Process protection method, device and terminal

Abstract

The invention discloses a process protection method, device and terminal, wherein the method comprises the following steps of: creating a hook function, wherein the hook function includes a first parameter and a second parameter; the first parameter is used for storing a process handle of a process; and the second parameter is used for storing data information for setting process attribute; replacing a function address of the hook function by an original function address used for setting a kernel function of the process attribute in a system service descriptor table SSDT; judging whether the current system satisfies a process protection condition or not according to the first parameter and the second parameter; and, if the current system satisfies the process protection condition, intercepting attribute setting of a target process through the hook function. The purpose of protecting the process by intercept a process attribute setting function is achieved; therefore, the target process, such as a process of a safety element in a terminal system, is protected easily; the defence capability of the target process is improved; and safety protection to a user terminal and the system can be carried out easily.

Description

technical field [0001] The present invention relates to the field of security technology, in particular to a process protection method, device and terminal. Background technique [0002] With the rapid development of Internet technology, malicious program technologies such as viruses and Trojan horses emerge in an endless stream. Some malicious programs will use special codes to attack the security software in the terminal system. For example, if the process corresponding to the security software is terminated, the terminal cannot be protected normally after the process corresponding to the security software is terminated, destroying the security of the terminal system. protect environment. Therefore, how to effectively intercept actions of malicious programs to maliciously terminate the target process so as to protect the target process has become an urgent problem to be solved. Contents of the invention [0003] The object of the present invention is to solve one of th...

AI Technical Summary

Problems solved by technology

Some malicious programs will use special codes to attack the security software in the terminal system. For example, if the process corresponding to the security software is terminated, the terminal cannot be protected normally after the process corresponding to the security software is terminated, destroying the security of the terminal system. protect environment

Images