CN105354498A - Operation method of registry, related device and equipment - Google Patents
Operation method of registry, related device and equipment Download PDFInfo
- Publication number
- CN105354498A CN105354498A CN201510731156.1A CN201510731156A CN105354498A CN 105354498 A CN105354498 A CN 105354498A CN 201510731156 A CN201510731156 A CN 201510731156A CN 105354498 A CN105354498 A CN 105354498A
- Authority
- CN
- China
- Prior art keywords
- function
- registration table
- operating system
- registry
- derive
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
- G06F2221/033—Test or assess software
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Stored Programmes (AREA)
Abstract
The embodiment of the invention provides an operation method of a registry, a related device and equipment, wherein the operation method of the registry comprises the following steps: acquiring registry operation required by a target application program on a registry; determining a registry kernel operation function which is not exported by an operating system, wherein the registry kernel operation function which is not exported corresponds to the registry operation; acquiring a function address of a registry kernel operation function which is not derived by the operating system; and calling a registry kernel operating function which is not derived by the operating system according to the function address. When the target application program needs to perform registry operation on the registry, the registry operation is completed by directly calling the address of the registry kernel operation function which is not derived by the operating system finally completing the registry operation, and because no intermediate calling function which can be utilized by a callback function or a hook function is used, the influence of the callback function or the hook function on the registry operation is avoided, and the safety of the operating system is improved.
Description
Technical field
The present invention relates to field of computer technology, be specifically related to a kind of method of operating of registration table and relevant apparatus and equipment.
Background technology
At present when carrying out registry operations, the registry operations function that application program is derived by call operation system performs registry operations, the registry operations function that operating system derives shields the operating process of bottom to application program, particularly, when carrying out registry operations at present, only need the registry operations function that call operation system derives, operating system is that the registry operations function of each derivation pre-sets and calls path, call path and generally include the registry operations function that multiple intermediate function and the actual operating system completing registry operations do not derive, invoked procedure is completed automatically by operating system.The kernel operations function that operating system corresponding to different registry operations does not derive is different.The kernel operations function operation system do not derived due to operating system does not provide calling interface to user, the function address of the kernel operations function namely not providing operating system not derive, so application program cannot directly be called.
For registration table constructive process, when destination application needs to create registration table, destination application calls the RegCreateKey function in the dynamic link library kernel32.dll of application layer; The NtCreateKey function of dynamic link library ntdll.dll in RegCreateKey function call application layer; The NtCreateKey function of the NtCreateKey function call kernel of dynamic link library ntdll.dll; The kernel operations function CmCreateKey that the NtCreateKey function call operating system of kernel does not derive, completes registration table by kernel operations function CmCreateKey and creates.
It should be noted that: if there is registration table call back function in operating system, then the NtCreateKey function of kernel is before calling the CmCreateKey function of kernel, the registration table call back function existed in the first call operation system of meeting, if registration table call back function returns failure, then the NtCreateKey function of kernel can not call the CmCreateKey function of kernel again, and it is unsuccessful that this can cause registration table to create.
Similarly, Hook Function hook of the prior art can monitor the establishment message of process in specified window, and after specific message sends, before arriving target window, Hook Function can first catch this message, that is Hook Function first obtains control.At this moment Hook Function can process process (namely changing) this message, also can not deal with and continue to transmit this message, can also force the transmission of end.
Therefore, the failure when existence of call back function and Hook Function may cause destination application to carry out registry operations.For example, all need to carry out registry operations when antivirus software starts and when antivirus software processes Malware, Malware is in order to stop the associative operation of antivirus software, the registry operations function can derived in antivirus software call operation system carries out in the process of registry operations, before the registration table kernel operations function of not deriving in final call operation system completes the associative operation of registration table, use call back function or Hook Function termination antivirus software complete the associative operation to registration table, will the safety of operating system are on the hazard like this.
Summary of the invention
The embodiment of the present invention provides a kind of method of operating of registration table and relevant apparatus and equipment, and the registry operations function of not deriving to direct call operation system completes the operation of registration table, improves the security of operating system under special scenes.
Embodiment of the present invention first aspect provides a kind of method of operating of registration table, comprising:
Obtain the registry operations that destination application needs to carry out registration table;
The registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations;
Obtain the function address of the registration table kernel operations function that described operating system does not derive;
The registration table kernel operations function that described operating system do not derive is called according to described function address.
In conjunction with first aspect, in the first possible embodiment of first aspect, the function address of the registration table kernel operations function that the described operating system of described acquisition does not derive, comprising:
The function address of the registration table kernel operations function that described operating system does not derive is obtained according to address mapping relation table;
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
In conjunction with the first possible embodiment of first aspect, in the embodiment that the second of first aspect is possible, before the function address of the kernel operations function of not deriving in the described operating system of described acquisition, described method also comprises: set up address mapping relation by stack backtrack mechanism.
In conjunction with first aspect, in the third possible embodiment of first aspect, described registry operations comprises: create registration table, delete registration table, delete registration table key assignments, edit the registry key assignments or enumerate Registry key.
In conjunction with first aspect, in the 4th kind of possible embodiment of first aspect, the registration table kernel operations function that described operating system does not derive comprises: the registration table kernel operations function that function name is not derived with the operating system of Key ending with Cm beginning.
In conjunction with the 4th kind of possible embodiment of first aspect, in the 5th kind of possible embodiment of first aspect, the registration table kernel operations function that described operating system does not derive comprises: CmCreateKey function, CmDeleteKey function, CmDeleteValueKey function, CmSetValueKey function or CmEnumerateKey function.
In conjunction with first aspect, in the 6th kind of possible embodiment of first aspect, the registration table kernel operations function that described determination operation system does not derive, comprising:
According to the registration table kernel operations function that the first mapping relations table acquisition operating system corresponding with described registry operations does not derive;
Wherein, described first mapping relations table comprises: with N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function that the operating system corresponding with described registry operations title does not derive, described N be greater than or equal to 1 integer.
In conjunction with first aspect or the first possible embodiment of first aspect or the possible embodiment of the second of first aspect or the 5th kind of possible embodiment of the third possible embodiment of first aspect or the 4th kind of possible embodiment of first aspect or first aspect or the 6th kind of possible embodiment of first aspect, in the 7th kind of possible embodiment of first aspect, described destination application comprises antivirus software.
Embodiment of the present invention second aspect provides a kind of operating means of registration table, comprising:
First acquiring unit, for obtaining the registry operations that destination application needs to carry out registration table;
First determining unit, for the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations;
Second acquisition unit, the function address of the registration table kernel operations function that the described operating system determined for obtaining described first determining unit does not derive;
Call unit, the described function address for obtaining according to described second acquisition unit calls the registration table kernel operations function that described operating system does not derive.
In conjunction with second aspect, in the first possible embodiment of second aspect, described second acquisition unit specifically for, obtain the function address of the registration table kernel operations function that described operating system does not derive according to address mapping relation table;
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
In conjunction with the first possible embodiment of second aspect, in the embodiment that the second of second aspect is possible, described device also comprises:
Set up unit, for setting up address mapping relation by stack backtrack mechanism.
In conjunction with second aspect, in the third possible embodiment of second aspect,
Described registry operations comprises: create registration table, delete registration table, delete registration table key assignments, edit the registry key assignments or enumerate Registry key.
In conjunction with second aspect, in the 4th kind of possible embodiment of second aspect,
The registration table kernel operations function that described operating system does not derive is the registration table kernel operations function that title does not derive with the operating system of Key ending with Cm beginning.
In conjunction with the 4th kind of possible embodiment of second aspect, in the 5th kind of possible embodiment of second aspect, the registration table kernel operations function that described operating system does not derive comprises: CmCreateKey function, CmDeleteKey function, CmDeleteValueKey function, CmSetValueKey function or CmEnumerateKey function.
In conjunction with second aspect, in the 6th kind of possible embodiment of second aspect, described first determining unit specifically for, obtain the registration table kernel operations function of not deriving with described operating system according to the first mapping relations table; Wherein, described first mapping relations table comprises: with N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function that the operating system corresponding with described registry operations title does not derive, described N be greater than or equal to 1 integer.
In conjunction with second aspect or the first possible embodiment of second aspect or the possible embodiment of the second of second aspect or the 5th kind of possible embodiment of the third possible embodiment of second aspect or the 4th kind of possible embodiment of second aspect or second aspect or the 6th kind of possible embodiment of second aspect, in the 7th kind of possible embodiment of second aspect, described destination application comprises antivirus software.
The embodiment of the present invention third aspect provides a kind of operating equipment of registration table, comprising: processor, storer and bus;
Described processor and described storer are connected by described bus and complete mutual communication;
Described storer stores executable programs code;
Described processor runs the program corresponding with described executable program code by reading the executable program code stored in described storer, for the method for operating performing a kind of registration table; Wherein, the method for operating of described registration table comprises:
Obtain the registry operations that destination application needs to carry out registration table;
The registration table kernel operations function that determination operation system does not derive, described registration table kernel operations function of not deriving is corresponding with described registry operations;
Obtain the function address of the registration table kernel operations function that described operating system does not derive;
The registration table kernel operations function that described operating system do not derive is called according to described function address.
The technical scheme that the embodiment of the present invention provides, when destination application needs to operate registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
Accompanying drawing explanation
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, be briefly described to the accompanying drawing used required in embodiment or description of the prior art below, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is the schematic flow sheet of the method for operating of a kind of registration table that the embodiment of the present invention provides;
Fig. 2 is the schematic flow sheet of the method for operating of the another kind of registration table that the embodiment of the present invention provides;
Fig. 3 is the schematic flow sheet of the method for operating of the another kind of registration table that the embodiment of the present invention provides;
Fig. 4 is the structural representation of the operating means of a kind of registration table that the embodiment of the present invention provides;
Fig. 5 is the structural representation of the operating means of the another kind of registration table that the embodiment of the present invention provides;
Fig. 6 is the structural representation of the operating equipment of a kind of registration table that the embodiment of the present invention provides.
Embodiment
The embodiment of the present invention provides a kind of method of operating of registration table and relevant apparatus and equipment, and the registry operations function of not deriving to direct call operation system has carried out the operation to registration table, improves the security of operating system under special scenes.
The present invention program is understood better in order to make those skilled in the art person, below in conjunction with the accompanying drawing in the embodiment of the present invention, technical scheme in the embodiment of the present invention is clearly and completely described, obviously, described embodiment is only the embodiment of a part of the present invention, instead of whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtained under creative work prerequisite, should belong to the scope of protection of the invention.
Below be described in detail respectively.
Term " first ", " second ", " the 3rd " and " the 4th " etc. in instructions of the present invention and claims and above-mentioned accompanying drawing are for distinguishing different object, instead of for describing particular order.In addition, term " comprises " and " having " and their any distortion, and intention is to cover not exclusive comprising.Such as contain the process of series of steps or unit, method, system, product or equipment and be not defined in the step or unit listed, but also comprise the step or unit do not listed alternatively, or also comprise alternatively for other intrinsic step of these processes, method, product or equipment or unit.
The schematic flow sheet of the method for operating of a kind of registration table provided for the embodiment of the present invention see Fig. 1, Fig. 1, as shown in Figure 1, a kind of method of operating of registration table, can comprise the steps:
101, the registry operations that destination application needs to carry out registration table is obtained.
Wherein, destination application comprises: wish that it is not called back the application program of function or Hook Function termination to the operation of registration table, the application programs such as such as antivirus software.
Wherein, destination application needs the registry operations to registration table carries out to comprise: create registration table, delete registration table, delete the operations such as registration table key assignments, edit the registry key assignments or enumerate Registry key.
102, the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations.
Wherein, the registration table kernel operations function that operating system does not derive, the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
Particularly, the registration table kernel operations function of not deriving with described operating system can be obtained according to the first mapping relations table;
Wherein, described first mapping relations table comprises: with N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function of not deriving corresponding with described registry operations title, described N be greater than or equal to 1 integer.
103, the function address of the registration table kernel operations function that described operating system does not derive is obtained.
Wherein, described function address is the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling the address of last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
104, call according to described function address the registration table kernel operations function that described operating system do not derive.
The operation that can complete described destination application and need to carry out registration table is called by the registration table kernel operations function of not deriving described operating system.
The technical scheme that the embodiment of the present invention provides, when destination application needs to operate registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
Optionally, in some possible embodiments of the present invention, the function address of the registration table kernel operations function that the described operating system of described acquisition does not derive, comprising:
The function address of the registration table kernel operations function that described operating system does not derive is obtained according to address mapping relation table;
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
Optionally, in some possible embodiments of the present invention, before the function address of the kernel operations function of not deriving in the described operating system of described acquisition, described method also comprises:
Address mapping relation table is set up by stack backtrack mechanism.
Optionally, in some possible embodiments of the present invention, the registration table kernel operations function that described operating system does not derive comprises: the registration table kernel operations function that function name is not derived with the operating system of Key ending with Cm beginning.
Optionally, in some possible embodiments of the present invention, the registration table kernel operations function that described operating system does not derive comprises: CmCreateKey function, CmDeleteKey function, CmDeleteValueKey function, CmSetValueKey function or CmEnumerateKey function.
Optionally, in some possible embodiments of the present invention, described destination application comprises antivirus software.
The schematic flow sheet of the method for operating of the another kind of registration table provided for the embodiment of the present invention see Fig. 2, Fig. 2, the method for operating of another kind of registration table as shown in Figure 2, can comprise the steps:
201, address mapping relation table is set up by stack backtrack mechanism.
Wherein, described stack backtrack mechanism refers to called function before execution, is kept in stack the address of called function.When the registry operations function using stack backtrack mechanism operating system can be used to derive in application program carries out registry operations, the address of function invoked before each function call is saved in stack, therefore can reads the address of the registration table kernel operations function that the operating system of carrying out practical operation to registration table does not derive from stack.Particularly, acquisition stack backtrack mechanism sets up the application program of address mapping relation table can be the program being different from destination application.Such as, if when destination application is antivirus software, the application program using stack backtrack mechanism to set up address mapping relation table can be text edit software etc., Malware may be such as that software is ejected in advertisement, the competing product software etc. of bogusware or antivirus software, Malware is not paid close attention to the process of text edit software Registry usually, so operation to registration table can be completed by using the application software such as text edit software, the address of the registration table kernel operations function using stack backtrack mechanism the operating system called in registry operations can not to be derived is kept in stack, the address of the registration table kernel operations function of not deriving for the actual operating system completing registry operations can be got from stack, address mapping relation table is set up according to the address of registration table kernel operations function that the operating system obtained does not derive.
Address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.When such as creating registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmCreateKey; When deleting registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteKey; When deleting registration table key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteValueKey; During edit the registry key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmSetValueKey; During enumerate Registry key, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmEnumerateKey.For example, such as N can be 5, then address mapping relation table comprises 5 records, and correspondence creates the operation of registration table, the operation of deleting registration table, the operation of deleting registration table key assignments, the operation of edit the registry key assignments and the operation of enumerate Registry key respectively.
202, the registry operations that destination application needs to carry out registration table is obtained.
Wherein, destination application comprises: wish that it is not called back the application program of function or Hook Function termination to the operation of registration table, the application programs such as such as antivirus software.
Wherein, destination application needs the registry operations to registration table carries out to comprise: create registration table, delete registration table, delete the operations such as registration table key assignments, edit the registry key assignments or enumerate Registry key.
203, the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations.
Wherein, the registration table kernel operations function that described operating system does not derive, the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
For example, when destination application needs to create registration table, the registration table kernel operations function that the operating system corresponding with creating registry operations does not derive is CmCreateKey; When destination application needs to delete registry entry, the registration table kernel operations function that the operating system corresponding with deleting registry entry does not derive is CmDeleteKey; When destination application needs to delete registration table key assignments, the registration table kernel operations function that the operating system corresponding with deleting registration table key assignments does not derive is CmDeleteValueKey; When destination application needs edit the registry key assignments, the registration table kernel operations function that the operating system of answering with edit the registry key-value pair does not derive is CmSetValueKey; When destination application needs enumerate Registry key, the registration table kernel operations function that the operating system corresponding with enumerate Registry key does not derive is CmEnumerateKey; When destination application needs to delete registry entry, the registration table kernel operations function that the operating system corresponding with deleting registry entry does not derive is CmDeleteKey; When destination application needs to delete registration table key assignments, the registration table kernel operations function that the operating system corresponding with deleting registration table key assignments does not derive is CmDeleteValueKey.
204, the function address of the registration table kernel operations function that described operating system does not derive is obtained according to address mapping relation table.
205, call according to described function address the registration table kernel operations function that described operating system do not derive.
The technical scheme that the embodiment of the present invention provides, when destination application needs to carry out registry operations to registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
For ease of better understanding and implement the such scheme of the embodiment of the present invention, be illustrated below by concrete application scenarios.
In this embodiment, destination application is antivirus software, and antivirus software needs the operation carried out registration table to be create registration table.
In prior art, antivirus software when mounted usually can in the position of starting up's registration table, the routing information of write antivirus software exe, such operating system is in starting up's process, this registry-location will be read, create antivirus software service processes, operating system is before the registration table kernel operations function CmCreateKey that call operation system does not derive completes antivirus software establishment registration table, Malware can judge this process by registration table call back function or Hook Function, what arrange call back function or Hook Function returns results as failure, stop antivirus software process creation registration table, antivirus software can not be performed further call registration table kernel behaviour to be function CmCreateKey, thus cause antivirus software to create registration table failure, such antivirus software can not complete start-up course, be on the hazard making the safety of operating system.
As shown in Figure 3, in the present embodiment, the process that antivirus software carries out registry operations can comprise the steps:
301, obtaining antivirus software needs the registry operations of carrying out registration table to be establishment registration table.
Particularly, in possible embodiment, when starting shooting at every turn or when double-clicking the exe file of antivirus software or when other process transfer antivirus softwares start etc. in situation, antivirus software needs the registry operations to registration table carries out all to comprise establishment registration table.
302, the registration table kernel operations function CmCreateKey that determination operation system does not derive, the described registration table kernel operations function CmCreateKey do not derived are corresponding with establishment registry operations.
Particularly, the corresponding registration table kernel operations function of not deriving for the actual operating system completing this registry operations of each registry operations.For example, the registration table kernel operations function that the operating system corresponding with creating registry operations does not derive is CmCreateKey, the registration table kernel operations function that the operating system corresponding with deleting registry entry does not derive is CmDeleteKey, the registration table kernel operations function that the operating system corresponding with deleting registration table key assignments does not derive is CmDeleteValueKey, the registration table kernel operations function that the operating system of answering with edit the registry key-value pair does not derive is CmSetValueKey, the registration table kernel operations function that the operating system corresponding with enumerate Registry key does not derive is CmEnumerateKey.Particularly, can set up the first mapping relations table, the first mapping relations table comprises and N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function that the operating system corresponding with described registry operations title does not derive, described N be greater than or equal to 1 integer.
303, the function address of CmCreateKey function is obtained according to address mapping relation table.
Particularly, setting up address mapping relation table by stack backtrack mechanism in advance, obtaining the function address of CmCreateKey function by searching address mapping relation table.
Wherein, described stack backtrack mechanism refers to called function before execution, and the address of called function can be kept in stack by it.When the registry operations function using stack backtrack mechanism operating system can be used to derive in application program carries out registry operations, the address of function invoked before each function call is saved in stack, therefore can reads the address of the registration table kernel operations function that the operating system of carrying out practical operation to registration table does not derive from stack.Particularly, acquisition stack backtrack mechanism sets up the application program of address mapping relation table can be the program being different from destination application.Such as, if when destination application is antivirus software, the application program using stack backtrack mechanism to set up address mapping relation table can be the application software such as text edit software, Malware, software is ejected in such as advertisement, the competing product software of bogusware or antivirus software is not paid close attention to the process of text edit software Registry usually, so the operation to registration table can be completed by application software such as use text edit softwares, the address of the registration table kernel operations function using stack backtrack mechanism the operating system called in registry operations can not to be derived is kept in stack, the address of the registration table kernel operations function of not deriving for the actual operating system completing registry operations can be got from stack, address mapping relation table is set up according to the address of registration table kernel operations function that the operating system obtained does not derive.
Address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the address of recording the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.Wherein, the function name of the registration table kernel operations function that operating system does not derive can be the title of the registration table kernel operations function that operating system does not derive, when such as creating registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmCreateKey; When deleting registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteKey; When deleting registration table key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteValueKey; During edit the registry key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmSetValueKey; During enumerate Registry key, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmEnumerateKey.For example, such as N can be 5, then address mapping relation table comprises 5 records, and correspondence creates the operation of registration table, the operation of deleting registration table, the operation of deleting registration table key assignments, the operation of edit the registry key assignments and the operation of enumerate Registry key respectively.
304, according to the call by location CmCreateKey function of the CmCreateKey function obtained.
The operation that antivirus software creates registration table is completed by calling CmCreateKey function.
The technical scheme that the embodiment of the present invention provides, when destination application needs to operate registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
See the structural representation of a kind of registry operations device that Fig. 4, Fig. 4 provide for the embodiment of the present invention.Wherein, registry operations device 400, can comprise:
First acquiring unit 401, for obtaining the registry operations that destination application needs to carry out registration table.
Wherein, destination application comprises: wish that it is not called back the application program of function or Hook Function termination to the operation of registration table, the application programs such as such as antivirus software.
Wherein, destination application needs the registry operations to registration table carries out to comprise: create registration table, delete registration table, delete the operations such as registration table key assignments, edit the registry key assignments or enumerate Registry key.
First determining unit 420, for the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with the described registry operations that described first acquiring unit obtains.
Wherein, the registration table kernel operations function that described operating system does not derive, the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
Particularly, the first determining unit 420 may be used for the function name obtaining the registration table kernel operations function that the operating system corresponding with described registry operations does not derive according to the first mapping relations table.
Wherein, described first mapping relations table comprises: with N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function that the operating system corresponding with described registry operations title does not derive, described N be greater than or equal to 1 integer.
Second acquisition unit 430, the function address of the registration table kernel operations function that the described operating system determined for obtaining described first determining unit does not derive.
Wherein, described function address is the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling the address of last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
Call unit 440, for the registration table kernel operations function that operating system described in the described call by location that obtains according to described second acquisition unit does not derive.
The operation that can complete described destination application and need to carry out registration table is called by the registration table kernel operations function of not deriving described operating system.
The technical scheme that the embodiment of the present invention provides, when destination application needs to operate registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
Optionally, described second acquisition unit 430 specifically for, obtain the function address of the registration table kernel operations function that described operating system does not derive according to address mapping relation table.
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the address of recording the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
Optionally, in some possible embodiments of the present invention, the operating means of described registration table can also comprise sets up unit, for setting up address mapping relation table by stack backtrack mechanism.
Optionally, in some possible embodiments of the present invention, the registration table kernel operations function that described operating system does not derive comprises: the registration table kernel operations function that function name is not derived with the operating system of Key ending with Cm beginning.
Optionally, in some possible embodiments of the present invention, the registration table kernel operations function that described operating system does not derive comprises: CmCreateKey function, CmDeleteKey function, CmDeleteValueKey function, CmSetValueKey function or CmEnumerateKey function.
Optionally, in some possible embodiments of the present invention, described destination application comprises antivirus software.
The structural representation of the operating means of the another kind of registration table provided for the embodiment of the present invention see Fig. 5, Fig. 5.Wherein, the operating means 500 of registration table, can comprise:
Mapping relations set up unit 510, for setting up address mapping relation table by stack backtrack mechanism.
Wherein, described stack backtrack mechanism refers to called function before execution, and the address of called function can be kept in stack by it.When the registry operations function using stack backtrack mechanism operating system can be used to derive in application program carries out registry operations, the address of function invoked before each function call is saved in stack, therefore can reads the address of the registration table kernel operations function that the operating system of carrying out practical operation to registration table does not derive from stack.Particularly, acquisition stack backtrack mechanism sets up the application program of address mapping relation table can be the program being different from destination application.Such as, if when destination application is antivirus software, the application program using stack backtrack mechanism to set up address mapping relation table can be text edit software etc., Malware, software is ejected in such as advertisement, the competing product software of bogusware or antivirus software is not paid close attention to the process of text edit software Registry usually, so the operation to registration table can be completed by application software such as use text edit softwares, the address of the registration table kernel operations function using stack backtrack mechanism the operating system called in registry operations can not to be derived is kept in stack, the address of the registration table kernel operations function of not deriving for the actual operating system completing registry operations can be got from stack, address mapping relation table is set up according to the address of registration table kernel operations function that the operating system obtained does not derive.
Address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the address of recording the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.Wherein, the function name of the registration table kernel operations function that operating system does not derive can be the title of the registration table kernel operations function that operating system does not derive, when such as creating registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmCreateKey; When deleting registration table, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteKey; When deleting registration table key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmDeleteValueKey; During edit the registry key assignments, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmSetValueKey; During enumerate Registry key, the function name of the registration table kernel operations function that corresponding operating system does not derive can be CmEnumerateKey.For example, such as N can be 5, then address mapping relation table comprises 5 records, and correspondence creates the operation of registration table, the operation of deleting registration table, the operation of deleting registration table key assignments, the operation of edit the registry key assignments and the operation of enumerate Registry key respectively.
First acquiring unit 520, for obtaining the registry operations that destination application needs to carry out registration table.
Wherein, destination application comprises: wish that it is not called back the application program of function or Hook Function termination to the operation of registration table, the application programs such as such as antivirus software.
Wherein, destination application needs the registry operations to registration table carries out to comprise: create registration table, delete registration table, delete the operations such as registration table key assignments, edit the registry key assignments or enumerate Registry key.
First determining unit 530, for the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations.
Wherein, the registration table kernel operations function of not deriving with described operating system, the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
Second acquisition unit 540, the function address of the registration table kernel operations function that the described operating system determined for obtaining described first determining unit does not derive.
Wherein, described function address is the registry operations function of being derived by call operation system in prior art when carrying out registry operations, by calling the function address of last invoked registry operations function of not deriving for the operating system performing registry operations step by step.
Call unit 550, the described function address for obtaining according to described second acquisition unit calls the registration table kernel operations function that described operating system does not derive.
The registry operations that can complete described destination application and need to carry out registration table is called by the registration table kernel operations function of not deriving described operating system.
The technical scheme that the embodiment of the present invention provides, when destination application needs to carry out registry operations to registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
See the structural representation of a kind of data transmitting equipment that Fig. 6, Fig. 6 provide for the embodiment of the present invention, described data transmitting equipment 600, can comprise:
Processor 601, storer 602 and bus 603.
Described processor 601 and described storer 602 are connected by described bus 603 and complete mutual communication; Described storer 602 stores executable programs code; Described processor 601 runs the program corresponding with described executable program code by reading the executable program code stored in described storer, for the method for operating performing a kind of registration table; Wherein, the method for operating of described registration table comprises:
Obtain the registry operations that destination application needs to carry out registration table;
The registration table kernel operations function that determination operation system does not derive, described registration table kernel operations function of not deriving is corresponding with described registry operations;
Obtain the function address of the registration table kernel operations function that described operating system does not derive;
The registration table kernel operations function that described operating system do not derive is called according to described function address.
The technical scheme that the embodiment of the present invention provides, when destination application needs to operate registration table, the registration table kernel operations function of not deriving by directly calling the operating system that finally completes registry operations has come, owing to not using call back function or the utilizable middle call function of Hook Function, so avoid call back function or Hook Function to the impact of registry operations, improve the security of operating system.
It should be noted that, for aforesaid each embodiment of the method, in order to simple description, therefore it is all expressed as a series of combination of actions, but those skilled in the art should know, the present invention is not by the restriction of described sequence of movement, because according to the present invention, some step can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in instructions all belongs to preferred embodiment, and involved action and module might not be that the present invention is necessary.
In the above-described embodiments, the description of each embodiment is all emphasized particularly on different fields, in certain embodiment, there is no the part described in detail, can see the associated description of other embodiments.
In several embodiments that the application provides, should be understood that, disclosed device, the mode by other realizes.Such as, device embodiment described above is only schematic, the such as division of described unit, be only a kind of logic function to divide, actual can have other dividing mode when realizing, such as multiple unit or assembly can in conjunction with or another system can be integrated into, or some features can be ignored, or do not perform.Another point, shown or discussed coupling each other or direct-coupling or communication connection can be by some interfaces, and the indirect coupling of device or unit or communication connection can be electrical or other form.
The described unit illustrated as separating component or can may not be and physically separates, and the parts as unit display can be or may not be physical location, namely can be positioned at a place, or also can be distributed in multiple network element.Some or all of unit wherein can be selected according to the actual needs to realize the object of the present embodiment scheme.
In addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, also can be that the independent physics of unit exists, also can two or more unit in a unit integrated.Above-mentioned integrated unit both can adopt the form of hardware to realize, and the form of SFU software functional unit also can be adopted to realize.
If described integrated unit using the form of SFU software functional unit realize and as independently production marketing or use time, can be stored in a computer read/write memory medium.Based on such understanding, the part that technical scheme of the present invention contributes to prior art in essence in other words or all or part of of this technical scheme can embody with the form of software product, this computer software product is stored in a storage medium, comprises all or part of step of some instructions in order to make a computer equipment (can be personal computer, server or the network equipment etc.) perform method described in each embodiment of the present invention.And aforesaid storage medium comprises: USB flash disk, ROM (read-only memory) (ROM, Read-OnlyMemory), random access memory (RAM, RandomAccessMemory), portable hard drive, magnetic disc or CD etc. various can be program code stored medium.
The above, above embodiment only in order to technical solution of the present invention to be described, is not intended to limit; Although with reference to previous embodiment to invention has been detailed description, wherein, those of ordinary skill in the art is to be understood that: it still can be modified to the technical scheme described in foregoing embodiments, or carries out equivalent replacement to wherein portion of techniques feature; And these amendments or replacement, do not make the essence of appropriate technical solution depart from the scope of various embodiments of the present invention technical scheme.
Claims (10)
1. a method of operating for registration table, is characterized in that, comprising:
Obtain the registry operations that destination application needs to carry out registration table;
The registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations;
Obtain the function address of the registration table kernel operations function that described operating system does not derive;
The registration table kernel operations function that described operating system do not derive is called according to described function address.
2. method according to claim 1, is characterized in that, the function address of the registration table kernel operations function that the described operating system of described acquisition does not derive, comprising:
The function address of the registration table kernel operations function that described operating system does not derive is obtained according to address mapping relation table;
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
3. method according to claim 2, is characterized in that, before the function address of the registration table kernel operations function of not deriving in the described operating system of described acquisition, described method also comprises:
Address mapping relation table is set up by stack backtrack mechanism.
4. the method for operating of registration table according to claim 1, is characterized in that,
Described registry operations comprises: create registration table, delete registration table, delete registration table key assignments, edit the registry key assignments or enumerate Registry key.
5. method according to claim 1, is characterized in that, the registration table kernel operations function that described operating system does not derive comprises: the registration table kernel operations function that function name is not derived with the operating system of Key ending with Cm beginning.
6. method according to claim 5, it is characterized in that, the registration table kernel operations function that described operating system does not derive comprises: CmCreateKey function, CmDeleteKey function, CmDeleteValueKey function, CmSetValueKey function or CmEnumerateKey function.
7. method according to claim 1, is characterized in that, the registration table kernel operations function that described determination operation system does not derive, comprising:
According to the registration table kernel operations function that the first mapping relations table acquisition described operating system corresponding with described registry operations does not derive;
Wherein, described first mapping relations table comprises: with N number of registry operations N bar record one to one; Every bar record comprises: for recording the first field of registry operations title and the second field for the function name that records the registration table kernel operations function of not deriving corresponding with described registry operations title, described N be greater than or equal to 1 integer.
8. the method according to any one of claim 1 to 7, is characterized in that,
Described destination application comprises antivirus software.
9. an operating means for registration table, is characterized in that, comprising:
First acquiring unit, for obtaining the registry operations that destination application needs to carry out registration table;
First determining unit, for the registration table kernel operations function that determination operation system does not derive, the registration table kernel operations function that described operating system does not derive is corresponding with described registry operations;
Second acquisition unit, the function address of the registration table kernel operations function that the described operating system determined for obtaining described first determining unit does not derive;
Call unit, the described function address for obtaining according to described second acquisition unit calls the registration table kernel operations function that described operating system does not derive.
10. device according to claim 9, is characterized in that,
Described second acquisition unit specifically for, obtain the function address of the registration table kernel operations function that described operating system does not derive according to address mapping relation table;
Wherein, described address mapping relation table comprises: the registration table kernel operations function N bar record one to one of not deriving with N number of operating system; Every bar record comprises: for recording the first field of the function name of the registration table kernel operations function that operating system does not derive and the second field for the function address that records the registration table kernel operations function that described operating system does not derive, described N be greater than or equal to 1 integer.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510731156.1A CN105354498A (en) | 2015-10-30 | 2015-10-30 | Operation method of registry, related device and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510731156.1A CN105354498A (en) | 2015-10-30 | 2015-10-30 | Operation method of registry, related device and equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105354498A true CN105354498A (en) | 2016-02-24 |
Family
ID=55330469
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510731156.1A Pending CN105354498A (en) | 2015-10-30 | 2015-10-30 | Operation method of registry, related device and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105354498A (en) |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105930729A (en) * | 2016-07-04 | 2016-09-07 | 北京金山安全软件有限公司 | Keyboard focus changing method and device and terminal equipment |
| CN106557693A (en) * | 2016-05-09 | 2017-04-05 | 哈尔滨安天科技股份有限公司 | A kind of malice Hook behavioral value method and system |
| CN106709331A (en) * | 2016-11-01 | 2017-05-24 | 腾讯科技（深圳）有限公司 | Anti-injection method and device of message hook, and client side |
| CN107122164A (en) * | 2017-03-31 | 2017-09-01 | 腾讯科技（深圳）有限公司 | Function address obtains and applied its method, device, equipment and storage medium |
| CN108052327A (en) * | 2017-12-11 | 2018-05-18 | 北京奇虎科技有限公司 | A kind of kernel module compiling, loading method and device |
| CN108287779A (en) * | 2018-01-24 | 2018-07-17 | 郑州云海信息技术有限公司 | A kind of Windows startup items monitoring method and system |
| CN113821439A (en) * | 2021-09-23 | 2021-12-21 | 成都欧珀通信科技有限公司 | Method, device, storage medium and terminal for registering function to probe point |
| CN114499928A (en) * | 2021-12-13 | 2022-05-13 | 奇安信科技集团股份有限公司 | Remote registry monitoring method and device |
| CN114499928B (en) * | 2021-12-13 | 2024-06-28 | 奇安信科技集团股份有限公司 | Remote registry monitoring method and device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102214287A (en) * | 2011-06-09 | 2011-10-12 | 北京思创银联科技股份有限公司 | Method for protecting Windows system registry |
| CN102722680A (en) * | 2012-06-07 | 2012-10-10 | 腾讯科技（深圳）有限公司 | Method and system for removing rogue programs |
| CN103425565A (en) * | 2012-05-16 | 2013-12-04 | 腾讯科技（深圳）有限公司 | Method and system for acquiring running information of program |
-
2015
- 2015-10-30 CN CN201510731156.1A patent/CN105354498A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102214287A (en) * | 2011-06-09 | 2011-10-12 | 北京思创银联科技股份有限公司 | Method for protecting Windows system registry |
| CN103425565A (en) * | 2012-05-16 | 2013-12-04 | 腾讯科技（深圳）有限公司 | Method and system for acquiring running information of program |
| CN102722680A (en) * | 2012-06-07 | 2012-10-10 | 腾讯科技（深圳）有限公司 | Method and system for removing rogue programs |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106557693A (en) * | 2016-05-09 | 2017-04-05 | 哈尔滨安天科技股份有限公司 | A kind of malice Hook behavioral value method and system |
| CN105930729A (en) * | 2016-07-04 | 2016-09-07 | 北京金山安全软件有限公司 | Keyboard focus changing method and device and terminal equipment |
| CN106709331A (en) * | 2016-11-01 | 2017-05-24 | 腾讯科技（深圳）有限公司 | Anti-injection method and device of message hook, and client side |
| CN106709331B (en) * | 2016-11-01 | 2020-09-25 | 腾讯科技（深圳）有限公司 | Message hook injection prevention method and device and client |
| CN107122164A (en) * | 2017-03-31 | 2017-09-01 | 腾讯科技（深圳）有限公司 | Function address obtains and applied its method, device, equipment and storage medium |
| CN107122164B (en) * | 2017-03-31 | 2023-04-07 | 腾讯科技（深圳）有限公司 | Method, device, equipment and storage medium for acquiring function address and applying function address |
| CN108052327A (en) * | 2017-12-11 | 2018-05-18 | 北京奇虎科技有限公司 | A kind of kernel module compiling, loading method and device |
| CN108287779A (en) * | 2018-01-24 | 2018-07-17 | 郑州云海信息技术有限公司 | A kind of Windows startup items monitoring method and system |
| CN108287779B (en) * | 2018-01-24 | 2021-07-27 | 郑州云海信息技术有限公司 | Windows startup item monitoring method and system |
| CN113821439A (en) * | 2021-09-23 | 2021-12-21 | 成都欧珀通信科技有限公司 | Method, device, storage medium and terminal for registering function to probe point |
| CN114499928A (en) * | 2021-12-13 | 2022-05-13 | 奇安信科技集团股份有限公司 | Remote registry monitoring method and device |
| CN114499928B (en) * | 2021-12-13 | 2024-06-28 | 奇安信科技集团股份有限公司 | Remote registry monitoring method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105354498A (en) | Operation method of registry, related device and equipment | |
| CN104572446B (en) | A kind of automated testing method and system | |
| CN110096424B (en) | Test processing method and device, electronic equipment and storage medium | |
| CN104049986A (en) | Plugin loading method and device | |
| CN105791324A (en) | Account login method and device | |
| US20140068026A1 (en) | System for automatically configuring server using pre-recorded configuration script and method thereof | |
| CN105871587A (en) | Log uploading method and device | |
| CN111552633A (en) | Interface abnormal call testing method and device, computer equipment and storage medium | |
| CN105718171B (en) | A kind of data processing method and terminal | |
| CN113990354B (en) | Audio control method, device, equipment and storage medium based on Linux | |
| CN110908865A (en) | Memory leakage monitoring method and device and electronic equipment | |
| CN104820683A (en) | Terminal | |
| CN102902580A (en) | Program callback method and device | |
| CN105573788B (en) | The method and apparatus of patch processing and the method and apparatus for generating patch | |
| US10521499B2 (en) | Method and device for editing data | |
| US10503430B2 (en) | Method and device for clearing data and electronic device | |
| CN105138366A (en) | Recognition software silent installation method and device | |
| WO2020006911A1 (en) | Hybrid app interface calling method and device, and computer-readable storage medium | |
| CN105425997B (en) | A kind of user terminal restart after interface display method and user terminal | |
| CN114386934A (en) | Method and device for generating business process, server and storage medium | |
| CN104601798B (en) | A kind of custom application starting control method and device | |
| CN111639316B (en) | Information processing method and device for WEB page | |
| CN105700886B (en) | The display methods and terminal of plug-in interface | |
| CN110018831B (en) | Program processing method, program processing apparatus, and computer-readable storage medium | |
| US10931737B2 (en) | Personal cloud system and related localization method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20160224 |
|
| RJ01 | Rejection of invention patent application after publication |