state at a particular moment after the operating system is instructed to load the file system or application.
  • the file system change parameter may be a change notification callback function, specifically by calling a system API function, such as a file registration change function NTSTATUS IoRegisterFsRegistrationChange(_In_PDRIVER_OBJECT DriverObject, _In_PDRIVER_FS_NOTIFICATION DriverNotificationRoutine), and inputting a callback function address, so that when there is a change, The system will call our callback function.
  • the signature of the callback function may be VOID DriverNotificationRoutine(_In_struct_DEVICE_OBJECT*DeviceObject, _In_BOOLEAN FsActive).
  • the file system change parameter is sent to the operating system, so that the operating system feeds back the corresponding loading state to the target application after starting any application or file system.
  • the target application prohibits a write operation for the preset file system or a preset application.
  • the operation of prohibiting writing in the file system may be: by calling the system API function NTSTATUS FltRegisterFilter (ie, for the file system filter), passing in a series of callback functions and configuration parameters, so that the specific event When it happens, we can collect it in time. Go to the notification and filter the event, release or disable it.
  • system API function NTSTATUS FltRegisterFilter ie, for the file system filter
  • the preset file system or the preset application may be set according to actual conditions.
  • the preset file system or the preset application may be preset in the target application, that is, the target application may include a list. The name of the file system of interest or the name of the application is set in this list.
  • the manner of prohibiting the write operation of the preset file system or the preset application may be to detect a corresponding path, and if a path for the preset file system or the preset application is detected, After processing, all write operations on the path can be disabled.
  • the following is a description of controlling the startup target application after the electronic device is turned on in conjunction with FIG. 2, wherein the target application may be a killing application for a virus file:
  • the operating system loads the file system, such as the NTFS file system, it checks whether there is a registered callback function and calls our notification callback function.
  • the system file system has not been fully initialized, and no one can write data to the disk through the file system.
  • the key technical points we use we use.
  • the solution provided by this embodiment can enable the registry and the file system to be frozen and banned by the killing driver when the startup is started, and can be kept frozen until the shutdown.
  • the state makes the system established, the virus can not be deformed, and it is easy to locate and kill.
  • this embodiment is also directed to the process of setting the startup sequence of the target application in the previous operation before the current startup.
  • FIG. 1-1 reference may be made to FIG. 1-2.
  • Step a1 creating a service group of the target application in a registry, where a service group of the target application corresponds to a startup order of the target application;
  • Step a2 setting a startup sequence of the new service packet to a first startup sequence; restarting the electronic device.
  • the registry is a tree structure with many nodes. Each node holds different information to configure the behavior of the operating system. There is a node-Service Group. The behavior defined under this node is the order in which the operating system loads all Service Groups. Each driver or file system belongs to a corresponding Service Group. The same Service Group may contain Multiple drivers. Therefore, we can change the order of Groups in a service group to change the order in which a particular driver or file system is loaded.
  • the method further includes: starting the target application, prohibiting a write operation for the system registry based on the target application. That is to say, once the target application is started, it is possible to detect all write operations for all the registry in the system registry and to prohibit the processing of the write operation.
  • the system that is started this time is frozen, and the virus cannot be automatically deformed or revived. It takes effect before shutdown. And the next boot can be started at the earliest, and the freeze policy is implemented again.
  • the virus can not be automatically deformed and revived, and the self-protection ability is lost. Therefore, the sample can be processed by using the previous killing technique.
  • the loading target application is directly determined according to the startup sequence in the electronic device, and then the writing process is performed for the file system or application of the Nth startup sequence based on the target application.
  • the writing process is performed for the file system or application of the Nth startup sequence based on the target application.
  • An embodiment of the present invention provides a system management apparatus, as shown in FIG. 5, including:
  • the initial unit 51 is configured to acquire, after the electronic device is started, a startup sequence of at least one application of the electronic device and at least one file system;
  • the processing unit 52 is configured to load the target application in the first startup sequence based on the startup sequence; sequentially start the file system or application in the Nth startup sequence, and write at least the file system or application based on the target application Processing; wherein N is an integer greater than or equal to 2;
  • the processing unit 52 is further configured to: after determining that the file system in the Nth boot sequence is a preset file system, or the application is a preset application, prohibiting, by the target application, the preset file system or The write operation of the preset application.
  • the initial unit 51 may be specifically configured to: after the electronic device is started, acquire an activation sequence of at least one application of the electronic device and at least one file system; or, when the electronic device is started, that is, a startup time Going to obtain at least one of the electronic devices The application and the order in which at least one file system is started.
  • the file system in the Nth boot sequence is a preset file system, or the application is a preset application
  • writing to the preset file system or a preset application is prohibited by the target application.
  • the operation can be specifically as follows:
  • the write operation for the preset file system or the preset application is prohibited by the target application;
  • the write operation for the preset file system or the preset application is prohibited by the target application.
  • system management device in this embodiment may be a device disposed in the electronic device, or may be a device that can be flexibly connected or disconnected from the electronic device, such as a USB flash drive, etc., as long as it can be in the electronic device.
  • the control of the system startup sequence and the like is within the protection scope of the present embodiment.
  • the startup of the electronic device can be divided into two parts: hardware startup and software startup.
  • hardware startup and software startup are completed, and hardware needs to be completed before acquiring the startup sequence of at least one application and at least one file system of the electronic device.
  • the startup that is to say, when the electronic device in this embodiment is started, is mainly directed to the processing in the software startup.
  • the hardware startup may include an operation of detecting that the power switch is pressed after the motherboard is plugged in, and then notifying the south bridge to generate a PS-ON (power on) signal, and details are not described herein again.
  • the initial state of the embodiment is a state in which the electronic device does not perform loading of any system data.
  • the initial unit 51 is further configured to determine whether the electronic device completes hardware startup, and if so, acquires a startup sequence of at least one application and at least one file system in the electronic device.
  • the killing related driver is preemptively started at the earliest point in the system loading (before the file system and all viruses), how to preempt, and the earliest startup after the restart is guaranteed, which will be explained later.
  • the initial unit 51 is configured to acquire at least one service packet in the electronic device, and determine a startup sequence of the at least one application and the at least one file system based on a startup sequence corresponding to the at least one service group.
  • the order of the driver loading is improved, so that the target application (the killing application) is first loaded before the file system is started, and the file system change notification is registered, and when the change notification is received at the first time, the mount is performed.
  • the file system filters the driver, starts freezing the system, and prohibits the registry or file data from being written.
  • the initial unit 51 is configured to extract to the startup sequence list, and obtain the startup sequence of the at least one application and the at least one file system by using the startup sequence list.
  • the boot sequence list may include a boot sequence including only applications, a boot sequence of the file system, and a boot sequence for all applications and file systems in the electronic device. The important point is that the target application in the above startup sequence is set in the first startup sequence.
  • the target application may be an application capable of writing control to other file systems or applications, for example, may be an antivirus application.
  • the target application in the first startup sequence may be acquired from the startup sequence, and then the target application is started. Further, after the above target application is started, other file systems or applications can be processed correspondingly at startup.
  • the electronic device further includes: a preset unit 53, configured to create a service group of the target application in a registry, the service group of the target application corresponds to a startup order of the target application; and set a new service group
  • the startup sequence is the first startup sequence; correspondingly, the processing unit is configured to restart the electronic device.
  • the processing unit is configured to send the electronic device to the electronic device based on the target application
  • the system registry configures a filtering parameter; the filtering parameter controls prohibiting a write operation for at least one target registry in the system registry.
  • control for the registry and the file system or application in the Nth startup sequence are sequentially started, and the processing for writing at least the file system or the application based on the target application may be simultaneous operation
  • the setting of the filtering parameter may be first performed for the registry, and then the file system or application in the Nth booting sequence is sequentially started, and the writing process is performed at least for the file system or the application based on the target application, While the system or the preset application is detecting and prohibiting the write operation, the control against the registry is maintained based on the filtering parameters for the registry.
  • the processing unit is configured to configure a file system change parameter to an operating system of the electronic device, where the file system change parameter is used to indicate that the feedback file system or application is loaded after the operating system loads the file system or the application status.
  • the file system change parameter is sent to the operating system, so that the operating system feeds back the corresponding loading state to the target application after starting any one of the application or the file system.
  • the loading file system or the loading state of the application may be specifically:
  • the file system or application is in a loaded state at a particular moment after the operating system is instructed to load the file system or application.
  • the processing unit is configured to determine whether the file system is a preset file system or an application after acquiring the file system in the Nth startup sequence or the information in the loading state fed back by the operating system. Whether it is a preset application;
  • the destination is The target application prohibits write operations for the preset file system or preset application.
  • the preset file system or the preset application may be set according to actual conditions.
  • the preset file system or the preset application may be preset in the target application, that is, the target application may include a list. The name of the file system of interest or the name of the application is set in this list.
  • the manner of prohibiting the write operation of the preset file system or the preset application may be to detect a corresponding path, and if a path for the preset file system or the preset application is detected, After processing, all write operations on the path can be disabled.
  • the following is a description of controlling the startup target application after the electronic device is turned on in conjunction with FIG. 2, wherein the target application may be a killing application for a virus file:
  • the operating system Register the file system change notification callback function to the operating system, and the operating system continues to initialize booting.
  • the operating system loads the file system, such as the NTFS file system, it checks whether there is a registered callback function and calls our notification callback function.
  • the system file system has not been fully initialized, and no one can write data to the disk through the file system.
  • the solution provided by this embodiment can freeze and ban the use of the filter function in the registry and the file system at the earliest booting, and the killing driver does not allow anti-registration or uninstallation. , until the shutdown, can remain frozen, making the system an, The virus can't be deformed, so it's easy to locate and kill.
  • this embodiment is also directed to the process of setting the startup sequence of the target application in the previous operation before the current startup, as follows:
  • the processing unit is configured to start the target application, and prohibit a write operation for the system registry based on the target application. That is to say, once the target application is started, it is possible to detect all write operations for all the registry in the system registry and to prohibit the processing of the write operation.
  • the processing unit is configured to acquire at least one service packet in the electronic device, and determine a startup sequence of the at least one application and the at least one file system based on a startup sequence corresponding to the at least one service group.
  • the system that is started this time is frozen, and the virus cannot be automatically deformed or revived. It takes effect before shutdown. And the next boot can be started at the earliest, and the freeze policy is implemented again.
  • the virus can not be automatically deformed and revived, and the self-protection ability is lost. Therefore, the sample can be processed by using the previous killing technique.
  • the order of the driver loading is improved, so that the target application (the killing application) is first loaded before the file system is started, and the file system change notification is registered.
  • the change notification is received the first time, the file system filter driver is mounted, the system is frozen, and the registry or file data is prohibited from being written.
  • the initial unit 51, the processing unit 52, and the preset unit 53 may each be a central processing unit (CPU), or a microprocessor (MPU), or a digital signal processor (DSP), or a programmable gate array ( FPGA) implementation.
  • CPU central processing unit
  • MPU microprocessor
  • DSP digital signal processor
  • FPGA programmable gate array
  • the embodiment further provides a system management apparatus comprising: a processor and a memory for storing a computer program executable on the processor, wherein the processor is configured to execute the computer program when the computer program is executed The steps of the method.
  • the memory may be implemented by any type of volatile or non-volatile storage device, or a combination thereof.
  • the non-volatile memory may be a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), or an Erasable Programmable Read (EPROM). Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM), Ferromagnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Memory , CD-ROM, or Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory can be a disk storage or a tape storage.
  • the volatile memory can be a random access memory (RAM) that acts as an external cache.
  • RAM Static Random Access Memory
  • SSRAM Synchronous Static Random Access Memory
  • SSRAM Dynamic Random Access
  • DRAM Dynamic Random Access Memory
  • SDRAM Synchronous Dynamic Random Access Memory
  • DDRSDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • ESDRAM Enhancement Synchronous dynamic A Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Dynamic Random Access Memory
  • DRRAM Direct Rambus Random Access Memory
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the above method may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the above processor may be a general purpose processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like.
  • the processor may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present invention.
  • a general purpose processor can be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiment of the present invention may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a storage medium, the storage medium being located in the memory, the processor reading the information in the memory, and completing the steps of the foregoing methods in combination with the hardware thereof.
  • the embodiment further provides a computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by the processor to implement the steps of the method described above.
  • the computer readable storage medium may be a memory such as FRAM, ROM, programmable read only memory PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or may include one or any of the above memories A combination of various devices.
  • the system management apparatus provided by the embodiments of the present invention can be implemented in various forms.
  • the apparatus described in the present invention may include, for example, a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet), a PMP (Portable Multimedia Player), a navigation device, etc.
  • Mobile terminals and fixed terminals such as digital TVs, desktop computers, and the like.
  • FIG. 6 is a schematic diagram showing the hardware configuration of a system management apparatus that implements various embodiments of the present invention.
  • the system management device 100 may include a user input unit 130, an output unit 150, a memory 160, an interface unit 170, a controller 180, a power supply unit 190, and the like.
  • the figure shows mobile terminals having various components, but it should be understood that not all illustrated components are required to be implemented. More or fewer components can be implemented instead. The elements of the mobile terminal will be described in detail below.
  • the user input unit 130 may generate key input data according to a command input by the user to control various operations of the mobile terminal.
  • the user input unit 130 allows the user to input various types of information, and may include a keyboard, a pot, a touch pad (eg, a touch sensitive component that detects changes in resistance, pressure, capacitance, etc. due to contact), a scroll wheel , rocker, etc.
  • a touch screen can be formed.
  • the interface unit 170 serves as an interface through which at least one external device can connect with the mobile terminal 100.
  • the external device may include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, and an audio input/output. (I/O) port, video I/O port, headphone port, and more.
  • the identification module may be stored to verify various information used by the user using the mobile terminal 100 and may include a User Identification Module (UIM), a Customer Identification Module (SIM), a Universal Customer Identity Module (USIM), and the like.
  • the device having the identification module may take the form of a smart card, and thus the identification device may be connected to the mobile terminal 100 via a port or other connection device.
  • the interface unit 170 can be configured to receive input from an external device (eg, data information, power, etc.) and transmit the received input to one or more components within the mobile terminal 100 or can be used at the mobile terminal and external device Transfer data between.
  • the interface unit 170 may function as a path through which power is supplied from the base to the mobile terminal 100 or may be used as a transmission of various command signals allowing input from the base to the mobile terminal 100 The path to the terminal.
  • Various command signals or power input from the base can be used as signals for identifying whether the mobile terminal is accurately mounted on the base.
  • the output unit 150 is configured to provide an output signal in a visual, audio, and/or tactile manner (eg, Audio signal, video signal, alarm signal, vibration signal, etc.).
  • the output unit 150 may include a display unit 151 and the like.
  • the display unit 151 can display information processed in the mobile terminal 100. For example, when the mobile terminal 100 is in a phone call mode, the display unit 151 can display a user interface (UI) or a graphical user interface (GUI) related to a call or other communication (eg, text messaging, multimedia file download, etc.). When the mobile terminal 100 is in a video call mode or an image capturing mode, the display unit 151 may display a captured image and/or a received image, a UI or GUI showing a video or image and related functions, and the like.
  • UI user interface
  • GUI graphical user interface
  • the display unit 151 can function as an input device and an output device.
  • the display unit 151 may include at least one of a liquid crystal display (LCD), a thin film transistor LCD (TFT-LCD), an organic light emitting diode (OLED) display, a flexible display, a three-dimensional (3D) display, and the like.
  • LCD liquid crystal display
  • TFT-LCD thin film transistor LCD
  • OLED organic light emitting diode
  • a flexible display a three-dimensional (3D) display, and the like.
  • 3D three-dimensional
  • Some of these displays may be configured to be transparent to allow a user to view from the outside, which may be referred to as a transparent display, and a typical transparent display may be, for example, a TOLED (Transparent Organic Light Emitting Diode) display or the like.
  • TOLED Transparent Organic Light Emitting Diode
  • the mobile terminal 100 may include two or more display units (or other display devices), for example, the mobile terminal may include an external display unit (not shown) and an internal display unit (not shown) .
  • the touch screen can be used to detect touch input pressure as well as touch input position and touch input area.
  • the memory 160 may store a software program or the like for processing and control operations performed by the controller 180, or may temporarily store data (for example, a phone book, a message, a still image, a video, etc.) that has been output or is to be output. Moreover, the memory 160 can store data regarding vibrations and audio signals of various manners that are output when a touch is applied to the touch screen.
  • the memory 160 may include at least one type of storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (eg, SD or DX memory, etc.), a random access memory (RAM), a static random access memory ( SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk, optical disk, and the like.
  • the mobile terminal 100 can execute the memory 160 with a connection through a network. The storage function of the network storage device cooperates.
  • the controller 180 typically controls the overall operation of the mobile terminal. For example, the controller 180 performs the control and processing associated with voice calls, data communications, video calls, and the like.
  • the power supply unit 190 receives external power or internal power under the control of the controller 180 and provides appropriate power required to operate the various components and components.
  • the various embodiments described herein can be implemented in a computer readable medium using, for example, computer software, hardware, or any combination thereof.
  • the embodiments described herein may be through the use of application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays ( An FPGA, a processor, a controller, a microcontroller, a microprocessor, at least one of the electronic units designed to perform the functions described herein, in some cases, such an embodiment may be at the controller 180 Implemented in the middle.
  • implementations such as procedures or functions may be implemented with separate software modules that permit the execution of at least one function or operation.
  • the software code can be implemented by a software application (or program) written in any suitable programming language, which can be stored in memory 160 and executed by
  • the loading target application is directly determined according to the startup sequence in the electronic device, and then the writing process is performed for the file system or application of the Nth startup sequence based on the target application.
  • the writing process is performed for the file system or application of the Nth startup sequence based on the target application.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or a light.
  • ROM read-only memory
  • RAM random access memory
  • magnetic disk or a light.
  • a medium such as a disk that can store program code.
  • the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, an electronic device, or a network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a RAM, a magnetic disk, or an optical disk.
  • the embodiment of the invention can ensure that after the electronic device is started, the loading target application is directly determined according to the startup sequence in the electronic device, and then the writing process is performed for the file system or application of the Nth startup sequence based on the target application. In this way, it is possible to avoid the problem that the partial driving of the electronic device or the partial file system is first turned on before the target application is started, and the problem that the writing process cannot be fully performed is improved, thereby improving the security of the electronic device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

一种系统管理方法及装置、存储介质，方法包括：电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序（101）；基于所述启动顺序加载处于第一启动顺序的目标应用（102）；依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理（103）；其中，N为大于等于2的整数；其中，所述基于所述目标应用至少针对所述文件系统或应用进行写入处理，包括：确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。

Description

一种系统管理方法及装置、存储介质
相关申请的交叉引用
本申请基于申请号为201611159444.5、申请日为2016年12月15日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及信息处理领域中的设备管理技术，尤其涉及一种系统管理方法及装置、存储介质。
背景技术
随着杀毒软件监控查杀越来越强力，病毒为生存而对抗杀软的方法也越来越隐蔽，很多病毒通过自动消失、自动变形、自动复活等技术来躲避杀毒软件的查杀，而面对这些技术，传统的查杀技术往往无法准确定位病毒并查杀。
但是，已有的冻结技术，不能处理操作系统重启后，在文件系统驱动加载之前，或加载之后且查杀驱动加载之前启动的病毒样本对系统数据的写入，从而存在无法全面保证电子设备的安全性的问题。
发明内容
本发明实施例提供一种系统管理方法及装置、存储介质，能至少解决现有技术中存在的上述问题。
本发明实施例的技术方案是这样实现的：
本发明实施例提供一种系统管理方法，所述方法包括：
电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
基于所述启动顺序加载处于第一启动顺序的目标应用；
依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
其中，所述基于所述目标应用至少针对所述文件系统或应用进行写入处理，包括：确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
本发明实施例提供一种系统管理装置，所述电子设备包括：
初始单元，配置为电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
处理单元，配置为基于所述启动顺序加载处于第一启动顺序的目标应用；依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
其中，所述处理单元，还配置为确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
本发明实施例中提供的系统管理方法及装置、存储介质，保证在电子设备启动之后，直接根据电子设备中的启动顺序确定加载目标应用，进而基于目标应用针对第N启动顺序的文件系统或应用进行写入处理。如此，就能够避免启动目标应用之前，电子设备存在部分驱动或部分文件系统首先开启，而导致的无法全面的进行写入处理的问题，提升了电子设备的安全性。
附图说明
图1-1为本发明实施例系统管理方法流程示意图一；
图1-2为本发明实施例系统管理方法流程示意图二；
图2为本发明实施例系统管理方法流程示意图三；
图3为本发明实施例系统处理示意图；
图4为本发明实施例系统管理方法流程示意图四；
图5为本发明实施例系统管理装置组成结构示意图；
图6为本发明实施例系统管理装置硬件示意图。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
实施例一、
本发明实施例提供了一种系统管理方法，如图1-1所示，包括：
步骤101：电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
步骤102：基于所述启动顺序加载处于第一启动顺序的目标应用；
步骤103：依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
其中，所述基于所述目标应用至少针对所述文件系统或应用进行写入处理，包括：确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
本实施例中，步骤101可以具体为：在电子设备启动之后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；或者，在电 子设备启动时，也即启动的时刻，即去获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序。
相应地，所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作，可以具体为：
在确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用之后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作；或者，
在确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用的时刻，即通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
需要说明的是，本实施例所提供的处理方法可以通过装置实现，该装置可以为设置在上述电子设备中的装置，也可以为能够与电子设备灵活连接或断开的装置，比如U盘等，只要能够对电子设备中的系统启动顺序等进行控制即在本实施例的保护范围内。
这里，执行步骤101之前，所述电子设备可以为刚刚完成硬件启动的状态。可以理解的是，电子设备的启动可以划分为硬件启动以及软件启动这两个部分，首先要完成硬件启动然后再进行软件启动，而上述步骤101之前需要完成硬件启动，也就是说，本实施例中的步骤101的电子设备启动，主要针对的为软件启动中的处理。
进一步地，上述硬件启动可以包括有主板插入电源后，检测到电源开关按下，然后通知南桥产生PS-ON(电源接通)的信号等操作，这里不再一一赘述。
也就是说，本实施例的初始状态为电子设备未进行任何系统数据的加载的状态。具体的，执行步骤101之前，可以包括：判断所述电子设备是 否完成硬件启动，若完成，则执行步骤101。
查杀相关驱动抢先在系统加载最早点启动(早于文件系统和所有病毒)，如何抢先，保证重启后最早启动，将在后续说明。
具体来说，上述步骤101的实现方式可以为获取电子设备中的至少一个服务分组，基于至少一个服务分组对应的启动顺序，确定所述至少一个应用以及至少一个文件系统的启动顺序。
本实施例通过创建服务分组，提升驱动加载的顺序，使得目标应用(查杀应用)先在文件系统启动之前最早加载，并且注册文件系统变更通知，在第一时间收到变更通知时，挂载文件系统过滤驱动，开始冻结系统，禁止注册表或文件数据写入。
上述步骤101的实现方式还可以为：提取到启动顺序列表，通过所述启动顺序列表获取到至少一个应用以及至少一个文件系统的启动顺序。上述启动顺序列表中可以为仅包括有应用的启动顺序，也可以包括有文件系统的启动顺序，还可以为针对电子设备中全部应用以及文件系统的启动顺序。重点在于，上述启动顺序中目标应用设置在第一启动顺序。其中，所述目标应用可以为能够对其他文件系统或应用进行写入控制的应用，比如，可以为杀毒应用。
上述步骤102中，基于所述启动顺序加载处于第一启动顺序的目标应用，具体来说，可以为从所述启动顺序中获取到处于第一启动顺序的目标应用，然后启动所述目标应用。进一步地，启动上述目标应用之后，就能够对其他文件系统或应用在启动的时候进行相应的处理。
进一步地，上述步骤102所述基于所述启动顺序加载处于第一启动顺序的目标应用之后，所述方法还包括：
基于所述目标应用向所述电子设备的系统注册表配置过滤参数；
通过所述过滤参数控制禁止针对所述系统注册表中的至少一个目标注 册表进行写入操作。
具体的，所述过滤参数可以为过滤回调函数，通过调用系统(CM)API函数：NTSTATUS CmRegisterCallback(_In_PEX_CALLBACK_FUNCTION Function,_In_opt_PVOID Context,_Out_PLARGE_INTEGER Cookie)；(用于针对对象进行调用之前的通知，以及调用之后的具体修改内容进行通知)；传入过滤回调函数作为参数，可以为：NTSTATUS RegistryCallback(_In_PVOID CallbackContext,_In_opt_PVOID Argument1,_In_opt_PVOID Argument2)(用于对格式进行描述)。
需要指出的是，上述针对注册表的控制与步骤103的处理可以为同时操作，也可以为首先针对注册表进行过滤参数的设置，然后执行步骤103，在针对预设文件系统或预设应用进行检测以及禁止写入操作的同时，基于针对注册表的过滤参数保持针对注册表的控制。
进一步地，上述步骤103中，依次启动处于第N启动顺序的文件系统或应用可以为基于启动顺序，检测最后启动的文件系统或应用的启动顺序；当确定最后启动的文件系统或应用的启动顺序为第N-1启动顺序时，确定启动处于第N启动顺序的文件系统或应用。另外，还可以包括：判断是否存在第N启动顺序的文件系统或应用，若存在，则启动处于第N启动顺序的文件系统或应用，否则，结束处理。
所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作之前，所述方法还包括：
向所述电子设备的操作系统配置文件系统变更参数；其中，所述文件系统变更参数用于指示所述操作系统加载文件系统或应用后，反馈文件系统或应用处于加载状态。
这里，所述指示所述操作系统加载文件系统或应用后，反馈文件系统 或应用的处于加载状态可以具体为：
在指示所述操作系统加载文件系统或应用时，也即在指示操作系统加载文件系统或应用的时刻，反馈文件系统或应用的处于加载状态；或者，
在在指示所述操作系统加载文件系统或应用后的特定时刻，反馈文件系统或应用的处于加载状态。
其中，所述文件系统变更参数可以为变更通知回调函数，具体的通过调用系统API函数，比如文件注册改变函数NTSTATUS IoRegisterFsRegistrationChange(_In_PDRIVER_OBJECT DriverObject,_In_PDRIVER_FS_NOTIFICATION DriverNotificationRoutine)，传入回调函数地址，使得有变更的时候，系统会调用我们的回调函数。其中，回调函数的签名可以为VOID DriverNotificationRoutine(_In_struct_DEVICE_OBJECT*DeviceObject,_In_BOOLEAN FsActive)。
也就是说，目标应用启动之后向操作系统发送文件系统变更参数，以使得操作系统在启动任意一个应用或文件系统后，向目标应用反馈相应的加载状态。
相应的，所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作，包括：
确定获取到所述操作系统反馈的处于第N启动顺序的文件系统或应用处于加载状态的信息后，判断所述文件系统是否为预设文件系统、或应用是否为预设应用；
若确定所述文件系统为预设文件系统、或应用为预设应用，则所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
具体来说，禁止在文件系统中进行写入的操作可以为：通过调用系统API函数NTSTATUS FltRegisterFilter(即针对文件系统的过滤器)，传入一系列的回调函数及配置参数，使得在特定的事件发生时，我们可以及时收 到通知并对事件进行过滤处理，放行或者禁止。
所述预设文件系统或预设应用可以为根据实际情况进行设置，另外，所述预设文件系统或预设应用可以为预设在目标应用中，即目标应用中可以包括有一个列表，在该列表中设置关心的文件系统的名称或应用的名称。
具体来说，所述禁止针对所述预设文件系统或预设应用的写入操作的方式，可以为检测对应的路径，一旦检测到有针对所述预设文件系统或预设应用的路径的处理后，可以针对该路径上的所有写入操作进行禁止。
下面结合图2针对电子设备开启之后就控制启动目标应用进行说明，其中，目标应用可以为一个针对病毒文件的查杀应用：
在查杀驱动启动后，先向系统注册注册表过滤参数(过滤回调函数)，通过回调函数检查并拦截对敏感注册表位置的写入，防止病毒变形，此处保持禁写，冻结到系统关机。
向操作系统注册文件系统变更通知回调函数，操作系统继续进行初始化引导启动，当操作系统加载文件系统，如NTFS文件系统时，会检查当前是否有注册的回调函数，并调用我们的通知回调函数；我们在注册的回调函数中收到通知时，这个时候，系统文件系统还未完全初始化完成，所有人均无法通过文件系统向磁盘写入数据。在这个时候，我们判断是否是感兴趣的目标文件系统，如果是，则立即向该文件系统注册文件过滤函数，并在文件过滤函数中，检查并拦截对敏感文件路径数据的写入，防止病毒样本变形及复活。这样，就能在最早可用的时机，锁定文件系统的写入，直到系统关机，保持全程冻结。这里是我们使用的关键技术点。
至此，结合图3，可以看出，本实施例提供的方案，能够使得注册表和文件系统均在开启启动时，就被查杀驱动使用过滤函数冻结禁写，一直到关机，都能保持冻结状态，使得系统无懈可击，病毒无法变形，便于定位查杀。
另外，本实施例还针对在本次开启之前的上一次操作中，针对目标应用的启动顺序进行设置的处理，在上述图1-1的基础之上，可以参见图1-2，所述获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序之前，所述还包括：
步骤a1：在注册表中创建所述目标应用的服务分组，所述目标应用的服务分组与所述目标应用的启动顺序相对应；
步骤a2：设置新的服务分组的启动顺序为第一启动顺序；重启所述电子设备。
需要指出的是：注册表是一个树状结构，有很多节点，每个节点保存了不同的信息用来配置操作系统的行为。其中有一个节点-Service Group(服务分组)，该节点下定义的行为就是操作系统加载所有Service Group的顺序，而每个驱动或文件系统都属于对应的某个Service Group，同一个Service Group可能包含多个驱动。所以，我们改变服务分组里Group的顺序，就可以改变具体某个驱动或文件系统的加载顺序。
所述在注册表中创建新的服务分组之前，所述方法还包括：启动所述目标应用，基于所述目标应用禁止针对系统注册表的写入操作。也就是说，一旦启动目标应用就可以针对所有针对系统注册表中的全部注册表的写入操作进行检测以及禁止写入操作的处理。
参见图4，下面针对如何保证重启后驱动最早加载的设置操作进行说明：
在准备要冻结系统时，首先锁定注册表，不允许第三方程序再写入任何数据到相关注册表；
在注册表指定位置创建一个新的服务分组，并且将该服务分组的启动顺序设成最早；
将我们的查杀驱动放置在新创建的服务分组中，使得下次开机，能够 在系统引导的最早时期被加载；
锁定文件，禁止相关位置的文件写入。
本次开机的系统冻结完成，病毒无法自动变形或复活，在关机之前均生效。且下次开机能最早启动，实施再次冻结策略。
如此，在冻结系统后，病毒已无法自动变形、复活，失去了自我保护能力，因此，可以继续使用以往查杀技术对样本进行处理。
可见，通过上述方案，就能够保证在电子设备启动之后，直接根据电子设备中的启动顺序确定加载目标应用，进而基于目标应用针对第N启动顺序的文件系统或应用进行写入处理。如此，就能够避免启动目标应用之前，电子设备存在部分驱动或部分文件系统首先开启，而导致的无法全面的进行写入处理的问题，提升了电子设备的安全性。
实施例二、
本发明实施例提供了一种系统管理装置，如图5所示，包括：
初始单元51，配置为电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
处理单元52，配置为基于所述启动顺序加载处于第一启动顺序的目标应用；依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
其中，所述处理单元52，还配置为确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
本实施例中，初始单元51可以具体配置为：在电子设备启动之后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；或者，在电子设备启动时，也即启动的时刻，即去获取所述电子设备中至少一个 应用以及至少一个文件系统的启动顺序。
相应地，所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作，可以具体为：
在确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用之后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作；或者，
在确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用的时刻，即通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
需要说明的是，本实施例系统管理装置，可以为设置在上述电子设备中的装置，也可以为能够与电子设备灵活连接或断开的装置，比如U盘等，只要能够对电子设备中的系统启动顺序等进行控制即在本实施例的保护范围内。
电子设备的启动可以划分为硬件启动以及软件启动这两个部分，首先要完成硬件启动然后再进行软件启动，而获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序之前需要完成硬件启动，也就是说，本实施例中的电子设备启动时，主要针对的为软件启动中的处理。
进一步地，上述硬件启动可以包括有主板插入电源后，检测到电源开关按下，然后通知南桥产生PS-ON(电源接通)的信号等操作，这里不再一一赘述。
也就是说，本实施例的初始状态为电子设备未进行任何系统数据的加载的状态。具体的，初始单元51，还配置为判断所述电子设备是否完成硬件启动，若完成，则获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序。
查杀相关驱动抢先在系统加载最早点启动(早于文件系统和所有病毒)，如何抢先，保证重启后最早启动，将在后续说明。
具体来说，初始单元51，配置为获取电子设备中的至少一个服务分组，基于至少一个服务分组对应的启动顺序，确定所述至少一个应用以及至少一个文件系统的启动顺序。
本实施例通过创建服务分组，提升驱动加载的顺序，使得目标应用(查杀应用)先在文件系统启动之前最早加载，并且注册文件系统变更通知，在第一时间收到变更通知时，挂载文件系统过滤驱动，开始冻结系统，禁止注册表或文件数据写入。
还可以为：初始单元51，配置为提取到启动顺序列表，通过所述启动顺序列表获取到至少一个应用以及至少一个文件系统的启动顺序。上述启动顺序列表中可以为仅包括有应用的启动顺序，也可以包括有文件系统的启动顺序，还可以为针对电子设备中全部应用以及文件系统的启动顺序。重点在于，上述启动顺序中目标应用设置在第一启动顺序。其中，所述目标应用可以为能够对其他文件系统或应用进行写入控制的应用，比如，可以为杀毒应用。
基于所述启动顺序加载处于第一启动顺序的目标应用，具体来说，可以为从所述启动顺序中获取到处于第一启动顺序的目标应用，然后启动所述目标应用。进一步地，启动上述目标应用之后，就能够对其他文件系统或应用在启动的时候进行相应的处理。
所述电子设备还包括：预设单元53，配置为在注册表中创建所述目标应用的服务分组，所述目标应用的服务分组与所述目标应用的启动顺序相对应；设置新的服务分组的启动顺序为第一启动顺序；相应的，所述处理单元，配置为重启所述电子设备。
进一步地，所述处理单元，配置为基于所述目标应用向所述电子设备 的系统注册表配置过滤参数；通过所述过滤参数控制禁止针对所述系统注册表中的至少一个目标注册表进行写入操作。
需要指出的是，上述针对注册表的控制与依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理的处理可以为同时操作，也可以为首先针对注册表进行过滤参数的设置，然后执行依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理，在针对预设文件系统或预设应用进行检测以及禁止写入操作的同时，基于针对注册表的过滤参数保持针对注册表的控制。
所述处理单元，配置为向所述电子设备的操作系统配置文件系统变更参数；其中，所述文件系统变更参数用于指示所述操作系统加载文件系统或应用后，反馈文件系统或应用处于加载状态。
在一具体示例中，目标应用启动之后向操作系统发送文件系统变更参数，以使得操作系统在启动任意一个应用或文件系统后，向目标应用反馈相应的加载状态。
这里，所述指示所述操作系统加载文件系统或应用后，反馈文件系统或应用的处于加载状态可以具体为：
在指示所述操作系统加载文件系统或应用时，也即在指示操作系统加载文件系统或应用的时刻，反馈文件系统或应用的处于加载状态；或者，
在在指示所述操作系统加载文件系统或应用后的特定时刻，反馈文件系统或应用的处于加载状态。
相应的，所述处理单元，配置为当获取到所述操作系统反馈的处于第N启动顺序的文件系统或应用处于加载状态的信息后，判断所述文件系统是否为预设文件系统、或应用是否为预设应用；
若确定所述文件系统为预设文件系统、或应用为预设应用，则所述目 标应用禁止针对所述预设文件系统或预设应用的写入操作。
所述预设文件系统或预设应用可以为根据实际情况进行设置，另外，所述预设文件系统或预设应用可以为预设在目标应用中，即目标应用中可以包括有一个列表，在该列表中设置关心的文件系统的名称或应用的名称。
具体来说，所述禁止针对所述预设文件系统或预设应用的写入操作的方式，可以为检测对应的路径，一旦检测到有针对所述预设文件系统或预设应用的路径的处理后，可以针对该路径上的所有写入操作进行禁止。
下面结合图2针对电子设备开启之后就控制启动目标应用进行说明，其中，目标应用可以为一个针对病毒文件的查杀应用：
在查杀驱动启动后，先向系统注册注册表过滤参数(过滤回调函数)，通过回调函数检查并拦截对敏感注册表位置的写入，防止病毒变形，此处保持禁写，冻结到系统关机。
向操作系统注册文件系统变更通知回调函数，操作系统继续进行初始化引导启动，当操作系统加载文件系统，如NTFS文件系统时，会检查当前是否有注册的回调函数，并调用我们的通知回调函数
我们在注册的回调函数中收到通知时，这个时候，系统文件系统还未完全初始化完成，所有人均无法通过文件系统向磁盘写入数据。在这个时候，我们判断是否是感兴趣的目标文件系统，如果是，则立即向该文件系统注册文件过滤函数，并在文件过滤函数中，检查并拦截对敏感文件路径数据的写入，防止病毒样本变形及复活。这样，就能在最早可用的时机，锁定文件系统的写入，直到系统关机，保持全程冻结。这里是我们使用的关键技术点。
至此，结合图3，可以看出，本实施例提供的方案，能够在注册表和文件系统均在开机最早被查杀驱动使用过滤函数冻结禁写，而查杀驱动又不允许反注册或卸载，一直到关机，都能保持冻结状态，使得系统无懈可击， 病毒无法变形，便于定位查杀。
另外，本实施例还针对在本次开启之前的上一次操作中，针对目标应用的启动顺序进行设置的处理，具体如下：
所述处理单元，配置为启动所述目标应用，基于所述目标应用禁止针对系统注册表的写入操作。也就是说，一旦启动目标应用就可以针对所有针对系统注册表中的全部注册表的写入操作进行检测以及禁止写入操作的处理。
所述处理单元，配置为获取电子设备中的至少一个服务分组，基于至少一个服务分组对应的启动顺序，确定所述至少一个应用以及至少一个文件系统的启动顺序。
参见图4，下面针对如何保证重启后驱动最早加载的设置操作进行说明：
在准备要冻结系统时，首先锁定注册表，不允许第三方程序再写入任何数据到相关注册表；
在注册表指定位置创建一个新的服务分组，并且将该服务分组的启动顺序设成最早；
将我们的查杀驱动放置在新创建的服务分组中，使得下次开机，能够在系统引导的最早时期被加载；
锁定文件，禁止相关位置的文件写入。
本次开机的系统冻结完成，病毒无法自动变形或复活，在关机之前均生效。且下次开机能最早启动，实施再次冻结策略。
如此，在冻结系统后，病毒已无法自动变形、复活，失去了自我保护能力，因此，可以继续使用以往查杀技术对样本进行处理。
本实施例通过创建服务分组，提升驱动加载的顺序，使得目标应用(查杀应用)先在文件系统启动之前最早加载，并且注册文件系统变更通知， 在第一时间收到变更通知时，挂载文件系统过滤驱动，开始冻结系统，禁止注册表或文件数据写入。
实际应用中，所述初始单元51、处理单元52以及预设单元53均可由中央处理器(CPU)、或微处理器(MPU)、或数字信号处理器(DSP)、或可编程门阵列(FPGA)实现。
本实施例还提供了一种系统管理装置，包括：处理器和用于存储能够在处理器上运行的计算机程序的存储器，其中，所述处理器用于运行所述计算机程序时，执行以上所述方法的步骤。
这里，实际应用中，存储器可以由任何类型的易失性或非易失性存储设备、或者它们的组合来实现。其中，非易失性存储器可以是只读存储器(ROM，Read Only Memory)、可编程只读存储器(PROM，Programmable Read-Only Memory)、可擦除可编程只读存储器(EPROM，Erasable Programmable Read-Only Memory)、电可擦除可编程只读存储器(EEPROM，Electrically Erasable Programmable Read-Only Memory)、磁性随机存取存储器(FRAM，Ferromagnetic Random Access Memory)、快闪存储器(Flash Memory)、磁表面存储器、光盘、或只读光盘(CD-ROM，Compact Disc Read-Only Memory)；磁表面存储器可以是磁盘存储器或磁带存储器。易失性存储器可以是随机存取存储器(RAM，Random Access Memory)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(SRAM，Static Random Access Memory)、同步静态随机存取存储器(SSRAM，Synchronous Static Random Access Memory)、动态随机存取存储器(DRAM，Dynamic Random Access Memory)、同步动态随机存取存储器(SDRAM，Synchronous Dynamic Random Access Memory)、双倍数据速率同步动态随机存取存储器(DDRSDRAM，Double Data Rate Synchronous Dynamic Random Access Memory)、增强型同步动态 随机存取存储器(ESDRAM，Enhanced Synchronous Dynamic Random Access Memory)、同步连接动态随机存取存储器(SLDRAM，SyncLink Dynamic Random Access Memory)、直接内存总线随机存取存储器(DRRAM，Direct Rambus Random Access Memory)。本发明实施例描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
所述处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP，Digital Signal Processor)，或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。处理器可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本发明实施例所公开的方法的步骤，可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于存储介质中，该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成前述方法的步骤。
本实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，其中，该计算机程序被处理器执行时实现以上所述方法的步骤。
这里，计算机可读存储介质可以是FRAM、ROM、可编程只读存储器PROM、EPROM、EEPROM、Flash Memory、磁表面存储器、光盘、或CD-ROM等存储器；也可以是包括上述存储器之一或任意组合的各种设备。
本发明实施例提供的系统管理装置可以以各种形式来实施。例如，本发明中描述的装置可以包括诸如移动电话、智能电话、笔记本电脑、数字广播接收器、PDA(个人数字助理)、PAD(平板电脑)、PMP(便携式多媒体播放器)、导航装置等等的移动终端以及诸如数字TV、台式计算机等等的固定终端。图6为实现本发明各个实施例的系统管理装置的硬件结构示意。
系统管理装置100可以包括用户输入单元130、输出单元150、存储器160、接口单元170、控制器180和电源单元190等等。图中示出了具有各种组件的移动终端，但是应理解的是，并不要求实施所有示出的组件。可以替代地实施更多或更少的组件。将在下面详细描述移动终端的元件。
用户输入单元130可以根据用户输入的命令生成键输入数据以控制移动终端的各种操作。用户输入单元130允许用户输入各种类型的信息，并且可以包括键盘、锅仔片、触摸板(例如，检测由于被接触而导致的电阻、压力、电容等等的变化的触敏组件)、滚轮、摇杆等等。特别地，当触摸板以层的形式叠加在显示单元151上时，可以形成触摸屏。
接口单元170用作至少一个外部装置与移动终端100连接可以通过的接口。例如，外部装置可以包括有线或无线头戴式耳机端口、外部电源(或电池充电器)端口、有线或无线数据端口、存储卡端口、用于连接具有识别模块的装置的端口、音频输入/输出(I/O)端口、视频I/O端口、耳机端口等等。识别模块可以是存储用于验证用户使用移动终端100的各种信息并且可以包括用户识别模块(UIM)、客户识别模块(SIM)、通用客户识别模块(USIM)等等。另外，具有识别模块的装置(下面称为"识别装置")可以采取智能卡的形式，因此，识别装置可以经由端口或其它连接装置与移动终端100连接。接口单元170可以用于接收来自外部装置的输入(例如，数据信息、电力等等)并且将接收到的输入传输到移动终端100内的一个或多个元件或者可以用于在移动终端和外部装置之间传输数据。
另外，当移动终端100与外部底座连接时，接口单元170可以用作允许通过其将电力从底座提供到移动终端100的路径或者可以用作允许从底座输入的各种命令信号通过其传输到移动终端的路径。从底座输入的各种命令信号或电力可以用作用于识别移动终端是否准确地安装在底座上的信号。输出单元150被构造为以视觉、音频和/或触觉方式提供输出信号(例如， 音频信号、视频信号、警报信号、振动信号等等)。
输出单元150可以包括显示单元151等等。显示单元151可以显示在移动终端100中处理的信息。例如，当移动终端100处于电话通话模式时，显示单元151可以显示与通话或其它通信(例如，文本消息收发、多媒体文件下载等等)相关的用户界面(UI)或图形用户界面(GUI)。当移动终端100处于视频通话模式或者图像捕获模式时，显示单元151可以显示捕获的图像和/或接收的图像、示出视频或图像以及相关功能的UI或GUI等等。
同时，当显示单元151和触摸板以层的形式彼此叠加以形成触摸屏时，显示单元151可以用作输入装置和输出装置。显示单元151可以包括液晶显示器(LCD)、薄膜晶体管LCD(TFT-LCD)、有机发光二极管(OLED)显示器、柔性显示器、三维(3D)显示器等等中的至少一种。这些显示器中的一些可以被构造为透明状以允许用户从外部观看，这可以称为透明显示器，典型的透明显示器可以例如为TOLED(透明有机发光二极管)显示器等等。根据特定想要的实施方式，移动终端100可以包括两个或更多显示单元(或其它显示装置)，例如，移动终端可以包括外部显示单元(未示出)和内部显示单元(未示出)。触摸屏可用于检测触摸输入压力以及触摸输入位置和触摸输入面积。
存储器160可以存储由控制器180执行的处理和控制操作的软件程序等等，或者可以暂时地存储己经输出或将要输出的数据(例如，电话簿、消息、静态图像、视频等等)。而且，存储器160可以存储关于当触摸施加到触摸屏时输出的各种方式的振动和音频信号的数据。
存储器160可以包括至少一种类型的存储介质，所述存储介质包括闪存、硬盘、多媒体卡、卡型存储器(例如，SD或DX存储器等等)、随机访问存储器(RAM)、静态随机访问存储器(SRAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、可编程只读存储器(PROM)、磁性存储器、磁盘、光盘等等。而且，移动终端100可以与通过网络连接执行存储器160 的存储功能的网络存储装置协作。
控制器180通常控制移动终端的总体操作。例如，控制器180执行与语音通话、数据通信、视频通话等等相关的控制和处理。
电源单元190在控制器180的控制下接收外部电力或内部电力并且提供操作各元件和组件所需的适当的电力。
这里描述的各种实施方式可以以使用例如计算机软件、硬件或其任何组合的计算机可读介质来实施。对于硬件实施，这里描述的实施方式可以通过使用特定用途集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理装置(DSPD)、可编程逻辑装置(PLD)、现场可编程门阵列(FPGA)、处理器、控制器、微控制器、微处理器、被设计为执行这里描述的功能的电子单元中的至少一种来实施，在一些情况下，这样的实施方式可以在控制器180中实施。对于软件实施，诸如过程或功能的实施方式可以与允许执行至少一种功能或操作的单独的软件模块来实施。软件代码可以由以任何适当的编程语言编写的软件应用程序(或程序)来实施，软件代码可以存储在存储器160中并且由控制器180执行。
可见，通过上述方案，就能够保证在电子设备启动之后，直接根据电子设备中的启动顺序确定加载目标应用，进而基于目标应用针对第N启动顺序的文件系统或应用进行写入处理。如此，就能够避免启动目标应用之前，电子设备存在部分驱动或部分文件系统首先开启，而导致的无法全面的进行写入处理的问题，提升了电子设备的安全性。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光 盘等各种可以存储程序代码的介质。
或者，本发明上述集成的单元如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、电子设备、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：移动存储设备、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。
工业实用性
本发明实施例能够保证在电子设备启动之后，直接根据电子设备中的启动顺序确定加载目标应用，进而基于目标应用针对第N启动顺序的文件系统或应用进行写入处理。如此，就能够避免启动目标应用之前，电子设备存在部分驱动或部分文件系统首先开启，而导致的无法全面的进行写入处理的问题，提升了电子设备的安全性。

Claims (16)

  1. 一种系统管理方法，所述方法包括：
    电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
    基于所述启动顺序加载处于第一启动顺序的目标应用；
    依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
    其中，所述基于所述目标应用至少针对所述文件系统或应用进行写入处理，包括：确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
  2. 根据权利要求1所述的方法，其中，所述获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序之前，所述方法还包括：
    在系统注册表中创建所述目标应用的服务分组，所述目标应用的服务分组与所述目标应用的启动顺序相对应；
    设置新的服务分组的启动顺序为第一启动顺序；
    重启所述电子设备。
  3. 根据权利要求2所述的方法，其中，所述在系统注册表中创建所述目标应用的服务分组之前，所述方法还包括：
    启动所述目标应用，基于所述目标应用禁止针对系统注册表的写入操作。
  4. 根据权利要求2或3所述的方法，其中，所述获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序，包括：
    获取电子设备中的至少一个服务分组，基于至少一个服务分组对应的 启动顺序，确定所述至少一个应用以及至少一个文件系统的启动顺序。
  5. 根据权利要求1所述的方法，其中，所述基于所述启动顺序加载处于第一启动顺序的目标应用之后，所述方法还包括：
    基于所述目标应用向所述电子设备的系统注册表配置过滤参数；
    通过所述过滤参数控制禁止针对所述系统注册表中的至少一个目标注册表进行写入操作。
  6. 根据权利要求1所述的方法，其中，所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作之前，所述方法还包括：
    向所述电子设备的操作系统配置文件系统变更参数；其中，所述文件系统变更参数用于指示所述操作系统加载文件系统或应用后，反馈文件系统或应用处于加载状态。
  7. 根据权利要求6所述的方法，其中，所述确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作，包括：
    确定获取到所述操作系统反馈的处于第N启动顺序的文件系统或应用处于加载状态的信息后，判断所述文件系统是否为预设文件系统、或应用是否为预设应用；
    若确定所述文件系统为预设文件系统、或应用为预设应用，则所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
  8. 一种系统管理装置，所述电子设备包括：
    初始单元，配置为电子设备启动后，获取所述电子设备中至少一个应用以及至少一个文件系统的启动顺序；
    处理单元，配置为基于所述启动顺序加载处于第一启动顺序的目标应用；依次启动处于第N启动顺序的文件系统或应用，基于所述目标应用至 少针对所述文件系统或应用进行写入处理；其中，N为大于等于2的整数；
    其中，所述处理单元，还配置为确定处于第N启动顺序的文件系统为预设文件系统、或所述应用为预设应用后，通过所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
  9. 根据权利要求8所述的装置，其中，所述装置还包括：
    预设单元，配置为在系统注册表中创建所述目标应用的服务分组，所述目标应用的服务分组与所述目标应用的启动顺序相对应；设置新的服务分组的启动顺序为第一启动顺序；
    相应的，所述处理单元，配置为重启所述电子设备。
  10. 根据权利要求9所述的装置，其中，所述处理单元，配置为重启所述电子设备之前，启动所述目标应用，基于所述目标应用禁止针对系统注册表的写入操作。
  11. 根据权利要求9所述的装置，其中，所述初始单元，配置为获取电子设备中的至少一个服务分组，基于至少一个服务分组对应的启动顺序，确定所述至少一个应用以及至少一个文件系统的启动顺序。
  12. 根据权利要求8所述的装置，其中，所述处理单元，还配置为基于所述目标应用向所述电子设备的系统注册表配置过滤参数；通过所述过滤参数控制禁止针对所述系统注册表中的至少一个目标注册表进行写入操作。
  13. 根据权利要求8所述的装置，其中，所述处理单元，还配置为向所述电子设备的操作系统配置文件系统变更参数；其中，所述文件系统变更参数用于指示所述操作系统加载文件系统或应用后，反馈文件系统或应用处于加载状态。
  14. 根据权利要求8所述的装置，其中，所述处理单元，还配置为确定获取到所述操作系统反馈的处于第N启动顺序的文件系统或应用处于加 载状态的信息后，判断所述文件系统是否为预设文件系统、或应用是否为预设应用；若确定所述文件系统为预设文件系统、或应用为预设应用，则所述目标应用禁止针对所述预设文件系统或预设应用的写入操作。
  15. 一种系统管理装置，包括：处理器和用于存储能够在处理器上运行的计算机程序的存储器，其中，所述处理器用于运行所述计算机程序时，执行权利要求1至7所述方法的步骤。
  16. 一种计算机可读存储介质，其上存储有计算机程序，其中，该计算机程序被处理器执行时实现权利要求1至7所述方法的步骤。
PCT/CN2017/115488 2016-12-15 2017-12-11 一种系统管理方法及装置、存储介质 WO2018108051A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611159444.5A CN106681813B (zh) 2016-12-15 2016-12-15 一种系统管理方法及装置
CN201611159444.5 2016-12-15

Publications (1)

Publication Number Publication Date
WO2018108051A1 true WO2018108051A1 (zh) 2018-06-21

Family

ID=58869336

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/115488 WO2018108051A1 (zh) 2016-12-15 2017-12-11 一种系统管理方法及装置、存储介质

Country Status (2)

Country Link
CN (1) CN106681813B (zh)
WO (1) WO2018108051A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111966410A (zh) * 2020-07-31 2020-11-20 龙芯中科技术有限公司 启动处理方法、装置、电子设备及存储介质
CN113051550A (zh) * 2021-03-30 2021-06-29 深信服科技股份有限公司 一种终端设备及其防护方法、装置和可读存储介质
CN114879942A (zh) * 2022-05-20 2022-08-09 北京宇信科技集团股份有限公司 分布式时间轮分组注册的校验方法、装置、介质和设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106681813B (zh) * 2016-12-15 2020-06-12 腾讯科技（深圳）有限公司 一种系统管理方法及装置
CN107480983B (zh) * 2017-08-29 2018-08-07 上海明心信息科技有限公司 一种防盗手机支付系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104008340A (zh) * 2014-06-09 2014-08-27 北京奇虎科技有限公司 病毒查杀方法及装置
CN104573511A (zh) * 2013-10-15 2015-04-29 联想(北京)有限公司 一种查杀内核型病毒的方法及系统
CN105760773A (zh) * 2015-07-06 2016-07-13 卡巴斯基实验室股份制公司 通过易受攻击的应用控制打开文件的系统和方法
CN106681813A (zh) * 2016-12-15 2017-05-17 腾讯科技（深圳）有限公司 一种系统管理方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1403915A (zh) * 2001-09-10 2003-03-19 英业达股份有限公司 一种计算机防病毒方法及使用这种方法的计算机
CN101408846B (zh) * 2008-11-24 2011-04-13 华为终端有限公司 一种杀毒软件升级的方法及相应的终端和系统
CN103514411A (zh) * 2012-06-25 2014-01-15 联想(北京)有限公司 启动电子设备的方法及电子设备安全系统
CN104503807B (zh) * 2014-12-31 2018-05-25 北京奇虎科技有限公司 启动项的管理方法及装置
CN106326735B (zh) * 2015-07-02 2020-04-03 腾讯科技（深圳）有限公司 防注入的方法和装置
CN105574410B (zh) * 2015-12-15 2018-07-31 北京金山安全软件有限公司 一种应用程序的安全检测方法及装置
CN106203073A (zh) * 2016-07-13 2016-12-07 浪潮电子信息产业股份有限公司 一种基于文件系统过滤驱动的Windows白名单控制方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104573511A (zh) * 2013-10-15 2015-04-29 联想(北京)有限公司 一种查杀内核型病毒的方法及系统
CN104008340A (zh) * 2014-06-09 2014-08-27 北京奇虎科技有限公司 病毒查杀方法及装置
CN105760773A (zh) * 2015-07-06 2016-07-13 卡巴斯基实验室股份制公司 通过易受攻击的应用控制打开文件的系统和方法
CN106681813A (zh) * 2016-12-15 2017-05-17 腾讯科技（深圳）有限公司 一种系统管理方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111966410A (zh) * 2020-07-31 2020-11-20 龙芯中科技术有限公司 启动处理方法、装置、电子设备及存储介质
CN111966410B (zh) * 2020-07-31 2023-11-14 龙芯中科技术股份有限公司 启动处理方法、装置、电子设备及存储介质
CN113051550A (zh) * 2021-03-30 2021-06-29 深信服科技股份有限公司 一种终端设备及其防护方法、装置和可读存储介质
CN114879942A (zh) * 2022-05-20 2022-08-09 北京宇信科技集团股份有限公司 分布式时间轮分组注册的校验方法、装置、介质和设备

Also Published As

Publication number Publication date
CN106681813A (zh) 2017-05-17
CN106681813B (zh) 2020-06-12

Similar Documents

Publication Publication Date Title
WO2018108051A1 (zh) 一种系统管理方法及装置、存储介质
TWI559167B (zh) 統一可延伸韌體介面（ｕｅｆｉ）相容計算裝置和用於在ｕｅｆｉ相容計算裝置中管控一安全啓動之方法
US9459805B2 (en) Backup of volatile memory to persistent storage
US8938811B2 (en) Information processing apparatus, method, program, and integrated circuit
WO2015062389A1 (zh) 一种终端设备卸载系统应用的方法和装置
JP6510070B2 (ja) システム稼働方法およびインテリジェント端末
TW201506788A (zh) 在配有適用統一可延伸韌體介面（ｕｅｆｉ）之韌體之計算裝置中的安全啓動覆蓋技術
US9824220B2 (en) Secure execution of software modules on a computer
CN109964227B (zh) 更新SELinux安全策略的方法及终端
KR20150048136A (ko) 보안 펌웨어 업데이트 기법
US9870490B2 (en) Apparatus and method for an antitheft secure operating system module
US8701195B2 (en) Method for antivirus in a mobile device by using a mobile storage and a system thereof
WO2015058574A1 (zh) 实现扩展应用程序的推送通知的方法及装置
US10140454B1 (en) Systems and methods for restarting computing devices into security-application-configured safe modes
US9146748B1 (en) Systems and methods for injecting drivers into computing systems during restore operations
JP2007164652A (ja) 利用者端末における二次記憶装置の管理方法および利用者端末
US9513928B2 (en) Method of operating multiple operating systems and the electronic device thereof
US8949588B1 (en) Mobile telephone as bootstrap device
RU2009105127A (ru) Изменения состояния среды для изменения функциональных возможностей
US10754931B2 (en) Methods for configuring security restrictions of a data processing system
US8572742B1 (en) Detecting and repairing master boot record infections
US9615193B1 (en) Systems and methods for managing launch activities on a mobile device
US20210240364A1 (en) Storing new settings for write-protected systems on non-write-protected storage
FR2922333A1 (fr) Procede de mise a jour securisee d'un programme a lancement automatique et entite electronique portable le mettant en oeuvre
JP6463170B2 (ja) アプリケーションの利用制限装置および利用制限用プログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17879716

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17879716

Country of ref document: EP

Kind code of ref document: A1