Driver repairing method and device

Abstract

An embodiment of the invention discloses a driver repairing method and device. The method comprises steps as follows: a reparative driver determines a defensive driven object corresponding to a defensive driver according to identification information of the defensive driver, wherein the reparative driver is a program which is loaded to a memory of a system of a terminal through a defensive progress when the defensive progress judges that the defensive driver conforms to preset conditions; a first execution entrance address of the defensive driver is determined from the defensive driven object; an original assembly code of the defensive driver is determined according to a file corresponding to the defensive driver; a target assembly code correspondingly stored in the first execution entrance address is modified into the original assembly code; the first execution entrance address is called, so that the defensive driver executes the original assembly code. With the adoption of the driver repairing method and device, the conditions that the driver cannot run normally and functions of the driver cannot be realized due to the fact that the driver is modified are prevented.

Description

technical field [0001] The invention relates to the field of computer information security, in particular to a driver repair method and device. Background technique [0002] When each driver is loaded, the terminal system will create a corresponding driver object for it, which contains a lot of information including the execution entry address of the driver. And the drive object can be queried through the name of the driver, and stored in the system of the terminal. [0003] The terminal system provides a module loading callback mechanism. After the driver registers a module loading callback function, when other drivers are loaded in the terminal system, the terminal system will notify the corresponding callback function of the driver that there are other Driver loading, the callback function will obtain the loading information of the other driver, the loading information includes the execution entry address of the other driver and the file path of the other driver, etc., a...

AI Technical Summary

Problems solved by technology

After processing, it will make this other driver unable to operate normally, so that its function cannot be performed

[0004] For example, in the terminal system, malicious software can use the above method to obtain the running of the driver program of the security software, the malicious software obtains the loading information of the driver program of the security software, and obtains the driver program of the security software from the loading information. The execution entry address of the execution entry address, and then modify the assembly code corresponding to the execution entry address. The meaning of the segment code is to return access denied. When the security software driver starts to execute the assembly code from the execution entry address, it will execute the modified assembly code, that is, return access denied, so that the security software driver will not be executed. The real code content, which makes the driver of the security software fail to work, and then the protection function of the security software fails, and the terminal system has security risks

Images