Summary of the invention
In view of this, technical matters to be solved by this invention there is provided a kind of method and the device that detect the installment state of application program, can carry out thorough, careful inspection in conjunction with the installation of multiple angles application programs.
In order to solve the problems of the technologies described above, the invention discloses a kind of method detecting the installment state of application program, comprising: set up cloud database, wherein preserve the fixed reference feature code for the All Files collected by each application program; Maintenance terminal configured list, the condition code of all files that each application program wherein record the installation path of each application program that described terminal is installed, obtaining according to described installation path is installed and each file; The condition code extracting each file of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges whether described application program to be detected is properly installed and feeds back to described terminal in described terminal according to comparison result.
Further, described condition code, for the condition code of file described in unique identification and file content, comprise one or more combination following: the MD5 identifying code drawn via message digest algorithm MD5 computing, Secure Hash Algorithm check code and cyclic redundancy check (CRC) code.
Further, described maintenance terminal configured list, also comprises: each application program increase newly file and/or deleted file and/or amendment file content and/or amendment file deposit path time, also in described terminal configuration list, upgrade corresponding record.
Further, the reference key assignments for the write registry entry collected by each application program is also preserved in described cloud database; The path also recording the registry entry that each application program that described terminal is installed creates in described terminal configuration list and the key assignments of each application program write registry entry obtained according to the path of described registry entry; The key assignments also extracting the write registry entry of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges be set correctly in the registration table of described application program to be detected whether in described terminal and feed back to described terminal according to comparison result.
Further, described maintenance terminal configured list, also comprise: at the path of each application modification registry entry and/or newly-increased registry entry and/or delete registry entry and/or edit the registry item content and/or amendment system registry list item content time, also in described terminal configuration list, upgrade corresponding record.
Further, reference the host process created when collected each application program is run and supporting process and/or whole dynamic link library and/or service is also preserved in described cloud database; Process and/or dynamic link library and/or service that operationally the created host process of each application program that described terminal is installed and described host process call also is recorded in described terminal configuration list; Extract according to described terminal configuration list process and/or dynamic link library that operationally the created host process of application program to be detected and described host process call and/or serve and compare in database beyond the clouds, judge the whether true(-)running feed back to described terminal in described terminal of described application program to be detected according to comparison result.
Further, described maintenance terminal configured list, also comprise: when each application program increases process and/or newly-increased supporting process and/or newly-increased dynamic link library newly and/or increases service and/or deletion process newly, also in described terminal configuration list, upgrade corresponding record.
Further, judge to comprise the feedback that described application program to be detected sends to described terminal when being properly installed in described terminal: point out described application program to be detected to be properly installed in described terminal according to comparison result; Judge the feedback sent to described terminal when being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprising: point out in the registration table of described application program to be detected in described terminal and be set correctly; According to comparison result judge described application program to be detected in described terminal during true(-)running to the feedback that described terminal sends, comprising: point out the true(-)running in described terminal of described application program to be detected; When not being set correctly when judging that described application program to be detected is not properly installed in described terminal according to comparison result and/or in registration table in described terminal and/or when there is no a true(-)running in described terminal, to the feedback that described terminal sends, comprise following one or more combination: point out the operation of the incorrect information of described application program to be detected, the described application program to be detected of prompting reparation, the described application program to be detected of prompting termination, the described application program to be detected of prompting cleaning, point out and reinstall described application program to be detected.
In order to solve the problems of the technologies described above, the invention also discloses a kind of device detecting the installment state of application program, comprising: cloud database, cloud database administration module, terminal configuration list, terminal configuration list maintenance module and compare of analysis module; Described cloud database administration module, for setting up cloud database; Described cloud database, for preserving the fixed reference feature code for the All Files collected by each application program; Described terminal configuration list maintenance module, for maintenance terminal configured list; Described terminal configuration list, all files installed for the installation path recording each application program that described terminal is installed, each application program that obtains according to described installation path and the condition code of each file; Described compare of analysis module, condition code for extracting each file of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges whether described application program to be detected is properly installed and feeds back to described terminal in described terminal according to comparison result.
Further, described compare of analysis module, the described condition code extracted, for the condition code of file described in unique identification and file content, comprise one or more combination following: the MD5 identifying code drawn via message digest algorithm MD5 computing, Secure Hash Algorithm check code and cyclic redundancy check (CRC) code.
Further, described terminal configuration list maintenance module, when maintenance terminal configured list, also for increase newly in each application program file and/or deleted file and/or amendment file content and/or amendment file deposit path time, in described terminal configuration list, upgrade corresponding record.
Further, described cloud database, also for preserving the reference key assignments for the write registry entry collected by each application program; Described terminal configuration list, also for the path of recording the registry entry that each application program that described terminal is installed creates and the key assignments of each application program write registry entry obtained according to the path of described registry entry; Described compare of analysis module, key assignments also for extracting the write registry entry of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges be set correctly in the registration table of described application program to be detected whether in described terminal and feed back to described terminal according to comparison result.
Further, described terminal configuration list maintenance module, when maintenance terminal configured list, also at the path of each application modification registry entry and/or newly-increased registry entry and/or when deleting registry entry and/or edit the registry item content and/or revise system registry list item content, in described terminal configuration list, upgrade corresponding record.
Further, described cloud database, also for preserving the reference host process and supporting process and/or all dynamic link library and/or services that create when collected each application program is run; Described terminal configuration list, also for recording the process and/or dynamic link library and/or service that operationally the created host process of each application program that described terminal is installed and described host process call; Described compare of analysis module, also compare in database beyond the clouds for extracting process and/or dynamic link library that operationally the created host process of application program to be detected and described host process call according to described terminal configuration list and/or serving, judge the whether true(-)running feed back to described terminal in described terminal of described application program to be detected according to comparison result.
Further, described terminal configuration list maintenance module, when maintenance terminal configured list, time also for increasing process and/or newly-increased supporting process and/or newly-increased dynamic link library in each application program newly and/or increasing service and/or deletion process newly, in described terminal configuration list, upgrade corresponding record.
Further, described compare of analysis module, judges to comprise the feedback that described application program to be detected sends to described terminal when being properly installed in described terminal: point out described application program to be detected to be properly installed in described terminal according to comparison result; Described compare of analysis module, judge the feedback sent to described terminal when being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprising: point out in the registration table of described application program to be detected in described terminal and be set correctly; Described compare of analysis module, according to comparison result judge described application program to be detected in described terminal during true(-)running to the feedback that described terminal sends, comprising: point out the true(-)running in described terminal of described application program to be detected; Described compare of analysis module, when not being set correctly when judging that described application program to be detected is not properly installed in described terminal according to comparison result and/or in registration table in described terminal and/or when there is no a true(-)running in described terminal, to the feedback that described terminal sends, comprise following one or more combination: the operation of described application program to be detected of pointing out the incorrect information of described application program to be detected, repair described application program to be detected, stop, clear up described application program to be detected, reinstall described application program to be detected.
Compared with existing scheme, the technique effect that the present invention obtains:
1) poor fault tolerance of viral wooden horse infection destruction and application program itself all can cause application program to be destroyed, comprise the data file of non-PE as dat file, lib file etc., even system file, all may be destroyed at any time or lose, the present invention can identify the damage of file content, and intelligent quick easily detection mode just seem especially necessary.
2) registry entry is destroyed, revises, or self problem causes failing correctly to write registry entry when application program is installed, now all cannot normally start and use application program, the present invention can identify the damage of registry entry, by this detection mode, correct startup whether can be basic after just thoroughly can running down software installation.
3) file and this static information of registry entry of supposing application program are all correct, but in certain specific environment, as under 64 systems, 32 processes and the supporting dll of process and service cannot be loaded, this situation also can think the installation of failure, the present invention can identify the damage of internal memory add-in, thus the reason that can not correctly start after thoroughly running down installation.
Embodiment
Graphic and embodiment below will be coordinated to describe embodiments of the present invention in detail, by this to the present invention how application technology means solve technical matters and the implementation procedure reaching technology effect can fully understand and implement according to this.
The main thought of the application
Detect key assignments, the internal memory add-in operationally of the condition code of each file of application program to be detected, write registry entry respectively;
The condition code of any file has uniqueness, after application program is installed, if the file content of amendment application program replaced by other viral wooden horses or hook, or the fault-tolerance of application program own is very poor, cause the file of application program corrupted or deleted or replace, then can verify out by condition code.
Application program can create different registry entries at registration table after installing, comprise and item, service entry, starting up's item, user's registration information etc. are installed, such as, can load the high service entry of priority before antivirus software logs in after powering, described service entry must get the jump on before viral wooden horse starts and start, the normal operation of such guarantee antivirus software, so also need the key assignments detecting write registry entry.
After application program is installed, host process can be started, host process also can call other supporting processes, dynamic link library (dll), service voluntarily afterwards, in some environments, application program cannot normally start process and load supporting process, dll and service, if be filled with the incorrect module application program of other third party's processes or dll or other in addition also can make mistakes, so also need the internal memory add-in detected operationally, described internal memory add-in comprises: the process that the host process created and described host process are called and/or dynamic link library and/or service.
the application scenarios of the application
1), after application program is completed by user installation, the problem that can run in a series of use even cannot start software; Now user usually seeks help from contact staff, but reviews reason as contact staff long-range being difficult to, and such as application program is not properly installed and is still destroyed, or the functional issues of application program itself; Now be suitable for application the present invention intelligence and check whether file is mounted, and whether registry entry (as mount message, service entry, the items such as user profile) is write, whether start process under specific user environment, load dll module, start service.
2) tester of application program is when testing, test application is often first wanted whether to be properly installed, then could whether the function of inspection software own be correct further, such as install the large-scale office software reaching 1G, the inside has several ten thousand files, also needs to write thousand registry entries, after installing, middle there is any link, be all whether be difficult to trace software be mounted makeing mistakes or the BUG of software itself, be now suitable for applying the present invention and investigate intelligently.
3) Develop Application System personnel are when developing large software, each developer can not be responsible for the exploitation of all modules, just be responsible for exploitation and the integrated debugging of part of module, in order to ensure the integrality of debugging, be now suitable for application the present invention intelligence and check whether file is mounted.
Certainly, the application is not limited to above application scenarios, also there are other and is applicable to relate to mass data and browses and the scene of data layout editor.
embodiment describes
With an embodiment, method of the present invention is described below.As shown in Figure 1, be the method flow diagram of the installment state of the detection application program of the embodiment of the present invention, perform and operate as follows:
Step S10, detects the condition code of each file of application program to be detected, judges whether described application program to be detected correctly installs in described terminal according to testing result.
Step S20, detects the key assignments of application program to be detected write registry entry, judges whether described application program to be detected is correctly arranged in described terminal according to testing result.
Step S30, detects application program to be detected internal memory add-in operationally, judges the whether true(-)running in described terminal of described application program to be detected according to testing result.
The installment state of application program comprises: whether application program to be detected correctly installs in described terminal, correctly setting and/or true(-)running.Above-mentioned steps S10, S20, S30 there is no execution order, can perform simultaneously, also successively can perform by any order, from the situation of the detection application program to be detected of above three parallel angle solids.
With an embodiment, above-mentioned steps S10 is described below.As shown in Figure 2, be the process flow diagram of embodiment of the present invention step S10, perform and operate as follows:
Step S102, sets up cloud database, wherein preserves the fixed reference feature code for the All Files collected by each application program;
Described condition code is the condition code of file described in unique identification and file content, comprises one or more combination following: the MD5 identifying code drawn via message digest algorithm MD5 computing, Secure Hash Algorithm SHA1 check code and cyclic redundancy CRC check code.
Described fixed reference feature code can be reference value that is correct, that be judged to be correct installation, is realized by white list; Described fixed reference feature code also can be reference value that is wrong, that be judged to be correct installation, is realized by blacklist.
Step S104, maintenance terminal configured list, the condition code of all files that each application program wherein record the installation path of each application program that described terminal is installed, obtaining according to described installation path is installed and each file;
By having the API(application programming interface of the function whether file or catalogue exist) function obtains the installation path of each application program that described terminal is installed, such as PathFileExists function, PathFileExists function is for determining whether the path of the file system object of a file or catalogue is effective; According to described installation path, the all files of each application program installation is obtained by the api function of the function with enumerate file or file, such as FindFirstFile function and FindNextFile function, FindFirstFile function is used for according to filename locating file, and the filename that FindNextFile function is used for according to specifying when calling FindFirstFile function searches next file.
Each application program increase newly file and/or deleted file and/or amendment file content (comprising system file) and/or amendment file deposit path time, also in described terminal configuration list, upgrade corresponding record.
Step S106, the condition code extracting each file of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges whether described application program to be detected is properly installed and feeds back to described terminal in described terminal according to comparison result.
When fixed reference feature code is kept at the white list of described cloud database, if find after comparison condition code in terminal configuration list all hit by the fixed reference feature code in cloud database, now can judge that described application program to be detected is properly installed in described terminal; As long as if having after comparison the condition code in a terminal configuration list not hit by the fixed reference feature code in cloud database, now can judge that described application program to be detected is not properly installed in described terminal.
When fixed reference feature code is kept at the blacklist of described cloud database, as long as if find after comparison in terminal configuration list have a condition code all hit by the fixed reference feature code in cloud database, now can judge that described application program to be detected is not properly installed in described terminal; If the condition code after comparison in terminal configuration list all not hit by the fixed reference feature code in cloud database, now can judge that described application program to be detected is properly installed in described terminal.
Judge to comprise the feedback that described application program to be detected sends to described terminal when being properly installed in described terminal: point out described application program to be detected to be properly installed in described terminal according to comparison result;
Judge the feedback that described application program to be detected sends to described terminal when not being properly installed in described terminal to comprise following one or more combination according to comparison result: point out the operation of the incorrect information of described application program to be detected, the described application program to be detected of prompting reparation, the described application program to be detected of prompting termination, the described application program to be detected of prompting cleaning, point out and reinstall described application program to be detected.
With an application example, above-mentioned steps S10 is described below.Application program to be detected is for Fetion, and condition code can be obtained by hash algorithm for MD5, MD5 value.
Preserve the reference MD5 value for the All Files collected by each application program in cloud database, described is correct reference value with reference to MD5 value, such as, wherein at least comprise:
Fetion.exe&8af829e342a6b15696af9650ad5f805c
fxWebBrowser.exe&8af829e342a6b15696af9650ad5f8051
Fetion.lib&8af829e342a6b15696af9650ad5f8052
Wherein, Fetion.exe, fxWebBrowser.exe, Fetion.lib are files, 8af829e342a6b15696af9650ad5f805c is the MD5 value that Fetion.exe is corresponding, 8af829e342a6b15696af9650ad5f8051 is the MD5 value that fxWebBrowser.exe is corresponding, and 8af829e342a6b15696af9650ad5f8052 is the MD5 value that Fetion.lib is corresponding.
The MD5 value of log file path in terminal configuration list, file and file, such as:
File1="C:\ProgramFiles\ChinaMobile\Fetion\Fetion.exe"&8af829e342a6b15696af9650ad5f805c
File1="C:\ProgramFiles\ChinaMobile\Fetion\fxWebBrowser.exe"&8af829e342a6b15696af9650ad5f8051
File1="C:\ProgramFiles\ChinaMobile\Fetion\Fetion.lib"&8af829e342a6b15696af9650ad5f8052
In above form, Fetion.exe, fxWebBrowser.exe, Fetion.lib are files, C: ProgramFiles ChinaMobile Fetion be file path, 8af829e342a6b15696af9650ad5f805c is the MD5 value that Fetion.exe is corresponding, 8af829e342a6b15696af9650ad5f8051 is the MD5 value that fxWebBrowser.exe is corresponding, 8af829e342a6b1596af9650ad5f8052 is the MD5 value that Fetion.lib is corresponding, and Fetion.lib is non-PE file.
Increase file (comprise interim generate file) newly at application program Fetion, path that deleted file, amendment file content (comprising amendment windows system file), file store time, the parameter recorded in terminal configuration list can upgrade adjustment automatically.
The MD5 value extracting Fetion.exe, fxWebBrowser.exe, Fetion.lib of Fetion according to described terminal configuration list is compared in database beyond the clouds, if find after comparison MD5 in terminal configuration list all hit by the reference MD5 value in cloud database, now can judge that described application program to be detected is properly installed in described terminal; As long as if having in terminal configuration list after comparison a MD5 not hit by the reference MD5 value in cloud database, now can judge that described application program to be detected is not properly installed in described terminal.
With an embodiment, above-mentioned steps S20 is described below.As shown in Figure 3, be the process flow diagram of embodiment of the present invention step S20, perform and operate as follows:
Step S202, sets up cloud database, wherein preserves the reference key assignments for the write registry entry collected by each application program;
Described can be reference value that is correct, that be judged to be correct installation with reference to key assignments, is realized by white list; Described also can be reference value that is wrong, that be judged to be correct installation with reference to key assignments, is realized by blacklist.
Step S204, maintenance terminal configured list, the path wherein recording the registry entry that each application program that described terminal is installed creates and the key assignments of each application program write registry entry obtained according to the path of described registry entry;
The path of the registry entry that each application program creates and the key assignments of write registry entry is obtained by the api function with the function of carrying out read-write operation under the registry entry of specifying, such as SHGetValue function and RegCreateKeyEx function, SHGetValue function is used for carrying out read-write operation under the registry entry of specifying; RegCreateKeyEx function is used for, specifying the complex way creating new item under registry entry, using in Win32 environment.
At the path of each application modification registry entry and/or newly-increased registry entry and/or when deleting registry entry and/or edit the registry item content and/or revise system registry list item content, also in described terminal configuration list, upgrade corresponding record.
Step S206, the key assignments extracting the write registry entry of application program to be detected according to described terminal configuration list is compared in database beyond the clouds, judges be set correctly in the registration table of described application program to be detected whether in described terminal and feed back to described terminal according to comparison result;
When being kept at the white list of described cloud database with reference to key assignments, if find after comparison key assignments in terminal configuration list all hit by the reference key assignments in cloud database, now can judge that described application program to be detected is set correctly in described terminal; As long as if having in terminal configuration list after comparison a key assignments not hit by the reference key assignments in cloud database, now can judge that described application program to be detected is not set correctly in described terminal.
When being kept at the blacklist of described cloud database with reference to key assignments, as long as if find after comparison to have in terminal configuration list a key assignments all hit by the reference key assignments in cloud database, now can judge that described application program to be detected is not set correctly in described terminal; If the key assignments after comparison in terminal configuration list all not hit by the reference key assignments in cloud database, now can judge that described application program to be detected is set correctly in described terminal.
Judge the feedback sent to described terminal when being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprising: point out in the registration table of described application program to be detected in described terminal and be set correctly;
Judge the feedback sent to described terminal when not being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprise following one or more combination: point out the operation of the incorrect information of described application program to be detected, the described application program to be detected of prompting reparation, the described application program to be detected of prompting termination, the described application program to be detected of prompting cleaning, point out and reinstall described application program to be detected.
With an application example, above-mentioned steps S20 is described below.Application program to be detected is for Fetion.
Preserve the reference key assignments for the write registry entry collected by each application program in cloud database, described is correct reference value with reference to key assignments, such as, wherein at least comprise:
″\″C:\\Program Files\\China Mobile\\Fetion\\Fetion.exe\″\″%1\″″。
The path of registry entry and the key assignments of write registry entry is recorded in terminal configuration list, such as:
[HKEY_CLASSES_ROOT\Applications\Fetion.exe\shell\open\command]@="\"C:\\Program Files\\China Mobile\\Fetion\\Fetion.exe\″\″%1\″″
In above form, [HKEY_CLASSES_ROOT Applications Fetion.exe shell open command] be the path of registry entry, " " C: Program Files China Mobile Fetion Fetion.exe " " %1 " " be the key assignments of the registry entry of write.
Application program Fetion is in the path of edit the registry, when newly-increased registry entry (comprising the interim registry entry generated), deletion registry entry, edit the registry item content (comprising amendment windows registry entry), the parameter recorded in terminal configuration list can upgrade adjustment automatically.
The key assignments extracting the registry entry of Fetion write according to described terminal configuration list is compared in database beyond the clouds, if find after comparison key assignments in terminal configuration list all hit by the reference key assignments in cloud database, now can judge that described application program to be detected is set correctly in described terminal; As long as if having in terminal configuration list after comparison a key assignments not hit by the reference key assignments in cloud database, now can judge that described application program to be detected is not set correctly in described terminal.
With an embodiment, above-mentioned steps S30 is described below.As shown in Figure 4, be the process flow diagram of embodiment of the present invention step S30, perform and operate as follows:
Step S302, sets up cloud database, wherein preserves the reference host process and supporting process and/or all dynamic link library and/or services that create when collected each application program is run;
Described with reference to host process and supporting process and/or all dynamic link library and/or service can be reference value that is correct, that be judged to be correct installation, realized by white list; Described with reference to host process and supporting process and/or all dynamic link library and/or service also can be wrong, be judged to be correct reference value of installing, realized by blacklist.
Step S304, maintenance terminal configured list, wherein records process and/or dynamic link library and/or service that operationally the created host process of each application program that described terminal is installed and described host process call;
The api function setting up the function of snapshot by the heap having process for specifying, process uses, module, thread obtains the process and/or dynamic link library and/or service that operationally the created host process of each application program and described host process call, such as CreateToolhelp32Snapshot function, the heap [HEAP] that CreateToolhelp32Snapshot function uses for the process for specifying, process, module [MODULE], thread [THREAD] set up a snapshot.
When each application program increases process and/or newly-increased supporting process and/or newly-increased dynamic link library newly and/or increases service and/or deletion process newly, also in described terminal configuration list, upgrade corresponding record.
Step S306, extract according to described terminal configuration list process and/or dynamic link library that operationally the created host process of application program to be detected and described host process call and/or serve and compare in database beyond the clouds, judge the whether true(-)running feed back to described terminal in described terminal of described application program to be detected according to comparison result;
When reference value is kept at the white list of described cloud database, if find after comparison the process that host process in terminal configuration list and described host process are called and/or dynamic link library and/or service all hit by the reference value in cloud database, now can judge that described application program to be detected is set correctly in described terminal; As long as if the process having a host process and described host process to call after comparison in terminal configuration list and/or dynamic link library and/or service not hit by the reference value in cloud database, now can judge that described application program to be detected is not set correctly in described terminal.
When reference value is kept at the blacklist of described cloud database, as long as if the process finding after comparison to have a host process and described host process to call in terminal configuration list and/or dynamic link library and/or service all hit by the reference key assignments in cloud database, now can judge that described application program to be detected is not set correctly in described terminal; If the process that the host process after comparison in terminal configuration list and described host process are called and/or dynamic link library and/or service all not hit by the reference key assignments in cloud database, now can judge that described application program to be detected is set correctly in described terminal.
According to comparison result judge described application program to be detected in described terminal during true(-)running to the feedback that described terminal sends, comprising: point out the true(-)running in described terminal of described application program to be detected;
Judge that described application program to be detected does not have the feedback sent to described terminal during true(-)running in described terminal according to comparison result, comprise following one or more combination: point out the operation of the incorrect information of described application program to be detected, the described application program to be detected of prompting reparation, the described application program to be detected of prompting termination, the described application program to be detected of prompting cleaning, point out and reinstall described application program to be detected.
With an application example, above-mentioned steps S30 is described below.Application program to be detected is for Fetion.
The reference host process and supporting process and/or all dynamic link library and/or services that create when collected each application program is run is preserved in cloud database, described with reference to host process and supporting process and/or all dynamic link library and/or service be correct reference value, such as wherein at least comprise:
Host process Fetion.exe, supporting dynamic link library ADVAPI32.dll and AvatarX.dll.
Process and/or dynamic link library and/or service that operationally the created host process of each application program and described host process call is recorded in terminal configuration list, such as:
Exe1=Fetion.exe&ADVAPI32.dll&AvatarX.dll
Exe2=…
In above form, Fetion.exe is host process, and ADVAPI32.dll is the supporting dynamic link library of host process Fetion.exe, and AvatarX.dll is also the supporting dynamic link library of host process Fetion.exe.
Application program Fetion in newly-increased process (comprise interim load process), newly-increased supporting dll(comprises needs to inject windows system process or dll), newly-increased supporting service, deletion process time, the parameter recorded in terminal configuration list can upgrade adjustment automatically.
Extract according to described terminal configuration list reference the host process and supporting process and/or whole dynamic link library that create when Fetion runs and/or serve and compare in database beyond the clouds, if find after comparison host process in terminal configuration list and supporting process and/or all dynamic link library and/or service all hit by the reference value in cloud database, now can judge described application program to be detected in described terminal by true(-)running; As long as if the host process after comparison in terminal configuration list and supporting process and/or all dynamic link library and/or service have one not hit by the reference value in cloud database, now can judge described application program to be detected in described terminal not by true(-)running.
Below be described device of the present invention with three device embodiments, described device is corresponding with said method flow process again, and weak point can with reference to said method part.As shown in Figure 5, for detecting the device of the installment state of application program, comprising: cloud database 1, cloud database administration module 2, terminal configuration list 3, terminal configuration list maintenance module 4 and compare of analysis module 5.
first device embodiment
Described cloud database administration module 2, for setting up cloud database 1;
Described cloud database 1, for preserving the fixed reference feature code for the All Files collected by each application program;
Described terminal configuration list maintenance module 4, for maintenance terminal configured list 3;
Described terminal configuration list 3, all files installed for the installation path recording each application program that described terminal is installed, each application program that obtains according to described installation path and the condition code of each file;
Described compare of analysis module 5, condition code for extracting each file of application program to be detected according to described terminal configuration list 3 is compared in database 1 beyond the clouds, judges whether described application program to be detected is properly installed and feeds back to described terminal in described terminal according to comparison result.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, the application programming interface api function be further used for by having the function whether file or catalogue exist obtains the installation path of each application program that described terminal is installed; Be further used for according to described installation path, obtained all files of each application program installation by the api function of the function with enumerate file or file.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, also for increase newly in each application program file and/or deleted file and/or amendment file content (comprising system file) and/or amendment file deposit path time, in described terminal configuration list 3, upgrade corresponding record.
Described condition code is the condition code of file described in unique identification and file content, comprises one or more combination following: the MD5 identifying code drawn via message digest algorithm MD5 computing, Secure Hash Algorithm check code and cyclic redundancy check (CRC) code.
Described compare of analysis module 5, judges to comprise the feedback that described application program to be detected sends to described terminal when being properly installed in described terminal: point out described application program to be detected to be properly installed in described terminal according to comparison result; The feedback that sends to described terminal when judging that described application program to be detected is not properly installed in described terminal according to comparison result, comprises following one or more combination: the operation of described application program to be detected of pointing out the incorrect information of described application program to be detected, repair described application program to be detected, stop, clear up described application program to be detected, reinstall described application program to be detected.
second device embodiment
Described cloud database administration module 2, for setting up cloud database 1;
Described cloud database 1, for preserving the reference key assignments for the write registry entry collected by each application program;
Described terminal configuration list maintenance module 4, for maintenance terminal configured list 3;
Described terminal configuration list 3, for the path of recording the registry entry that each application program that described terminal is installed creates and the key assignments of each application program write registry entry obtained according to the path of described registry entry;
Described compare of analysis module 5, key assignments for extracting the write registry entry of application program to be detected according to described terminal configuration list 3 is compared in database 1 beyond the clouds, judges be set correctly in the registration table of described application program to be detected whether in described terminal and feed back to described terminal according to comparison result.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, the api function be further used for by having the function of carrying out read-write operation under the registry entry of specifying obtains the path of the registry entry that each application program creates and the key assignments of write registry entry.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, also at the path of each application modification registry entry and/or newly-increased registry entry and/or when deleting registry entry and/or edit the registry item content and/or revise system registry list item content, in described terminal configuration list 3, upgrade corresponding record.
Described compare of analysis module 5, judge the feedback sent to described terminal when being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprising: point out in the registration table of described application program to be detected in described terminal and be set correctly; Judge the feedback sent to described terminal when not being set correctly in the registration table of described application program to be detected in described terminal according to comparison result, comprise following one or more combination: the operation of described application program to be detected of pointing out the incorrect information of described application program to be detected, repair described application program to be detected, stop, clear up described application program to be detected, reinstall described application program to be detected.
3rd device embodiment
Described cloud database administration module 2, for setting up cloud database 1;
Described cloud database 1, for preserving the reference host process and supporting process and/or all dynamic link library and/or services that create when collected each application program is run;
Described terminal configuration list maintenance module 4, for maintenance terminal configured list 3;
Described terminal configuration list 3, also for recording the process and/or dynamic link library and/or service that operationally the created host process of each application program that described terminal is installed and described host process call;
Described compare of analysis module 5, also compare in database 1 beyond the clouds for extracting process and/or dynamic link library that operationally the created host process of application program to be detected and described host process call according to described terminal configuration list 3 and/or serving, judge the whether true(-)running feed back to described terminal in described terminal of described application program to be detected according to comparison result.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, the api function being further used for setting up the function of snapshot by the heap having process for specifying, process uses, module, thread obtains the process and/or dynamic link library and/or service that operationally the created host process of each application program and described host process call.
Described terminal configuration list maintenance module 4, when maintenance terminal configured list 3, time also for increasing process and/or newly-increased supporting process and/or newly-increased dynamic link library in each application program newly and/or increasing service and/or deletion process newly, in described terminal configuration list 3, upgrade corresponding record.
Described compare of analysis module 5, according to comparison result judge described application program to be detected in described terminal during true(-)running to the feedback that described terminal sends, comprising: point out the true(-)running in described terminal of described application program to be detected; Judge that described application program to be detected does not have the feedback that sends to described terminal during true(-)running in described terminal according to comparison result, comprise following one or more combination: the operation of described application program to be detected of pointing out the incorrect information of described application program to be detected, repair described application program to be detected, stop, clear up described application program to be detected, reinstall described application program to be detected.
It should be noted that, when not conflicting, the embodiment in the present invention and the feature in embodiment can combination in any mutually.
Certainly; the present invention also can have other various embodiments; when not deviating from the present invention's spirit and essence thereof; those of ordinary skill in the art can make various corresponding change and distortion according to the present invention, but these change accordingly and are out of shape the protection domain that all should belong to the claim appended by the present invention.
One of ordinary skill in the art will appreciate that in said method all or part of step carrys out instruction by program, related hardware completes, described program can be stored in computer-readable recording medium, as ROM (read-only memory), disk or CD etc.Alternatively, all or part of step of above-described embodiment also can use one or more integrated circuit to realize.Correspondingly, each module/unit in above-described embodiment can adopt the form of hardware to realize, and the form of software function module also can be adopted to realize.The present invention is not restricted to the combination of the hardware and software of any particular form.