CN103593186A - Method and device for operating registry - Google Patents
Method and device for operating registry Download PDFInfo
- Publication number
- CN103593186A CN103593186A CN201310556281.4A CN201310556281A CN103593186A CN 103593186 A CN103593186 A CN 103593186A CN 201310556281 A CN201310556281 A CN 201310556281A CN 103593186 A CN103593186 A CN 103593186A
- Authority
- CN
- China
- Prior art keywords
- key
- regedit
- item
- coordinate
- interface
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 81
- 230000006870 function Effects 0.000 abstract description 33
- 230000008569 process Effects 0.000 description 28
- 238000010586 diagram Methods 0.000 description 22
- 230000002155 anti-virotic effect Effects 0.000 description 11
- 238000004088 simulation Methods 0.000 description 8
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 208000032826 Ring chromosome 3 syndrome Diseases 0.000 description 3
- 241000700605 Viruses Species 0.000 description 3
- 230000009471 action Effects 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000007796 conventional method Methods 0.000 description 2
- 238000012217 deletion Methods 0.000 description 2
- 230000037430 deletion Effects 0.000 description 2
- 238000009795 derivation Methods 0.000 description 2
- 230000008676 import Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 101150093240 Brd2 gene Proteins 0.000 description 1
- 206010033799 Paralysis Diseases 0.000 description 1
- 101150007742 RING1 gene Proteins 0.000 description 1
- 208000035217 Ring chromosome 1 syndrome Diseases 0.000 description 1
- 208000032825 Ring chromosome 2 syndrome Diseases 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000006378 damage Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
Images
Landscapes
- User Interface Of Digital Computer (AREA)
- Digital Computer Display Output (AREA)
Abstract
The invention discloses a method and device for operating a registry. The method comprises the steps of starting up a registry editor, obtaining a window handle of the registry editor and operating the registry editor by calling interface functions according to the window handle. Due to the facts that the registry editor is started up by calling the interface functions, and the registry is operated by calling the interface functions, the functional legitimacy of operating the registry can be achieved, security operation performed on the registry can be guaranteed, and meanwhile system security is ensured.
Description
Technical field
The present invention relates to computer realm, relate in particular to a kind of method and device of Registry.
Background technology
Registration table is being played the part of a very crucial role aspect the configuration of Windows system and control, it is that the system overall situation arranges and user arranges vivid storage repository, also be the window that Windows carries out the various data in EMS memory structures that body and kernel safeguard, all software information and hardware informations are all managed by registration table.If registration table is damaged for a certain reason, it is abnormal to there is the start-up course of Windows in the lighter, and severe one may cause the paralysis completely of whole Windows system.In order to protect registration table, Windows provides two kinds of conventional methods of operating: a kind of is REGEDIT Regedit.exe, by user interface, operates; Another kind is to provide a large amount of API for the data in user's access and edit the registry.The registration table structure that user sees by REGEDIT is presented to user after reading through REGEDIT, and its disk form is not a simple large file, but one group of HIVE document form.
From Inte180386, for the consideration of safety and stability, this serial CPU can run on ring0～ring3 four different authority levels from high to low, to data, also provides corresponding four protection levels.Wherein ring0 priority is the highest, for operating kernel; Ring1 and ring2 are for operating system service; Ring3 priority is minimum, for application program.Run on the data that more low-level code can not arbitrarily call high level code and access higher level, and the code that only operates in ring0 layer can directly conduct interviews to physical hardware.
Fig. 1 shows the graphical schematic diagram that Windows operating system is utilized CPU runlevel.As shown in Figure 1, Windows has only utilized two runlevels of CPU.One is called as kernel mode, and corresponding 80 * 86 ring0 layer, is the core of operating system, and device driver operates under this pattern exactly; Another is called as user model, i.e. corresponding 80 * 86 ring3 layer, and the user interface part of operating system (Win API) and all user applications all operate in this rank.
Windows does not provide read/write protection to operating in the space of kernel mode component; but be equipped with on the machine of the fail-safe softwares such as antivirus software; if the registration table API calling under kernel mode carries out risky operation to registration table; the securing softwares such as antivirus software will be tackled corresponding registration table API Calls; more likely directly tackle the application program of calling this type of API, to prevent that it from destroying the safety of system.
Registration table is the key position of system, and the startup key assignments that virus and Malware usually can write oneself inside the startup item of registration table reaches the object of self-starting, and some virus also can edit the registry content be carried out Image File Execution Options antivirus software.Conventionally antivirus software can be monitored registration table, or Registry Protection item is protected, and prevents that rogue program or virus from distorting registration table, thus destruction system.The program of calling system API, in the process of operation to the operation of registration table also under antivirus software monitoring.The method of operation of third party software is to carry out registry operations by active calling system api function, but this mode in most of the cases all can touch the prevention policies of fail-safe software, cause third party software by directly interception execution, so just cannot realize automated procedures and remove to simulate some real test environments, carry out Validity Test work.
In prior art, third party software Registry normally adopts the function providing in Windows API to realize, such as RegCreateKey, RegCreateKeyEx, RegSetValueEx, RegDeleteValue etc., by these functions, can read registration table, write, delete, and opening operation.
This by the data in Windows API Access and edit the registry, need calling branch layer by layer, by the registration table API of kernel, called again the driving of file system etc., remove to access the HIVE file on disk, and finally return to the data result of request.If program operates in the environment (such as antivirus software is installed) of protection mechanism, be blocked possibly, can not correctly carry out.And the not all platform of these API is all suitable for, if NT and Windows98 are 32-bit operating systems, but in some api function, do not support Windows98.
There is following major defect in the conventional method that in prior art, third party software Registry is used:
1) portable low.
2) execution validity is low.
3) running environment is limited.
4) under the environment of securing software, there are the various risks of being reported by mistake existing.
And in prior art, have by technological means hook API yet or antivirus software carried out to the behavior of attacking and defending operation, but the comparatively loaded down with trivial details while of its process does not possess versatility and legitimacy.
Therefore a kind of reasonable and general mode is provided, with various antivirus softwares or securing software and deposit in the situation that, can registration table be operated by the registration table API calling under kernel mode, can prevent the interception of the securing softwares such as antivirus software simultaneously, be very important.
Summary of the invention
For solving the above-mentioned problems in the prior art, the invention provides a kind of method and device thereof of Registry.
According to an aspect of the present invention, a kind of method that it provides Registry, comprising:
Start REGEDIT;
Obtain the window handle of described REGEDIT;
According to described window handle, by calling interface function, described REGEDIT is operated.
Alternatively, describedly by calling interface function, registration table is operated and comprised: obtain the menu item of REGEDIT, analog mouse and/or keyboard operate described menu item.
Alternatively, the menu item that obtains REGEDIT comprises:
The all top-level window handles of the system of obtaining, form first window handle list;
In precalculated position analog mouse clicking operation;
In predetermined time interval, all top-level window handles of the system of again obtaining, form Second Window handle list;
Obtain the difference set of first window handle list and Second Window handle list;
From described difference set, obtain the window handle of menu;
According to the window handle of described menu, obtain menu item.
Alternatively, describedly by calling interface function, registration table is operated and comprised: obtain and launch key coordinate and/or key assignments item coordinate, and analog mouse operates.
Alternatively, obtaining expansion key coordinate comprises:
Obtain the interface handle of root key in REGEDIT;
According to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
Alternatively, obtaining key assignments item coordinate comprises:
Analog mouse operation, carries out clicking operation at the coordinate position of the expansion key getting;
The interface handle at an interface, place finds key value;
According to the interface handle at described key assignments item place, from this interface list, travel through and search, and obtain the coordinate of described key assignments item.
Alternatively, described precalculated position comprises the coordinate of key assignments item and/or the menu bar of REGEDIT.
According on the other hand provided by the invention, the device that it provides a kind of Registry, comprising:
Start module, it is for starting REGEDIT;
Acquisition module, it is for obtaining the window handle of described REGEDIT;
Operational module, it is for operating described REGEDIT by calling interface function according to described window handle.
Alternatively, described operational module comprises:
Menu item operational module, it is for obtaining the menu item of REGEDIT, and analog mouse and/or keyboard operate described menu item.
Alternatively, described menu item operational module obtains the menu item on registration table as follows:
The all top-level window handle list of the system of obtaining;
In precalculated position analog mouse clicking operation;
In predetermined time interval, all top-level window handle list of acquisition system;
The difference set of all top-level window handle list that obtain respectively more for the first time and for the second time;
From described difference set, find the window handle of popup menu;
According to the window handle of described menu, obtain corresponding menu item.
Alternatively, described operational module comprises:
Coordinate obtaining module, it launches key coordinate and/or launches key assignments item coordinate for obtaining, and analog mouse operates.
Alternatively, described coordinate obtaining module is obtained as follows and is launched key coordinate:
Obtain the interface handle of root key in REGEDIT;
According to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
Alternatively, coordinate obtaining module is obtained as follows and is launched key assignments item coordinate:
Analog mouse operation, carries out clicking operation at the coordinate position of the expansion key getting;
The interface handle at an interface, place finds key value;
According to the interface handle at described key assignments item place, from this interface list, travel through and search, and obtain the coordinate of described key assignments item.
Alternatively, described precalculated position comprises the coordinate of expansion key assignments item and/or the menu bar of REGEDIT.
The such scheme that the present invention proposes is applicable to any platform, and it,, by imitating user's mouse and keyboard action, to registration table operates on the REGEDIT interface carrying in system.This scheme is with various antivirus softwares or securing software and deposit in the situation that, can realize the behavior that Reality simulation user carries out registry operations, the otherness that can ignore platform, is applicable to the scene in various graphical user interfaces, registration table being operated simultaneously.The present invention can realize the legitimacy of Registry function, can guarantee the safe operation of carrying out to registration table, has also guaranteed security of system simultaneously.
Above-mentioned explanation is only the general introduction of technical solution of the present invention, in order to better understand technological means of the present invention, and can be implemented according to the content of instructions, and for above and other objects of the present invention, feature and advantage can be become apparent, below especially exemplified by the specific embodiment of the present invention, be illustrated.
Accompanying drawing explanation
Fig. 1 is the graphical schematic diagram that Windows operating system is utilized CPU runlevel;
Fig. 2 is the method flow diagram of Registry in the present invention;
Fig. 3 opens wherein a kind of method flow diagram of REGEDIT in Windows system Imitating user manual operation;
Fig. 4 is the method flow diagram that obtains REGEDIT menu item in the present invention;
Fig. 5 is the method flow diagram of newly-built expansion key in the present invention;
Fig. 6 obtains the method flow diagram that launches key coordinate in the present invention;
Fig. 7 is the method flow diagram that obtains key assignments item coordinate in the present invention;
Fig. 8 utilizes the present invention under Windows system, in REGEDIT, to revise the embodiment process flow diagram of key assignments item;
Fig. 9 utilizes the present invention to launch the embodiment process flow diagram of key coordinate obtain REGEDIT under Windows system in;
Figure 10 be utilize the present invention under Windows system, obtain REGEDIT in the embodiment process flow diagram of key assignments item coordinate;
Figure 11 shows the another kind of embodiment process flow diagram that utilizes the present invention to revise key assignments item in REGEDIT under Windows system;
Figure 12 is the modularize structure icon of the device of Registry in the present invention.
Embodiment
For making the object, technical solutions and advantages of the present invention clearer, below in conjunction with specific embodiment, and with reference to accompanying drawing, the present invention is described in more detail.
Fig. 2 shows the method flow diagram of a kind of Registry provided by the invention.As shown in Figure 2, the method comprises:
Step 201: start REGEDIT;
Step 202: the window handle that obtains described REGEDIT;
Step 203: by calling interface function, described REGEDIT is operated according to described window handle.
Step 201: start REGEDIT.
In Windows system, the mode of startup REGEDIT can have multiple, and as REGEDIT is opened in the api interface analog subscriber manual operation providing by system, or the api interface that calling system provides directly starts REGEDIT etc.
Alternatively, if REGEDIT is opened in analog subscriber manual operation, can adjust " RUN " window by the Hotkey of simulation Win+R, and in opening path, input Register.exe, then analog subscriber mouse is clicked " the determining " on this " RUN " window, starts REGEDIT.
Those skilled in the art will appreciate that the function that the graphic user interface to computer system that alleged interface function herein refers to that system or development platform provide operates.
Fig. 3 shows wherein a kind of method flow diagram of opening REGEDIT in Windows system Imitating user manual operation.As shown in Figure 3, the method comprises:
Step 301: recall " RUN " window by calling system api interface " keybd_event " input keyboard pseudo code " VK_LWIN+R ";
Step 302: calling system api interface " FindWindow & EnumChildWindows " is searched the handle " hedit " of the input frame of window " ClassName=Eidt ", obtain the input frame handle on " RUN " window, then calling system api interface " SendMessage " sends message number " WM_SETTEXT " to this handle " hedit ", its parameter is " Register.exe ", i.e. simulating hand operation is to described input frame input " Register.exe ";
Step 303: calling system api interface " FindWindow & EnumChildWindows " is searched the button handle " hbtn " of window " WindowsName=' determines ' ", obtain the confirming button handle on " RUN " window, and calling system api interface " PostMessage " sends BN_CLICKED message to handle " hbtn ", be that simulating hand is clicked confirming button, open REGEDIT.
Certainly in aforesaid way, also can operate by keyboard analog forms such as shortcuts.In addition, in every kind of operating system, the path of opening of REGEDIT is not quite similar, and can operate to start REGEDIT according to actual conditions analog subscriber.
Step 202: the window handle that obtains described REGEDIT.In Windows system, each window of opening has specific handle, by obtaining this handle, can operate on it.
According to the above-mentioned example, by analog subscriber manual operation, open after REGEDIT, can be in a time-out time 5s, poll calling system api interface " FindWindow ", search the handle of window " ClassName=RegisterWindowClass ", search the window handle that obtains Register.exe REGEDIT.
Step 203: by calling interface function, described REGEDIT is operated according to described window handle.Particularly, the operation of registration table is comprised and imports or derive register-file, newly-built, deletion or rename key or key assignments item, revise key assignments item etc.For above-mentioned these operations to registration table, can realize by calling interface function.
Alternatively, describedly by calling interface function, registration table is operated and comprised: obtain the menu item of REGEDIT, analog mouse and/or keyboard operate described menu item.
Fig. 4 shows the method flow diagram that obtains the menu item of REGEDIT in the present invention.As shown in Figure 4, the method for obtaining REGEDIT menu item comprises the steps:
Step 401: all top-level window handles of the system of obtaining, form first window handle list;
Step 402: in precalculated position analog mouse clicking operation;
Step 403: in predetermined time interval, all top-level window handles of the system of again obtaining, form Second Window handle list;
Step 404: the difference set of obtaining first window handle list and Second Window handle list;
Step 405: the window handle that obtains menu from described difference set;
Step 406: obtain menu item according to the window handle of described menu.
Alternatively, described precalculated position comprises the coordinate of key assignments item and/or the menu bar of REGEDIT.For different operations, can select directly on corresponding key assignments item, to simulate right mouse button and select corresponding menu to operate, also can be directly at the enterprising line operate of menu bar of REGEDIT.For example, for importing, derivation, newly-built and rename operation, can select to utilize the menu bar of REGEDIT to operate, and other operations can be chosen in and simulate right mouse button on corresponding key assignments item and select corresponding menu to operate, certainly as derive, two kinds of modes of operation such as newly-built and rename all can.
Take newly-built key and/or key assignments item below obtains the idiographic flow of menu item in REGEDIT as example describes in detail.Fig. 5 shows the method flow diagram of newly-built expansion key in the present invention.As shown in Figure 5, this idiographic flow comprises:
Step 501: all top-level window handle list of obtaining system by system api interface EnumChildWindows, are designated as first window handle list hwndlistl;
Step 502: at preposition place, the api interface mouse_event Transfer Parameters MOUSEEVENTF_RIGHTDOWN & MOUSEEVENTF_RIGHTUP providing by operating system, operates with analog mouse right button.
Step 503: in a time-out time (acquiescence 5s), recursive call system api interface EnumChildWindows obtains current all top-level window handles in a system, is designated as Second Window handle list hwndlist2;
Step 504: the difference set of calculating Second Window handle list hwndlist2 and first window handle list hwndlist1;
Step 505: search the handle of ClassName=#32768 in described difference set, i.e. the window handle hwnd of popup menu item;
Step 506: the window handle hwnd of described popup menu item is converted to menu handle hmenu by system api interface GetMenu;
Step 507: obtain all menu item numbers in this menu according to described menu handle hmenu calling system api interface GetMenuItemCount, and calling system api interface GetMenuItemInfo travels through each menu item, obtain the menu item that its Word message is " newly-built ", and return to the position coordinates (x at this menu item place, y), analog subscriber is placed on this position coordinates (x by cursor of mouse, y), and search popup menu according to the step of introducing above, so recurrence continues to find Word message for the corresponding position coordinates of menu item of " item ";
Step 508: at position coordinates place corresponding to found " item " menu item, analog subscriber mouse clicking operation, and the keyboard operation of analog subscriber, input the title of newly-built key, and simulate carriage return operation, complete the newly-built operation of key.
Seemingly, difference is that what finally to be searched is that Word message is " string value ", " binary value ", " DWORD value ", " many string values " or " extendible string value " etc. for the newly-built operation of key assignments item and the newly-built class of operation of above-mentioned key.
In described step 502, preposition can be father's key coordinate of the key of wanting newly-built in REGEDIT window on interface, the left side, can be also interface, the right that described father's key the is corresponding coordinate of position of anticipating of taking up an official post.
In addition, described newly-built operation can also complete by the System menu obtaining on REGEDIT, be specially: the window handle that obtains REGEDIT, and obtain its menu handle according to described window handle, according to described menu handle, find after the position coordinates of Edit menu item, simulation is placed in this position coordinates place by cursor of mouse, and search popup menu, so recurrence continues to find Word message for the corresponding position coordinates of menu item of " item ", and carries out corresponding newly-built operation.
Alternatively, describedly by calling interface function, registration table is also operated and comprised: obtain and launch key coordinate and/or key assignments item coordinate, and analog mouse operates.
Fig. 6 shows the method flow diagram that obtains expansion key coordinate in the present invention.As shown in Figure 5, obtaining expansion key seat calibration method comprises:
Step 601: the interface handle that obtains root key in REGEDIT;
Step 602: according to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
Fig. 7 shows the method flow diagram that obtains key assignments item coordinate in the present invention.As shown in Figure 7, obtaining key assignments item seat calibration method comprises:
Step 701: analog mouse operation, at the coordinate position of the expansion key getting, carry out clicking operation;
Step 702: the interface handle at an interface, place that finds key value;
Step 703: according to the interface handle at described key assignments item place, travel through and search from this interface list, and obtain the coordinate of described key assignments item.
Take below and revise key assignments item as the example brief description operating process of REGEDIT once.
Fig. 8 shows the detailed embodiment process flow diagram that utilizes the present invention to revise key assignments item under Windows system in REGEDIT.As shown in Figure 8, the method comprises:
Step 801: move REGEDIT Regedit by calling system interface, and obtain the interface handle of Regedit;
Step 802: split target key assignments item path to be modified; Such as revising the key assignments content of the key assignments item LogPixels of key HKEY_CURRENT_CONFIG \ Software \ Fonts, be split into for the first time key HKEY_CURRENT_CONFIG \ Software \ Fonts and key assignments item LogPixels; Key HKEY_CURRENT_CONFIG \ Software \ Fonts is arranged in the tree structure of Regedit interface left-hand component, and key assignments item LogPixels is arranged in the list structure of Regedit interface right-hand component;
Step 803: according to the window handle of Regedit, search the window handle of the root key key of Regedit interface left-hand component;
Step 804: according to the window handle of root key key, call GUI function and search layer by layer from tree root, the coordinate position of locator key, such as the HKEY_CURRENT_CONFIG \ Software \ coordinate position of the sub-key Fonts in Fonts is found in final location;
Step 805: find after the coordinate position of sub-key, analog mouse operation, clicks the coordinate position navigating to, and the key assignments item information that this sub-key is corresponding is presented in the list structure of Regedit interface right part;
Step 806: obtain the interface handle of the root key assignments item of Regedit interface right part, and according to the interface handle of described key assignments item, travel through described list structure, finally locate the coordinate position of key assignments item to be found;
Step 807: on the coordinate position of found key assignments item, analog mouse right button operation, popup menu item, and from described menu item, select the operation of modifying of " modification " menu item.
Be described in detail in below in REGEDIT and obtain and launch key coordinate and the method step that obtains key assignments item coordinate.
Fig. 9 shows and utilizes the present invention to launch the detailed embodiment process flow diagram of key coordinate obtain REGEDIT under Windows system in.As shown in Figure 9, the method comprises:
Step 901: search the window of type SysTreeView32 by system api interface FindWindow, obtain the window handle hwnd at key in REGEDIT (interface, the REGEDIT left side);
Step 902: calling system api interface SendMessage sends message number TVM_GETNEXTITEM to described key window handle hwnd, and its parameter is " TVGN_ROOT ", to obtain the information hitem of root key HKEY_CLASSES_ROOT in REGEDIT;
Step 903: calling system api interface WriteProcessMemory applies for an internal memory rectAddr, and its structure form is TVITEM;
Step 904: calling system api interface SendMessage sends message number TVM_GETNEXTITEM to described key window handle hwnd, parameter is " 1 ", obtain first key information item under described key HKEY_CLASSES_ROOT, and be saved in memory block rectAddr, the information hitem that is simultaneously root key HKEY_CLASSES_ROOT its father node is also saved in memory block rectAddr;
Step 905: calling system api interface ReadProcessMemory reads described first key information item from memory block rectAddr, and this key information comprises text and rect, represents respectively Word message and position coordinates;
Step 906: calling system api interface GetWindowRect sends out message to described key window handle hwnd, to obtain the position coordinates rect of this key window handle hwnd;
Step 907: calculate this first key at the relative coordinate pos of described key window according to the position coordinates rect comprising in position coordinates rect corresponding to described key window handle hwnd and described first key information item;
Step 908: use the same method, the sub-key childHitem of first key of circulation searching item, obtains Word message and the coordinate position of sub-key childHitem, whether identically with given key name mates its Word message;
Step 909: if identical, calling system api interface SendMessage sends out message TVM_EXPAND to described key window handle hwnd, parameter is TVE_EXPAND, this first key is launched, and be presented at middle position, interface, calling system api interface SendMessage sends out message TVM_SELECTITEM to described key window handle hwnd, and parameter is TVGN_CARET, to choose described first key;
Step 910: if not identical, search successively the next key nextitem adjacent with described first key, and make to use the same method, the sub-key of the next key nextitem of circulation searching, until find given key, and obtain the coordinate of this given key.
Figure 10 show utilize the present invention under Windows system, obtain REGEDIT in the detailed embodiment process flow diagram of key assignments item coordinate.As shown in figure 10, the method comprises:
Step 1001: search the window of type SysListView32 by system api interface FindWindow, obtain the window handle hwnd at key assignments item (interface, REGEDIT the right);
Step 1002: the message number that calling system api interface SendMessage sends LVM_GETITEMCOUNT to described key assignments item window handle hwnd, obtain the key assignments item quantity count that described key assignments item window handle hwnd is corresponding, i.e. key assignments item line number;
Step 1003: travel through the information item of the every line unit value item correspondence in described key assignments item window, line number is index, calling system api interface WriteProcessMemory applies for an internal memory rectAddr, its structure form is LVITEM;
Step 1004: calling system api interface SendMessage sends the message number of LVM_GETITEMTEXT to described key assignments item window handle hwnd, parameter is current traveled through key assignments item line number index, obtain the key assignments item information item of current traversal, and be saved in memory block rectAddr;
Step 1005: calling system api interface ReadProcessMemory reads the key assignments item information item of current traversal from memory block rectAddr, the coordinate that this key assignments item information item comprises Word message and this key assignments item correspondence, whether the Word message that this key assignments item information of overmatching item comprises is identical with given key assignments key name;
Step 1006: if not identical, continue traversal and search next line;
Step 1007: if identical, calling system api interface GetWindowRect sends out message to described key assignments item window handle hwnd, obtain the coordinate of described key assignments item window, the relative coordinate of the key assignments item that calculates this current traversal according to the coordinate of the key assignments item of the coordinate of described key assignments item window and current traversal in key assignments item window, as the coordinate of the key assignments item that will obtain.
Figure 11 shows the another kind of embodiment process flow diagram that utilizes the present invention to revise key assignments item in REGEDIT under Windows system.As shown in figure 11, the method comprises:
Step 1101: utilize the definite key assignments item coordinate pos having introduced in method above, transmit MOUSEEVENTF_RIGHTDOWN & MOUSEEVENTF_RIGHTUP parameter simulation right mouse button by system api interface mouse_event and operate;
Step 1102: calling system api interface FindWindow & EnumChildWindows searches the handle hedit of the input frame of window ClassName=" editing character string ", calling system api interface SendMessage sends the message number of WM_SETTEXT to this input frame handle hedit, the content of parameter for revising;
Step 1103: calling system api interface FindWindow & EnumChildWindows searches the button handle hbtn that window WindowsName=" determines ", calling system api interface PostMessage sends BN_CLICKED message to this button handle hbtn, to complete the retouching operation of key assignments item.
Those skilled in the art are to be understood that; above only exemplary introduction a part of embodiment of registry operations method proposed by the invention; wherein only contained a part of mode of operation to registration table; and other can continue to use said method to the concrete operations of registration table; it is expanded or is out of shape, so long as registration table is carried out within corresponding operation is all encompassed in protection scope of the present invention by calling interface function.
From above-mentioned embodiment, can find out, in the such scheme that the present invention proposes, all flow processs are all called interface function registration table are operated, rather than the registry functions that provides of calling system, such as functions such as looking for window, input characters, button click operates registration table.It can be perfectly under the system environments of securing software monitoring; the safe operation of realization to registration table; avoided the executive routine of oneself can not caused the situations such as disabler by securing software wrong report simultaneously; this method is not only limited to the environment to antivirus software or securing software; also be applicable to various Windows homes, can guarantee maximum compatibility simultaneously.
It should be noted that, for embodiment of the method, for simple description, therefore it is all expressed as to a series of combination of actions, but those skilled in the art should know, the application is not subject to the restriction of described sequence of movement, because according to the application, some step can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in instructions all belongs to preferred embodiment, and related action and module might not be that the application is necessary.
Figure 12 shows the modularize structure icon of the device of a kind of Registry that the present invention proposes.As shown in figure 12, this device comprises:
Start module 1201, it is for starting REGEDIT;
Acquisition module 1202, it is for obtaining the window handle of described REGEDIT;
Operational module 1203, it is for operating described REGEDIT by calling interface function according to described window handle.
The function that the Windows operating system of still take below realizes as the included above-mentioned modules of device of the Registry of example detailed description the present invention proposition, those skilled in the art should know, the method is not limited only to Windows system, other graphic interface system that it is also applicable to operate registration table by REGEDIT.
Start module 1201, it is for starting REGEDIT.
In Windows system, the mode of startup REGEDIT can have multiple, and as REGEDIT is opened in the api interface analog subscriber manual operation providing by system, or the api interface that calling system provides directly starts REGEDIT etc.
Alternatively, if REGEDIT is opened in analog subscriber manual operation, can adjust " RUN " window by the Hotkey of simulation Win+R, and in opening path, input Register.exe, then analog subscriber mouse is clicked " the determining " on this " RUN " window, starts REGEDIT.
Start the startup that module 1201 can complete registration editing machine in several ways, wherein as shown in Figure 3 a kind of, it can first recall " RUN " window by transferring system interface, then calling system interface is searched and is obtained input frame handle on " RUN " window, and calling system interface is to the start-up routine title " Register.exe " of described input frame handle input REGEDIT, and analog mouse is clicked " determining " button on " RUN " window, whole process is all to call the mode that interface functional simulation user starts registration table to start described REGEDIT.Owing to having described the content shown in Fig. 3 in the above in detail, at this, just repeat no more.
Certainly in aforesaid way, also can operate by keyboard analog forms such as shortcuts.In addition, in every kind of operating system, the path of opening of REGEDIT is not quite similar, and can operate to start REGEDIT according to actual conditions analog subscriber.
Acquisition module 1202, obtains the window handle of described REGEDIT.In Windows system, each window of opening has specific handle, by obtaining this handle, calls corresponding interface function and can operate on it.
According to the above-mentioned example, by analog subscriber manual operation, open after REGEDIT, can be in a time-out time 5s, poll calling system api interface " FindWindow ", search the handle of window " ClassName=RegisterWindowClass ", search the window handle that obtains Register.exe REGEDIT.
Operational module 1203, it operates described REGEDIT by calling interface function according to described window handle.Particularly, the operation of registration table is comprised and imports or derive register-file, newly-built, deletion or rename key or key assignments item, revise key assignments item etc.For above-mentioned these operations to registration table, can realize by calling interface function.
Alternatively, described operational module comprises menu item operational module, and it is for obtaining the menu item of REGEDIT, and analog mouse and/or keyboard operate described menu item.
The menu item specific implementation process that described menu item operational module obtains REGEDIT is as follows:
The all top-level window handles of the system of obtaining, form first window handle list;
In precalculated position analog mouse clicking operation;
In predetermined time interval, all top-level window handles of the system of again obtaining, form Second Window handle list;
Obtain the difference set of first window handle list and Second Window handle list;
From described difference set, obtain the window handle of menu;
According to the window handle of described menu, obtain menu item.
Alternatively, described precalculated position comprises the coordinate of key assignments item and/or the menu bar of REGEDIT.For different operations, can select directly on corresponding key assignments item, to simulate right mouse button and select corresponding menu to operate, also can be directly at the enterprising line operate of menu bar of REGEDIT.For example, for importing, derivation, newly-built and rename operation, can select to utilize the menu bar of REGEDIT to operate, and other operations can be chosen in and simulate right mouse button on corresponding key assignments item and select corresponding menu to operate, certainly as derive, two kinds of modes of operation such as newly-built and rename all can.
Take newly-built key and/or key assignments item below describes the idiographic flow that menu item operational module obtains menu item in REGEDIT in detail as example.
First, all top-level window handle list that this module is obtained system by system api interface EnumChildWindows, are designated as first window handle list hwndlist1; At preposition place, the api interface mouse_event Transfer Parameters MOUSEEVENTF_RIGHTDOWN & MOUSEEVENTF_RIGHTUP providing by operating system, operates with analog mouse right button.
Secondly, in a time-out time (acquiescence 5s), recursive call system api interface EnumChildWindows obtains current all top-level window handles in a system, is designated as Second Window handle list hwndlist2; Calculate the difference set of Second Window handle list hwndlist2 and first window handle list hwndlist1; In described difference set, search the handle of ClassName=#32768, i.e. the window handle hwnd of popup menu item;
Afterwards, by system api interface GetMenu, the window handle hwnd of described popup menu item is converted to menu handle hmenu; According to described menu handle hmenu calling system api interface GetMenuItemCount, obtain all menu item numbers in this menu, and calling system api interface GetMenuItemInfo travels through each menu item, obtain the menu item that its Word message is " newly-built ", and return to the position coordinates (x at this menu item place, y), analog subscriber is placed on this position coordinates (x by cursor of mouse, y), and search popup menu according to the step of introducing above, so recurrence continues to find Word message for the corresponding position coordinates of menu item of " item ";
Finally, at position coordinates place corresponding to found " item " menu item, analog subscriber mouse clicking operation, and the keyboard operation of analog subscriber, input the title of newly-built key, and simulate carriage return operation, completes the newly-built operation of key.
Seemingly, difference is that what finally to be searched is that Word message is " string value ", " binary value ", " DWORD value ", " many string values " or " extendible string value " etc. for the newly-built operation of key assignments item and the newly-built class of operation of above-mentioned key.
Above-mentioned preposition can be father's key coordinate of the key of wanting newly-built in REGEDIT window on interface, the left side, can be also interface, the right that described father's key the is corresponding coordinate of position of anticipating of taking up an official post.
In addition, described newly-built operation can also complete by the System menu obtaining on REGEDIT, be specially: the window handle that obtains REGEDIT, and obtain its menu handle according to described window handle, according to described menu handle, find after the position coordinates of Edit menu item, simulation is placed in this position coordinates place by cursor of mouse, and search popup menu, so recurrence continues to find Word message for the corresponding position coordinates of menu item of " item ", and carries out corresponding newly-built operation.
Alternatively, described operational module also comprises: coordinate obtaining module, it launches key coordinate and/or launch key assignments item coordinate for obtaining, and analog mouse operates.
Wherein, coordinate obtaining module obtains that to launch the specific implementation process of key coordinate as follows:
First, obtain the interface handle of root key in REGEDIT;
Secondly, according to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
Wherein, to obtain the specific implementation process of key assignments item coordinate as follows for described coordinate obtaining module:
First, analog mouse operation, carries out clicking operation at the coordinate position of the expansion key getting;
Secondly, the interface handle at an interface, place that finds key value;
Finally, according to the interface handle at described key assignments item place, from this interface list, travel through and search, and obtain the coordinate of described key assignments item.
The modification key assignments item of take is below the example brief description specific implementation process that once device of this Registry operates REGEDIT.
First, start module by calling system interface operation REGEDIT Regedit;
Secondly, described acquisition module obtains the interface handle of Regedit;
Again, described operational module splits target key assignments item path to be modified; Such as revising the key assignments content of the key assignments item LogPixels of key HKEY_CURRENT_CONFIG \ Software \ Fonts, be split into for the first time key HKEY_CURRENT_CONFIG \ Software \ Fonts and key assignments item LogPixels; Key HKEY_CURRENT_CONFIG \ Software \ Fonts is arranged in the tree structure of Regedit interface left-hand component, and key assignments item LogPixels is arranged in the list structure of Regedit interface right-hand component;
Afterwards, operational module, according to the window handle of Regedit, is searched the window handle of the root key key of Regedit interface left-hand component; And according to the window handle of root key key, call GUI function and search layer by layer from tree root, the coordinate position of locator key, such as the HKEY_CURRENT_CONFIG \ Software \ coordinate position of the sub-key Fonts in Fonts is found in final location; After finding the coordinate position of sub-key, analog mouse operation, clicks the coordinate position navigating to, and the key assignments item information that this sub-key is corresponding is presented in the list structure of Regedit interface right part;
Finally, obtain the interface handle of the root key assignments item of Regedit interface right part, and according to the interface handle of described key assignments item, travel through described list structure, finally locate the coordinate position of key assignments item to be found; On the coordinate position of found key assignments item, analog mouse right button operation, popup menu item, and from described menu item, select the operation of modifying of " modification " menu item.
The device that describes the Registry proposing according to the present invention below in detail obtains the specific implementation process of launching key coordinate and obtaining key assignments item coordinate in REGEDIT.
Obtain that in REGEDIT, to launch the specific implementation process of key coordinate as follows:
First, operational module is searched the window of type SysTreeView32 by system api interface FindWindow, obtains the window handle hwnd at key in REGEDIT (interface, the REGEDIT left side); Calling system api interface SendMessage sends message number TVM_GETNEXTITEM to described key window handle hwnd, and its parameter is " TVGN_ROOT ", to obtain the information hitem of root key HKEY_CLASSES_ROOT in REGEDIT; Calling system api interface WriteProcessMemory applies for an internal memory rectAddr, and its structure form is TVITEM;
Secondly, operational module calling system api interface SendMessage sends message number TVM_GETNEXTITEM to described key window handle hwnd, parameter is " 1 ", obtain first key information item under described key HKEY_CLASSES_ROOT, and be saved in memory block rectAddr, the information hitem that is simultaneously root key HKEY_CLASSES_ROOT its father node is also saved in memory block rectAddr; Calling system api interface ReadProcessMemory reads described first key information item from memory block rectAddr, and this key information comprises text and rect, represents respectively Word message and position coordinates;
Afterwards, operational module calling system api interface GetWindowRect sends out message to described key window handle hwnd, to obtain the position coordinates rect of this key window handle hwnd; According to the position coordinates rect comprising in position coordinates rect corresponding to described key window handle hwnd and described first key information item, calculate this first key at the relative coordinate pos of described key window;
Finally, operational module uses the same method, and the sub-key childHitem of first key of circulation searching item obtains Word message and the coordinate position of sub-key childHitem, whether identically with given key name mates its Word message;
If identical, calling system api interface SendMessage sends out message TVM_EXPAND to described key window handle hwnd, parameter is TVE_EXPAND, this first key is launched, and be presented at middle position, interface, calling system api interface SendMessage sends out message TVM_SELECTITEM to described key window handle hwnd, and parameter is TVGN_CARET, to choose described first key;
If not identical, search successively the next key nextitem adjacent with described first key, and make to use the same method, the sub-key of the next key nextitem of circulation searching, until find given key, and obtain the coordinate of this given key.
The specific implementation process of obtaining key assignments item coordinate in REGEDIT is as follows:
First, operational module is searched the window of type SysListView32 by system api interface FindWindow, obtains the window handle hwnd at key assignments item (interface, REGEDIT the right); And calling system api interface SendMessage is to the message number of described key assignments item window handle hwnd transmission LVM_GETITEMCOUNT, obtains the key assignments item quantity count that described key assignments item window handle hwnd is corresponding, i.e. key assignments item line number;
Secondly, operational module travels through the information item of the every line unit value item correspondence in described key assignments item window, and line number is index, and calling system api interface WriteProcessMemory applies for an internal memory rectAddr, and its structure form is LVITEM; Calling system api interface SendMessage sends the message number of LVM_GETITEMTEXT to described key assignments item window handle hwnd, parameter is current traveled through key assignments item line number index, obtain the key assignments item information item of current traversal, and be saved in memory block rectAddr;
Finally, operational module calling system api interface ReadProcessMemory reads the key assignments item information item of current traversal from memory block rectAddr, the coordinate that this key assignments item information item comprises Word message and this key assignments item correspondence, whether the Word message that this key assignments item information of overmatching item comprises is identical with given key assignments key name;
If not identical, continue traversal and search next line;
If identical, calling system api interface GetWindowRect sends out message to described key assignments item window handle hwnd, obtain the coordinate of described key assignments item window, the relative coordinate of the key assignments item that calculates this current traversal according to the coordinate of the key assignments item of the coordinate of described key assignments item window and current traversal in key assignments item window, as the coordinate of the key assignments item that will obtain.
The specific implementation process of revising key assignments item under Windows operating system in REGEDIT is as follows:
First, utilize the definite key assignments item coordinate pos having introduced in method above, operational module transmits MOUSEEVENTF_RIGHTDOWN & MOUSEEVENTF_RIGHTUP parameter simulation right mouse button by system api interface mouse_event and operates;
Secondly, operational module calling system api interface FindWindow & EnumChildWindows searches the handle hedit of the input frame of window ClassName=" editing character string ", calling system api interface SendMessage sends the message number of WM_SETTEXT to this input frame handle hedit, the content of parameter for revising;
Finally, operational module calling system api interface FindWindow & EnumChildWindows searches the button handle hbtn that window WindowsName=" determines ", calling system api interface PostMessage sends BN_CLICKED message to this button handle hbtn, to complete the retouching operation of key assignments item.
Specific implementation process described above is all that to start the window handle that module and acquisition module started REGEDIT and obtained REGEDIT be prerequisite, and above only the introduction of exemplary type a part of operating process of registration table, those skilled in the art should draw by the flow process of introducing other operating processes of registration table above beyond all doubtly.
Because described device embodiment is substantially corresponding to the embodiment of the method shown in earlier figures 1, therefore not detailed part in the description of the present embodiment can, referring to the related description in previous embodiment, just not repeat at this.
The device of c11, Registry as claimed in claim 8, is characterized in that, described operational module comprises:
Coordinate obtaining module, it launches key coordinate and/or launches key assignments item coordinate for obtaining, and analog mouse operates.
The device of c12, Registry as claimed in claim 11, is characterized in that, described coordinate obtaining module is obtained as follows and launched key coordinate:
Obtain the interface handle of root key in REGEDIT;
According to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
The device of c13, the Registry as described in claim 11 or 13, is characterized in that, coordinate obtaining module is obtained as follows and launched key assignments item coordinate:
Analog mouse operation, carries out clicking operation at the coordinate position of the expansion key getting;
The interface handle at an interface, place finds key value;
According to the interface handle at described key assignments item place, from this interface list, travel through and search, and obtain the coordinate of described key assignments item.
The device of c14, Registry as claimed in claim 10, is characterized in that, described precalculated position comprises launches the coordinate of key assignments item and/or the menu bar of REGEDIT.
The such scheme that the present invention proposes can be used in numerous general or special purpose computingasystem environment or configuration.For example: personal computer, server computer, handheld device or portable set, plate equipment, multicomputer system, the system based on microprocessor, Set Top Box, programmable consumer-elcetronics devices, network PC, small-size computer, mainframe computer, comprise distributed computing environment of above any system or equipment etc.
The present invention can describe in the general context of the computer executable instructions of being carried out by computing machine, for example program module.Usually, program module comprises the routine carrying out particular task or realize particular abstract data type, program, object, assembly, data structure etc.Also can in distributed computing environment, put into practice the application, in these distributed computing environment, by the teleprocessing equipment being connected by communication network, be executed the task.In distributed computing environment, program module can be arranged in the local and remote computer-readable storage medium that comprises memory device.
Finally, also it should be noted that, in this article, relational terms such as the first and second grades is only used for an entity or operation to separate with another entity or operational zone, and not necessarily requires or imply and between these entities or operation, have the relation of any this reality or sequentially.And, term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability, thereby the process, method, article or the equipment that make to comprise a series of key elements not only comprise those key elements, but also comprise other key elements of clearly not listing, or be also included as the intrinsic key element of this process, method, article or equipment.The in the situation that of more restrictions not, the key element being limited by statement " comprising ... ", and be not precluded within process, method, article or the equipment that comprises described key element and also have other identical element.
Above-described specific embodiment; object of the present invention, technical scheme and beneficial effect are further described; institute is understood that; the foregoing is only specific embodiments of the invention; be not limited to the present invention; within the spirit and principles in the present invention all, any modification of making, be equal to replacement, improvement etc., within all should being included in protection scope of the present invention.
Claims (10)
1. a method for Registry, is characterized in that, comprising:
Start REGEDIT;
Obtain the window handle of described REGEDIT;
According to described window handle, by calling interface function, described REGEDIT is operated.
2. the method for Registry as claimed in claim 1, it is characterized in that, describedly by calling interface function, described REGEDIT is operated and comprised: obtain the menu item of REGEDIT, analog mouse and/or keyboard operate described menu item.
3. the method for Registry as claimed in claim 2, is characterized in that, the menu item that obtains REGEDIT comprises:
The all top-level window handles of the system of obtaining, form first window handle list;
In precalculated position analog mouse clicking operation;
In predetermined time interval, all top-level window handles of the system of again obtaining, form Second Window handle list;
Obtain the difference set of first window handle list and Second Window handle list;
From described difference set, obtain the window handle of menu;
According to the window handle of described menu, obtain menu item.
4. the method for Registry as claimed in claim 1, is characterized in that, describedly by calling interface function, described REGEDIT is operated and is comprised: obtain and launch key coordinate and/or key assignments item coordinate, and analog mouse operates.
5. the method for Registry as claimed in claim 4, is characterized in that, obtains expansion key coordinate and comprises:
Obtain the interface handle of root key in REGEDIT;
According to the interface handle of root key, call interface function and successively search from tree root, obtain the coordinate that launches key.
6. the method for the Registry as described in claim 4 or 5, is characterized in that, obtains key assignments item coordinate and comprises:
Analog mouse operation, carries out clicking operation at the coordinate position of the expansion key getting;
The interface handle at an interface, place finds key value;
According to the interface handle at described key assignments item place, from this interface list, travel through and search, and obtain the coordinate of described key assignments item.
7. the method for Registry as claimed in claim 3, is characterized in that, described precalculated position comprises the coordinate of key assignments item and/or the menu bar of REGEDIT.
8. a device for Registry, is characterized in that, comprising:
Start module, it is for starting REGEDIT;
Acquisition module, it is for obtaining the window handle of described REGEDIT;
Operational module, it is for operating described REGEDIT by calling interface function according to described window handle.
9. the device of Registry as claimed in claim 8, is characterized in that, described operational module comprises:
Menu item operational module, it is for obtaining the menu item of REGEDIT, and analog mouse and/or keyboard operate described menu item.
10. the device of Registry as claimed in claim 9, is characterized in that, described menu item operational module obtains the menu item on registration table as follows:
The all top-level window handle list of the system of obtaining;
In precalculated position analog mouse clicking operation;
In predetermined time interval, all top-level window handle list of acquisition system;
The difference set of all top-level window handle list that obtain respectively more for the first time and for the second time;
From described difference set, find the window handle of popup menu;
According to the window handle of described menu, obtain corresponding menu item.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310556281.4A CN103593186B (en) | 2013-11-11 | 2013-11-11 | A kind of method and device of Registry |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310556281.4A CN103593186B (en) | 2013-11-11 | 2013-11-11 | A kind of method and device of Registry |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103593186A true CN103593186A (en) | 2014-02-19 |
| CN103593186B CN103593186B (en) | 2017-10-27 |
Family
ID=50083346
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310556281.4A Expired - Fee Related CN103593186B (en) | 2013-11-11 | 2013-11-11 | A kind of method and device of Registry |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103593186B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104601543A (en) * | 2014-12-05 | 2015-05-06 | 百度在线网络技术（北京）有限公司 | Method and system for identifying software tampered browser home page |
| CN105631318A (en) * | 2015-12-23 | 2016-06-01 | 北京金山安全软件有限公司 | Method and device for acquiring registry key values |
| CN107368380A (en) * | 2017-09-05 | 2017-11-21 | 深圳市兆驰数码科技股份有限公司 | The method for sending message under Windows systems to any window |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040205369A1 (en) * | 2003-04-10 | 2004-10-14 | International Business Machines Corporation | Method system and synchronization circuit for providing hardware component access to a set of data values without restriction |
| CN201607688U (en) * | 2007-08-03 | 2010-10-13 | 发明技术解决方案有限公司 | Computer power-saving equipment and computer power-saving system |
| CN102830991A (en) * | 2012-07-31 | 2012-12-19 | 北京奇虎科技有限公司 | Methods and devices used for realizing document collection and automatic installation of software package |
| CN102902919A (en) * | 2012-08-30 | 2013-01-30 | 北京奇虎科技有限公司 | Method, device and system for identifying and processing suspicious practices |
-
2013
- 2013-11-11 CN CN201310556281.4A patent/CN103593186B/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040205369A1 (en) * | 2003-04-10 | 2004-10-14 | International Business Machines Corporation | Method system and synchronization circuit for providing hardware component access to a set of data values without restriction |
| CN201607688U (en) * | 2007-08-03 | 2010-10-13 | 发明技术解决方案有限公司 | Computer power-saving equipment and computer power-saving system |
| CN102830991A (en) * | 2012-07-31 | 2012-12-19 | 北京奇虎科技有限公司 | Methods and devices used for realizing document collection and automatic installation of software package |
| CN102902919A (en) * | 2012-08-30 | 2013-01-30 | 北京奇虎科技有限公司 | Method, device and system for identifying and processing suspicious practices |
Non-Patent Citations (1)
| Title |
|---|
| 张楠: "打印机驱动自动安装***的设计及实现", 《中国优秀硕士学位论文全文数据库（电子期刊）》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104601543A (en) * | 2014-12-05 | 2015-05-06 | 百度在线网络技术（北京）有限公司 | Method and system for identifying software tampered browser home page |
| CN105631318A (en) * | 2015-12-23 | 2016-06-01 | 北京金山安全软件有限公司 | Method and device for acquiring registry key values |
| CN105631318B (en) * | 2015-12-23 | 2019-04-05 | 珠海豹趣科技有限公司 | A kind of acquisition methods and device of registration table key assignments |
| CN107368380A (en) * | 2017-09-05 | 2017-11-21 | 深圳市兆驰数码科技股份有限公司 | The method for sending message under Windows systems to any window |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103593186B (en) | 2017-10-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Ligh et al. | The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory | |
| CN107832619B (en) | Automatic application program vulnerability mining system and method under Android platform | |
| US10866791B2 (en) | Transforming non-Apex code to Apex code | |
| KR102310649B1 (en) | Scrubber to remove personally identifiable information | |
| CN104598809B (en) | Program monitoring method and defending method thereof, as well as relevant device | |
| CN110851114A (en) | Business system development method and device, electronic equipment and storage medium | |
| CN106569783B (en) | Method and device for executing task script | |
| EP3336690A1 (en) | Extensible data transformation authoring and validation system | |
| US20050204343A1 (en) | Automated test system for testing an application running in a windows-based environment and related methods | |
| Mercaldo et al. | Hey malware, i can find you! | |
| CN108647061B (en) | Calling method and device of system hiding method and computing equipment | |
| US11954006B1 (en) | Systems and methods for locally streaming applications in a computing system | |
| US9038019B2 (en) | Paige control for enterprise mobile applications | |
| Margosis et al. | Windows Sysinternals administrator's reference | |
| US20190026164A1 (en) | Method and system for invoking event-based package module | |
| Fu et al. | Buffer overflow exploit and defensive techniques | |
| CN103593186A (en) | Method and device for operating registry | |
| US10241890B2 (en) | Hybrid code modification in intermediate language for software application | |
| CN102819717A (en) | Method and device for carrying out protection processing on file | |
| Pecka et al. | Privilege escalation attack scenarios on the devops pipeline within a kubernetes environment | |
| CN101950339A (en) | Security protection method and system of computer | |
| CN113127906A (en) | Unified authority management platform, method and storage medium based on C/S architecture | |
| CN110764745B (en) | Variable transmission and collection method, device and computer readable storage medium | |
| CN113434217B (en) | Vulnerability scanning method, vulnerability scanning device, computer equipment and medium | |
| CN107015787B (en) | Method and device for designing interactive application framework |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220729 Address after: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |
|
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20171027 |