CN106293963B - Method and system for communication between application layer and drive layer in windows system - Google Patents
Method and system for communication between application layer and drive layer in windows system Download PDFInfo
- Publication number
- CN106293963B CN106293963B CN201610620942.9A CN201610620942A CN106293963B CN 106293963 B CN106293963 B CN 106293963B CN 201610620942 A CN201610620942 A CN 201610620942A CN 106293963 B CN106293963 B CN 106293963B
- Authority
- CN
- China
- Prior art keywords
- system service
- function
- description table
- layer
- service description
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/54—Interprogram communication
- G06F9/547—Remote procedure calls [RPC]; Web services
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Stored Programmes (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a method and a system for communication between an application layer and a drive layer in a windows system, wherein the method comprises the following steps: establishing a new system service description table in a drive layer, and replacing an original system service description table in a system kernel with the new system service description table; and receiving a communication instruction of the application layer, and calling a corresponding system service function according to the system service description table in the drive layer. According to the communication method of the application layer and the driver layer, the system service description table is newly established in the driver layer, the memory limitation of the original system kernel is overcome, and the number of system service functions which can be pointed by the system service description table is expanded; meanwhile, the new system service description table can also directly store the system service function and can be directly called by the application layer, thereby accelerating the calling speed of the system service and improving the processing performance of the system.
Description
Technical Field
The invention relates to the technical field of computers, in particular to a method and a system for communication between an application layer and a drive layer in a windows system.
Background
At present, a system service function of a computer is implemented by one or more processing functions, a specific system service call is that an application layer calls a processing function in a system kernel through a driver layer, and in a specific communication process, if the application layer needs to communicate with the driver layer, the application layer must open a driver device object by using a CreateFile function in a windows system, and then communicate with the driver layer through a DeviceIoControl API function, so as to call the processing function pointed by a system service description table in the system kernel. The number of the system service description table stored in the computer and the processing functions pointed to by the system service description table is limited by the memory capacity of the system kernel, and the calling number of the processing functions is also influenced by the number of threads which can be created by the driver layer and the system kernel, so that the problem of delaying system service calling may exist, and therefore the existing communication mode cannot meet the communication requirements of the existing application layer and the existing driver layer.
Disclosure of Invention
The invention aims to provide a method and a system for communication between an application layer and a drive layer in a windows system, wherein a system service description table is established in the drive layer, so that the overall process of system service calling is accelerated, and the communication efficiency of the application layer and the drive layer is improved.
The technical scheme adopted by the invention for realizing the purpose is as follows:
according to an aspect of the present invention, there is provided a method for application layer and driver layer communication in a windows system, including: establishing a new system service description table in a drive layer, and replacing an original system service description table in a system kernel with the new system service description table; and receiving a communication instruction of the application layer, and calling a corresponding system service function according to the system service description table in the drive layer.
Further, the method further comprises: before a new system service description table is established in a driver layer, acquiring basic attributes and data contents of an original system service description table, wherein the basic attributes comprise memory addresses and memory capacity of the system service description table, and the data contents comprise a system service table pointed by the system service description table and an address table and a parameter table contained in the system service table; the process of obtaining the basic attribute and the data content of the original system service description table comprises the following steps: loading a drive entry function of a drive layer, acquiring the version number of a current operating system by using a PsGetVersion function, and acquiring the memory address and the memory capacity of an original system service description table according to the version number of the operating system; and searching the original system service description table according to the memory address, and copying the system service table pointed by the system service description table and an address table and a parameter table contained in the system service table.
Further, the process of establishing a new system service description table in the driver layer includes: according to the memory capacity of the original system service description table, allocating a memory space which is not less than the memory capacity at a drive layer, establishing a new system service description table in the memory space, generating a memory address of the new system service description table, and copying the copied system service table and an address table and a parameter table contained in the system service table into the memory space.
Further, the process of replacing the original system service description table in the system kernel with the new system service description table includes: closing an interrupt function of a CPU occupied by a drive entry function, clearing a WP bit of a CR0 register, modifying the system kernel into write permission, and replacing an original system service description table in the system kernel and the pointing relation between the system service table and the system service function by the system service description table and the system service table of a drive layer and the pointing relation between the system service table and the system service function; after the memory address replacement is complete, the WP bit of the CR0 register is set to 1 and the previously shut down interrupt function of the occupied-CPU is resumed.
Further, the method further comprises: before closing the interrupt function of the CPU occupied by the driving entry function, detecting whether other CPUs with thread connection exist in the system; if so, a deferred procedure call operation is enabled for the other CPU to block the other CPU.
Further, the method further comprises: storing a new system service function and/or a part of original system service functions in a system kernel in a memory space of a drive layer; establishing the direction relation between the system service table and the system service functions in the driving layer, and generating the serial numbers of all the system service functions in the new system service description table.
Further, the method further comprises: the application layer detects whether a CPU installed in the system supports a rapid system call instruction or not according to the serial number of the system service function stored in the drive layer, and if not, an int 2e instruction is started; if the system service function is supported, writing the serial number of the system service function stored in the driving layer in the quick system call instruction, and setting a corresponding address table and a parameter table.
Further, the method further comprises: and establishing a pointing relation between the system service table and other system service functions in the system kernel.
The process of receiving the communication instruction of the application layer and calling the corresponding system service function according to the system service description table in the driving layer comprises the following steps: and determining the storage position of the system service function to be called according to the system service function to be called in the communication instruction and the pointing relationships between the new system service description table and the system service table and between the new system service description table and the system service function in sequence, wherein if the system service description table and the new system service description table are located in the drive layer, the application layer directly calls the system service function, and if the system service description table is located in the kernel, the application layer calls the system service function through the drive layer.
According to another aspect of the present invention, there is also provided a communication system including: creating a replacement unit, which is used for establishing a new system service description table in the drive layer and replacing the original system service description table in the system kernel with the new system service description table; and the service receiving unit is used for receiving the communication instruction of the application layer and calling a corresponding system service function according to the system service description table in the drive layer.
The technical effect of the invention adopting the technical scheme is as follows:
according to the communication method of the application layer and the driver layer, the system service description table is newly established in the driver layer, the memory limitation of the original system kernel is overcome, and the number of system service functions which can be pointed by the system service description table is expanded; meanwhile, the new system service description table can also directly store the system service function and can be directly called by the application layer, thereby accelerating the calling speed of the system service and improving the processing performance of the system.
Drawings
FIG. 1 is an overall flow chart of the communication method of the present invention;
FIG. 2 is a flow chart of the present invention for obtaining the basic attributes and data contents of the original system service description table;
FIG. 3 is a diagram of the pointing relationship of the system services of the present invention.
Wherein, 1, an application layer; 2. a drive layer; 3. a system kernel; 4. a system service description table; 5. a system service table; 6. an address table; 7. a parameter table; 8. a system service function.
Detailed Description
For the purpose of clearly illustrating the aspects of the present invention, preferred embodiments are given below in conjunction with the accompanying drawings. The following description is merely exemplary in nature and is not intended to limit the present disclosure, application, or uses. It should be understood that throughout the drawings, corresponding reference numerals indicate like or corresponding parts and features.
As shown in fig. 1, the present invention provides a method for communication between an application layer and a driver layer in a windows system, which includes the steps of:
s101, establishing a new system service description table 4 in a driver layer 2, and replacing an original system service description table in a system kernel 3 with the new system service description table 4;
s102, receiving a communication instruction of the application layer 1, and calling a corresponding system service function 8 according to the system service description table 4 in the drive layer 2.
After the driver layer 2 establishes the new system service description table 4, because the system service function 8 stored in the original system kernel 3 is still called, the content and the pointing relationship of the original system service description table are retained in the new system service description table 4, therefore, before the driver layer 2 establishes the new system service description table 4, the present invention needs to obtain the basic attribute and the data content of the original system service description table, specifically, the basic attribute includes the memory address and the memory capacity of the system service description table 4, and the data content includes the system service table 5 pointed by the system service description table 4 and the address table 6 and the parameter table 7 included in the system service table 5;
in an embodiment of the present invention, as shown in the flowchart of fig. 2, the process of obtaining the basic attribute and data content of the original system service description table includes:
s201, loading a drive entry function of a drive layer 2;
s202, acquiring the version number of the current operating system by using a PsGetVersion function;
s203, acquiring the memory address and the memory capacity of the original system service description table according to the version number of the operating system; for example, for the windows XP SP3 operating system of version 5.1, the memory address of a certain system service description table in the system kernel is 0x80505450, and the memory capacity is 1136 bytes;
s204, the original system service description table is searched according to the memory address, and the system service table 5 pointed by the system service description table 4 and the address table 6 and the parameter table 7 contained in the system service table 5 are copied.
In one embodiment of the present invention, the process of creating a new system service description table 4 in the driver layer 2 includes:
according to the memory capacity of the original system service description table, allocating a memory space which is not less than the memory capacity at the drive layer 2, establishing a new system service description table 4 in the memory space, and generating a memory address of the new system service description table 4, for example, in the embodiment, the memory address of a certain system service description table in the drive layer is 0x85EC0248, it should be noted that the creation position of the system service description table in the drive layer is not unique, a technician may preset a plurality of optional memory addresses as required, and determine the unique memory address when the system service description table is created; copying the copied system service table 5 and the address table 6 and parameter table 7 contained in the system service table 5 into the memory space.
In one embodiment of the present invention, the process of replacing the original system service description table in the system kernel 3 with the new system service description table 4 comprises:
the interrupt function of the CPU occupied by the drive entry function of the load drive layer 2 is closed, and the interruption of the whole replacement process caused by calling the CPU by other threads in the replacement process of the system service description table 4 is prevented; clearing the WP bit of the CR0 register to enable the system kernel 3 to be in a state of allowing writing, replacing the original system service description table in the system kernel 3 and the orientation relation between the system service table 5 and the system service function 8 by the orientation relation between the system service description table 4 and the system service table 5 of the drive layer 2 and the system service function 8, wherein the original system service description table can be deleted or continuously reserved, and the system service function 8 is not searched and called according to the original system service description table in the later communication process of the application layer 1 and the drive layer 2;
after the memory address replacement is completed, the WP bit of the CR0 register is set to be 1, and the system kernel 3 is changed into a state allowing read only; and recovering the interrupt function of the occupied CPU which is closed before, wherein the occupied CPU in the replacement process can be normally called by other threads.
In an embodiment of the present invention, before closing the interrupt function of the CPU occupied by the drive entry function of the drive layer 2, it is further detected whether there are other CPUs with thread connection in the system, before the replacement is completed, since other threads still call the system service function 8 according to the original system service description table, in order to avoid affecting the replacement process, if there are other CPUs with thread connection, a delayed process call operation is enabled for other CPUs to block other CPUs, after the replacement is completed, the threads recover the connection with the CPUs and continue to call the corresponding system service function 8 according to the pointing relationship of the new system service description table 4.
The new system service description table 4 is established in the newly divided memory space of the driver layer 2, and a new system service function 8 and/or a part of the original system service functions 8 in the system kernel 3 may be stored in the memory space of the driver layer 2 in the memory space; establishing the direction relation between the system service table 5 and the system service functions 8 in the drive layer 2, and generating the serial numbers of all the system service functions 8 in the new system service description table 4; in this way, the application layer 1 can directly call the system service function 8 stored in the driver layer 2 without calling from the system kernel 3 according to the direction relationship, and the reaction speed of the system is accelerated.
Normally, if the driver layer 2 needs to provide some functions to the application layer 1, a control code needs to be defined, then the application layer 1 transfers the control code and the parameter corresponding to the system service to be called to the driver layer 2, the driver finds the corresponding system service function 8 in the system kernel 3 according to the control code to process, and if the application layer 1 needs to call two functions of "OPEN FILE" and "CLOSE FILE", two control codes of CTRL _ OPEN _ FILE and CTRL _ CLOSE _ FILE need to be transferred to the driver layer 2, and the driver layer 2 calls the system processing functions of "OPEN FILE" and "CLOSE FILE" in the system kernel 3 according to the two control codes. In an embodiment of the present invention, the two system processing functions of "open file" and "close file" may be directly stored in the memory space of the driver layer 2, so that the application layer 1 may directly call the two system service functions 8 from the driver layer 2 without transferring control codes, thereby reducing the communication lookup process between the driver layer 2 and the original system service table 5, and improving the response speed of system service call.
In an embodiment of the present invention, after the directly-invokable system service function 8 is supplemented in the memory space of the driver layer 2, it is further required to detect whether the CPU supports fast invocation, and the specific steps include: the application layer 1 detects whether a CPU installed in the system supports a quick system call instruction, such as a YSENTER instruction with higher execution efficiency, according to the serial number of the system service function 8 stored in the drive layer 2; if not, the int 2e instruction, which can be generic to all CPUs, is enabled; if supported, the serial numbers of the system service functions 8 stored in the driver layer 2 are written in the fast system call instruction, and the corresponding address table 6 and the parameter table 7 are set, so that the direct call of the system service functions 8 at a later period is facilitated.
In one embodiment of the present invention, as shown in fig. 2, the newly created system service description table 4 points to the system service table 5, and the system service table 5 points to the system service function 8 in the memory space of the driver layer 2 and the system service function 8 in the system kernel 3, respectively. In the actual operating system, the system service description table 4 includes a conventional system service description table 4 and a hidden system service description table 4, which correspond to the non-GUI user and the GUI user, respectively, and the embodiment of the present invention is illustrated by only one of the system service description tables 4, and the type and number of the new system service description table 4 and the replaced system service description table 4 are not limited.
The process that the driver layer 2 receives the communication instruction of the application layer 1 and calls the corresponding system service function 8 according to the system service description table 4 in the driver layer 2 comprises the following steps: according to the system service function 8 to be called in the communication instruction, sequentially according to the new system service description table 4 and the system service table 5, and the pointing relationship between the system service table 5 and the system service function 8, as shown in fig. 3, the storage location of the system service function 8 to be called is determined, if the system service function 8 is located in the driver layer 2, the application layer 1 directly calls the system service function 8, and if the system service function 8 is located in the kernel, the application layer 1 calls the system service function 8 through the driver layer 2. In the above embodiments of "open file" and "close file", two system service functions 8 of "open file" and "close file" are located in the driver layer 2, and when the system service function 8 related to "copy file" is located in the system kernel 3, and the "copy file" is to be called, the system service function 8 of "copy file" in the pointed system kernel 3 is called according to the new system service description table 4.
The invention also provides a communication system, which adopts the communication method in the embodiment, and the system specifically comprises:
creating a replacement unit, which is used for creating a new system service description table 4 in the driver layer 2, and replacing the original system service description table in the system kernel 3 with the new system service description table 4;
and the service receiving unit is used for receiving the communication instruction of the application layer 1 and calling a corresponding system service function 8 according to the system service description table 4 in the drive layer 2.
The communication system further includes an obtaining unit, configured to obtain basic attributes and data contents of an original system service description table before the driver layer 2 establishes a new system service description table 4, where the basic attributes include a memory address and a memory capacity of the system service description table 4, and the data contents include a system service table 5 pointed by the system service description table 4, and an address table 6 and a parameter table 7 included in the system service table 5.
Specifically, the obtaining unit is configured to: loading a drive entry function of a drive layer 2, acquiring the version number of a current operating system by using a PsGetVersion function, and acquiring the memory address and the memory capacity of an original system service description table according to the version number of the operating system; and finding the original system service description table according to the memory address, and copying the system service table 5 pointed by the system service description table 4 and an address table 6 and a parameter table 7 contained in the system service table 5.
In an embodiment, the creating a replacement unit is to: according to the memory capacity of the original system service description table, a memory space which is not less than the memory capacity is distributed in the drive layer 2, a new system service description table 4 is established in the memory space, a memory address of the new system service description table 4 is generated, and the copied system service table 5 and an address table 6 and a parameter table 7 which are contained in the system service table 5 are copied to the memory space.
In an embodiment, the creating the replacement unit is further configured to: closing the interrupt function of the CPU occupied by the drive entry function of the drive layer 2, clearing the WP bit of the CR0 register, modifying the system kernel 3 to allow writing, and replacing the original system service description table in the system kernel 3 and the directional relation between the system service table 5 and the system service function 8 by the system service description table 4 and the system service table 5 of the drive layer 2 and the directional relation between the system service table 8 and the system service function 8; after the memory address replacement is complete, the WP bit of the CR0 register is set to 1 and the previously shut down interrupt function of the occupied-CPU is resumed.
In an embodiment, the creating the replacement unit is further configured to: before closing the interrupt function of the CPU occupied by the drive entry function of the drive layer 2, detecting whether other CPUs with thread connection exist in the system; if so, a deferred procedure call operation is enabled for the other CPU to block the other CPU.
In an embodiment, the creating the replacement unit is further configured to: storing the new system service function 8 and/or part of the original system service function 8 in the system kernel 3 in the memory space of the drive layer 2; establishing the orientation relation between the system service table 5 and the system service function 8 in the driver layer 2, and generating the serial numbers of all the system service functions 8 in the new system service description table 4.
In an embodiment, the creating the replacement unit is further configured to: the system service table 5 is established with a pointing relationship to other system service functions 8 in the system kernel 3.
The communication system further comprises a detection unit for: the application layer 1 detects whether a CPU installed in the system supports a rapid system call instruction according to the serial number of the system service function 8 stored in the drive layer 2, and if not, an int 2e instruction is started; if the support is provided, the serial number of the system service function 8 stored in the driving layer 2 is written in the fast system call instruction, and the corresponding address table 6 and the parameter table 7 are set.
A service receiving unit to: according to the system service function 8 to be called in the communication instruction, sequentially according to the new system service description table 4 and the system service table 5, and the pointing relationship between the system service table 5 and the system service function 8, determining the storage position of the system service function 8 to be called, if the system service function is located in the drive layer 2, the application layer 1 directly calls the system service function 8, and if the system service function is located in the kernel, the application layer 1 calls the system service function 8 through the drive layer 2.
In summary, the above descriptions are only examples of the present invention, and are only used for illustrating the principle of the present invention, and not for limiting the protection scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (8)
1. A method for application layer and driver layer communication in a windows system, comprising:
distributing a memory space which is not less than the memory capacity at a drive layer according to the memory capacity of an original system service description table, establishing a new system service description table in the memory space, generating a memory address of the new system service description table, and copying a copied system service table, an address table and a parameter table contained in the system service table into the memory space;
closing an interrupt function of a CPU occupied by a drive entry function, clearing a WP bit of a CR0 register, modifying a system kernel into write permission, and replacing an original system service description table and a pointing relation between the system service table and a system service function in the system kernel by using a system service description table and a pointing relation between the system service table and the system service function of a drive layer; after the memory address replacement is completed, setting the WP bit of the CR0 register as 1, and recovering the interrupt function of the occupied CPU which is closed before;
and receiving a communication instruction of an application layer, and calling a corresponding system service function according to the system service description table in the drive layer.
2. The method of claim 1, further comprising:
before a new system service description table is established in a driver layer, acquiring basic attributes and data contents of an original system service description table, wherein the basic attributes comprise memory addresses and memory capacity of the system service description table, and the data contents comprise a system service table pointed by the system service description table and an address table and a parameter table contained in the system service table;
the process of acquiring the basic attribute and the data content of the original system service description table comprises the following steps:
loading a drive entry function of a drive layer, acquiring the version number of a current operating system by using a PsGetVersion function, and acquiring the memory address and the memory capacity of an original system service description table according to the version number of the operating system;
and searching the original system service description table according to the memory address, and copying a system service table pointed by the system service description table and an address table and a parameter table contained in the system service table.
3. The method of claim 2, further comprising:
before closing the interrupt function of the CPU occupied by the drive entry function, detecting whether other CPUs with thread connection exist in the system; if so, a deferred procedure call operation is enabled for the other CPU to block the other CPU.
4. The method of claim 3, further comprising:
storing a new system service function and/or a part of original system service functions in a system kernel in a memory space of the drive layer;
establishing the direction relation between the system service table and the system service function in the driving layer, and generating the serial numbers of all the system service functions in the new system service description table.
5. The method of claim 4, wherein the steps further comprise: the application layer detects whether a CPU installed in the system supports a rapid system call instruction or not according to the serial number of the system service function stored in the drive layer, and if not, an int 2e instruction is started; if the system service function is supported, writing the serial number of the system service function stored in the driving layer in the quick system call instruction, and setting a corresponding address table and a parameter table.
6. The method of claim 5, further comprising:
and establishing a pointing relation between the system service table and other system service functions in the system kernel.
7. The method according to claim 6, wherein the step of receiving the communication command from the application layer and calling the corresponding system service function according to the system service description table in the driver layer comprises:
and according to the system service function to be called in the communication instruction, sequentially according to the new directing relationship between the system service description table and the system service table and the directing relationship between the system service table and the system service function, determining the storage position of the system service function to be called, if the system service function is positioned in the drive layer, directly calling the system service function by the application layer, and if the system service function is positioned in the kernel, calling the system service function by the application layer through the drive layer.
8. A communication system, comprising:
creating a replacement unit, configured to allocate, according to the memory capacity of an original system service description table, a memory space not smaller than the memory capacity at a driver layer, create a new system service description table in the memory space, generate a memory address of the new system service description table, and copy a copied system service table, an address table included in the system service table, and a parameter table into the memory space; and the number of the first and second groups,
closing an interrupt function of a CPU occupied by a drive entry function, clearing a WP bit of a CR0 register, modifying a system kernel into write permission, and replacing an original system service description table and a pointing relation between the system service table and a system service function in the system kernel by using a system service description table and a pointing relation between the system service table and the system service function of a drive layer; after the memory address replacement is completed, setting the WP bit of the CR0 register as 1, and recovering the interrupt function of the occupied CPU which is closed before;
and the service receiving unit is used for receiving the communication instruction of the application layer and calling a corresponding system service function according to the system service description table in the driving layer.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610620942.9A CN106293963B (en) | 2016-08-01 | 2016-08-01 | Method and system for communication between application layer and drive layer in windows system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610620942.9A CN106293963B (en) | 2016-08-01 | 2016-08-01 | Method and system for communication between application layer and drive layer in windows system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106293963A CN106293963A (en) | 2017-01-04 |
| CN106293963B true CN106293963B (en) | 2020-02-07 |
Family
ID=57663797
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610620942.9A Active CN106293963B (en) | 2016-08-01 | 2016-08-01 | Method and system for communication between application layer and drive layer in windows system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106293963B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107357667A (en) * | 2017-06-26 | 2017-11-17 | 北京金山安全管理***技术有限公司 | Application layer and the means of communication and device of driving layer |
| CN108465244B (en) | 2018-03-30 | 2019-05-07 | 腾讯科技（深圳）有限公司 | AI method for parameter configuration, device, equipment and storage medium for racing class AI model |
| CN116708247B (en) * | 2022-09-24 | 2024-05-17 | 荣耀终端有限公司 | Router speed measuring method and router |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101334823B (en) * | 2008-07-17 | 2010-07-07 | 成都市华为赛门铁克科技有限公司 | File virtualization processing method and device |
| CN101604370B (en) * | 2009-07-06 | 2012-08-29 | 中国人民解放军信息技术安全研究中心 | Highly compatible method for monitoring Windows kernel function call |
| CN104123492A (en) * | 2014-07-21 | 2014-10-29 | 蓝盾信息安全技术有限公司 | Windows process protection method |
-
2016
- 2016-08-01 CN CN201610620942.9A patent/CN106293963B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN106293963A (en) | 2017-01-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10732905B2 (en) | Automatic I/O stream selection for storage devices | |
| US10157268B2 (en) | Return flow guard using control stack identified by processor register | |
| US9342248B2 (en) | Techniques for reducing read I/O latency in virtual machines | |
| US9268678B2 (en) | Memory defragmentation in a hosted hypervisor | |
| JP5636034B2 (en) | Mediation of mount times for data usage | |
| JP5236367B2 (en) | Shared Java JAR file | |
| US11086638B2 (en) | Method and apparatus for loading application | |
| JP5422652B2 (en) | Avoiding self-eviction due to dynamic memory allocation in flash memory storage | |
| KR101650424B1 (en) | Operation transfer from an origin virtual machine to a destination virtual machine | |
| US20080114923A1 (en) | Apparatus and method for controlling operation processing in nonvolatile memory | |
| US20140297999A1 (en) | Computer system and method for controlling acpi information | |
| US20170364449A1 (en) | Process running method and apparatus | |
| US9626112B2 (en) | eMMC functionality expander | |
| CN106293963B (en) | Method and system for communication between application layer and drive layer in windows system | |
| US11157413B2 (en) | Unified in-memory cache | |
| US20040064672A1 (en) | Method and apparatus for managing a dynamic alias page table | |
| JP2016085677A (en) | Memory management method, memory management program, and information processing device | |
| US8478956B2 (en) | Computing system and method controlling memory of computing system | |
| US9934100B2 (en) | Method of controlling memory swap operation and data processing system using same | |
| WO2023169164A1 (en) | Method and apparatus for restoring application program, and computer device and storage medium | |
| JP6245028B2 (en) | Execution control method, execution control program, and execution control apparatus | |
| US20080162783A1 (en) | Dynamically updateable and moveable memory zones | |
| WO2008135969A1 (en) | Storage device and method for data-smuggling | |
| JP2022184735A (en) | Program starting method and device, and storage medium | |
| JP5471677B2 (en) | Virtual disk control system, method and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address | ||
| CP03 | Change of name, title or address |
Address after: 100041, room 2, building 3, building 30, Xing Xing street, Shijingshan District, Beijing, Patentee after: Beijing Falcon Safety Technology Co., Ltd Address before: 100041 Beijing city Shijingshan District Street Hing 30 Hospital No. 3 Building 2 layer A-0003 Patentee before: BEIJING KINGSOFT SECURITY MANAGEMENT SYSTEM TECHNOLOGY Co.,Ltd. |