WO2019000737A1

WO2019000737A1 - File decryption method and device, computer readable storage medium and apparatus

Info

Publication number: WO2019000737A1
Application number: PCT/CN2017/107619
Authority: WO
Inventors: 周志刚; 张文明; 陈少杰
Original assignee: 武汉斗鱼网络科技有限公司
Priority date: 2017-06-30
Filing date: 2017-10-25
Publication date: 2019-01-03
Also published as: CN107423634A; CN107423634B

Abstract

The present invention relates to the technical field of information processing. Disclosed are a file decryption method and device, computer readable storage medium and apparatus. The method comprises: acquiring a first hook function for hooking a file opening function and a second hook function for hooking a file reading function (101); in the process of performing an opening operation on a target file, calling the first hook function to determine whether the target file is in a list of files under decryption, then calling the file opening function to perform the opening operation on the target file, and if the target file is in the list of files under decryption, storing a file handle of the target file to a list of file handles under decryption (102); in the process of performing a reading operation on the target file, calling the second hook function to determine whether the file handle of the target file is in the list of file handles under decryption, if the file handle of the target file is in the list of file handles under decryption, acquiring a decryption key and performing a decryption operation on the target file using the decryption key, and calling the file reading function to perform the reading operation on the target file (103), thereby enabling automatic decryption of a target file at a low level of a system.

Description

File decryption method, device, computer readable storage medium and device

Technical field

The present invention relates to the field of information processing technologies, and in particular, to a file decryption method, apparatus, computer readable storage medium, and device.

Background technique

At present, software development usually adopts modular development, that is, modularizes the functions of software, different modules are responsible for different functions, and at the same time, when designing modules, the modules are loosely coupled as much as possible, that is, the modules can Used independently, and allows different developers to develop different modules. However, since different modules are developed by different developers, it is very likely that the file is not decrypted due to a person's negligence, and thus the read content is wrong. Therefore, the prior art needs a method for decrypting the file. .

Summary of the invention

In view of the above problems, the present invention has been made in order to provide a file decrypting method, apparatus, computer readable storage medium and apparatus that overcome the above problems or at least partially solve the above problems.

The present invention provides a file decryption method, the method comprising:

Obtaining a first hook function for hooking the open file function and a second hook function for hooking the read file function;

In the process of performing the opening operation on the target file, first calling the first hook function to determine whether the target file is located in the file list to be decrypted, and then calling the open file function to open the target file, where If the target file is located in the to-be-decrypted file list, save the file handle of the target file to the file handle list to be decrypted;

In the process of performing the read operation on the target file, first calling the second hook function to determine whether the file handle of the target file is located in the file handle list to be decrypted, if the file handle of the target file is located in the In the case of the decrypted file handle list, the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to perform a read operation on the target file.

Preferably, the obtaining the decryption key comprises:

The decryption key is obtained from the server.

Preferably, the decrypting operation on the target file includes:

The target file is decrypted using the TEA algorithm.

Preferably, the parameter type of the first hook function is the same as the parameter type of the open file function, and the parameter type of the second hook function is the same as the parameter type of the read file function.

The invention also provides a file decryption device, the device comprising:

An obtaining module, configured to obtain a first hook function for hooking the open file function and a second hook function for hooking the read file function;

a first calling module, configured to: in the process of performing an opening operation on the target file, first calling the first hook function to determine whether the target file is located in a file list to be decrypted, and then calling the open file function to the target The file is opened, wherein if the target file is located in the list of files to be decrypted, the file handle of the target file is saved in the file handle list to be decrypted;

a second calling module, configured to: in the process of performing a read operation on the target file, first calling the second hook function to determine whether a file handle of the target file is located in the file handle list to be decrypted, if The file handle of the target file is located in the file handle list to be decrypted, then the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to the target file. Read it.

Preferably, the first calling module includes:

An obtaining unit, configured to acquire the decryption key from a server.

Preferably, the second calling module comprises:

And a decryption unit, configured to perform a decryption operation on the target file by using a TEA algorithm.

The embodiment of the invention further provides a computer readable storage medium, on which a computer program is stored, and when the program is executed by the processor, the following steps are implemented:

The present invention also provides a computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor implementing the program to implement the following steps:

Get the first hook function for hooking the open file function and the first function for hooking the read file function Two hook function;

One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages:

The first hook function for hooking the open file function and the second hook function for hooking the read file, in the process of opening the target file, first calling the first hook function to determine whether the target file is located In the list of files to be decrypted, the open file function is called to open the target file, wherein if the target file is located in the file list to be decrypted, the file handle of the target file is saved to the file handle list to be decrypted, and the target file is During the read operation, the second hook function is first called to determine whether the file handle of the target file is located in the file handle list to be decrypted, and if the file handle of the target file is located in the file handle list to be decrypted, the decryption key is obtained, and The decryption key is used to decrypt the target file, and then the read file function is called to read the target file, thereby automatically decrypting the target file at the bottom of the system, ensuring that the encrypted file can be correctly decrypted, and at the same time, each module Developers no longer need to care about the decryption of files.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Further, the same components are denoted by the same reference numerals throughout the drawings. In the drawing:

1 is a flow chart showing a method for decrypting a file in an embodiment of the present invention;

2 is a structural diagram of a file decryption apparatus in an embodiment of the present invention;

FIG. 3 is a diagram showing the physical structure of a computer device in an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be The embodiments set forth herein are limited. Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

The embodiment of the present application provides a file decryption method, where the file decryption method is applied to a client. As shown in FIG. 1, the method includes:

Step 101: Acquire a first hook function for hooking the open file function and a second hook function for hooking the read file function.

Step 102: In the process of performing an open operation on the target file, first calling the first hook function to determine whether the target file is located in a file list to be decrypted, and then calling the open file function to open the target file. And, if the target file is located in the to-be-decrypted file list, save the file handle of the target file to the file handle list to be decrypted.

Step 103: In the process of performing a read operation on the target file, first calling the second hook function to determine whether a file handle of the target file is located in the file handle list to be decrypted, if the file of the target file The handle is located in the file handle list to be decrypted, then obtains a decryption key, and decrypts the target file by using the decryption key, and then invokes the read file function to perform a read operation on the target file.

Specifically, in the present application, the first hook function is used to hook the open file function, and the second hook function is used to hook the read file function, and the first hook function and the second hook function are executed and the first hook is executed. The process of the function and the second hook function is described in detail.

For the first hook function, the present application uses Detours to hook up (HOOK) the Windows open file function (CreateFile), thereby realizing the technical effect of monitoring the operation of all open files in the main program. Specifically, in the process of opening the target file, using Detours to implement the HOOK of the CreateFile function is as follows:

DetourAttach(&(PVOID&)CreateFile, MY_CreateFile);

The first parameter in the above formula is the memory address of the CreateFile function, and the second parameter in the above formula is the first hook function (MY_CreateFile). In the process of opening the target file, call MY_CreateFile and call the CreateFile function.

Among them, the function prototype of the CreateFile function is as follows:

HANDLE CreateFile(

LPCTSTR IpFileName,

DWORD dwDesiredAccess,

DWORD dwShareMode,

LPSECURITY_ATTRIBUTES IpSecurityAttributes,

DWORD dwCreationDisposition,

DWORD dwFlagsAndAttributes,

HANDLE hTemplateFile);

The parameter IpFileName indicates the name of the open file, the parameter dwDesiredAccess indicates whether to open the file for reading or writing, the parameter dwShareMode indicates the sharing mode of the file, the parameter IpSecurityAttributes indicates the security attribute of the file, and the parameter dwCreationDisposition indicates the operation of opening the file, whether it is created or Open an existing file, the parameter dwFlagsAndAttributes specifies the file's attributes and flags, and the parameter hTemplateFile specifies the template file.

Among them, the function of the first hook function (MY_CreateFile) is implemented as follows:

The parameter type of the first hook function is the same as the parameter type of the open file function.

In the specific implementation process, in the process of opening the target file, the first hook function is first called to determine whether the target file is located in the file list to be decrypted, and then the open file function is called to open the target file. The server stores a list of files to be decrypted, and the file name of the file to be decrypted is stored in the file list to be decrypted, and the client obtains the list of files to be decrypted from the server, and locally determines whether the file name of the target file is to be decrypted. In the file list. If the file name of the target file exists in the file list to be decrypted, the file handle of the target file is saved in the file handle list to be decrypted, and the file handle corresponding to the decrypted file is saved in the file handle list to be decrypted.

It should be noted that, in the process of reading the file, the name of the file does not exist. Therefore, the present application first judges the file name, and then saves the file handle to implement the subsequent judgment process.

For the second hook function, the present application uses Detours to hook the Windows write file function (ReadFile), thereby realizing the technical effect of monitoring the operation of all the read files in the main program. Specifically, in the process of reading the target file, the implementation of the HOOK of the ReadFile function using Detours is as follows:

DetourAttach(&(PVOID&)ReadFile, MY_ReadFile);

Among them, the first parameter in the above formula is the memory address of the ReadFile function, and the second parameter in the above formula is the second hook function (MY_ReadFile).

Among them, the function prototype of the ReadFile function is as follows:

BOOL ReadFile(

HANDLE hFile,

LPVOID IpBuffer,

DWORD nNumberOfBytesToRead,

LPDWORD IpNumberOfBytesRead,

LPOVERLAPPED IpOverlapped);

Among them, the parameter hFile is the handle of the file, the parameter IpBuffer is the place where the read file is stored, the parameter nNumberOfBytesToRead indicates the number of bytes that need to be read, the parameter IpNumberOfBytesRead indicates the number of bytes actually read, and the parameter IpOverlapped indicates the file. Asynchronous read operation.

Among them, the function of the second hook function (MY_ReadFile) is implemented as follows:

The parameter type of the second hook function is the same as the parameter type of the write file function.

In the specific implementation process, in the process of reading the target file, the second hook function is first called to determine whether the file handle of the target file is located in the file handle list to be decrypted, if the file handle of the target file is located in the file handle list to be decrypted. In the middle, the decryption key is obtained, and the decryption key is used to decrypt the target file, and then the read file function is called to read the target file, thereby ensuring that the target file is decrypted before performing the read operation, and the content of the file is used in the present application. Read after decryption.

In the specific implementation process, the content of the read file is stored in the IpBuffer, and the file size read by the file is stored in the nNumberOfBytesToRead. The present application uses the TEA decryption algorithm to decrypt the data. Specifically, the code corresponding to the decryption operation is as follows:

TEA.decrypt(IpBuffer, IpNumberOfBytesRead, KEY)

The KEY is a decryption key, and the decryption key is stored in the server. The application obtains the decryption key by initiating a request to the server.

The function code corresponding to each step of the present application is written in the main program, so that when the main program is initialized, each function code is called, and the effect of decrypting the file at the bottom layer is realized, so that the other Module developers do not need to understand the decryption function of the file, thus avoiding the module developer missing the decryption operation and generating errors.

The embodiment of the invention further provides a file decryption device. As shown in FIG. 2, the device includes:

The obtaining module 201 is configured to obtain a first hook function for hooking the open file function and a second hook function for hooking the read file function;

The first calling module 202 is configured to: in the process of performing an opening operation on the target file, first calling the first hook function to determine whether the target file is located in a file list to be decrypted, and then calling the open file function to The target file is opened, wherein if the target file is located in the to-be-decrypted file list, the file handle of the target file is saved to the file handle list to be decrypted;

The second invoking module 203 is configured to: in the process of performing a read operation on the target file, first calling the second hook function to determine whether a file handle of the target file is located in the file handle list to be decrypted, if The file handle of the target file is located in the file handle list to be decrypted, and then the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to the target. The file is read.

Preferably, the first calling module 202 includes:

An obtaining unit, configured to acquire the decryption key from a server.

Preferably, the second invoking module 203 comprises:

The embodiment of the present invention further provides a computer device. As shown in FIG. 3, for the convenience of description, only parts related to the embodiment of the present invention are shown. If the specific technical details are not disclosed, please refer to the method part of the embodiment of the present invention. . The computer device may be any terminal device including a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), an in-vehicle computer, and the like, and the computer device is used as a mobile phone as an example:

3 is a block diagram showing a portion of the structure associated with a computer device provided by an embodiment of the present invention. Referring to FIG. 3, the computer device includes a memory 301 and a processor 302. Those skilled in the art will appreciate that the computer device architecture illustrated in FIG. 3 does not constitute a limitation to a computer device, and may include more or fewer components than those illustrated, or some components may be combined, or different component arrangements.

The specific components of the computer device will be specifically described below with reference to FIG. 3:

The memory 301 can be used to store software programs and modules, and the processor 302 executes various functional applications and data processing by running software programs and modules stored in the memory 301. The memory 301 can mainly include a storage program area and a storage data area, wherein the storage program area can store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area can store data. (such as audio data, phone book, etc.). Further, the memory 301 may include a high speed random access memory, and may also include a nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The processor 302 is a control center of a computer device that performs various functions and processing data by running or executing software programs and/or modules stored in the memory 301, and recalling data stored in the memory 301. Optionally, the processor 302 may include one or more processing units; preferably, the processor 302 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. The modem processor primarily handles wireless communications.

In the embodiment of the present invention, the processor 302 included in the computer device may have the following functions:

In summary, the present application firstly calls the first hook function to determine the target file in the process of opening the target file by using the first hook function for hooking the open file function and the second hook function for hooking the read file. Whether it is located in the list of files to be decrypted, and then call the open file function to open the target file, wherein if the target file is located in the file list to be decrypted, the file handle of the target file is saved to the file handle list to be decrypted, in the pair In the process of reading the target file, the second hook function is first used to determine whether the file handle of the target file is located in the file handle list to be decrypted. If the file handle of the target file is located in the file handle list to be decrypted, the decryption key is obtained. And decrypting the target file by using the decryption key, and then calling the read file function to read the target file, thereby automatically decrypting the target file at the bottom of the system, ensuring that the encrypted file can be correctly decrypted, and at the same time, Developers of each module no longer need to care about the decryption of files .

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those specifically recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose, unless stated otherwise. To replace.

In addition, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments and not other features, combinations of features of different embodiments are intended to be within the scope of the present invention. And different embodiments are formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some, or all, of the gateways, proxy servers, systems in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of words, second, third, etc. does not indicate any order. These words can be interpreted as names.

Claims

A file decryption method, characterized in that the method comprises:

Obtaining a first hook function for hooking the open file function and a second hook function for hooking the read file function;

In the process of performing the opening operation on the target file, first calling the first hook function to determine whether the target file is located in the file list to be decrypted, and then calling the open file function to open the target file, where If the target file is located in the to-be-decrypted file list, save the file handle of the target file to the file handle list to be decrypted;

In the process of performing the read operation on the target file, first calling the second hook function to determine whether the file handle of the target file is located in the file handle list to be decrypted, if the file handle of the target file is located in the In the case of the decrypted file handle list, the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to perform a read operation on the target file.
The method of claim 1 wherein said obtaining a decryption key comprises:

The decryption key is obtained from the server.
The method of claim 1, wherein the decrypting operation on the target file comprises:

The target file is decrypted using the TEA algorithm.
The method according to claim 1, wherein a parameter type of said first hook function is the same as a parameter type of said open file function, and a parameter type of said second hook function and a parameter of said read file function The same type.
A file decryption device, characterized in that the device comprises:

An obtaining module, configured to obtain a first hook function for hooking the open file function and a second hook function for hooking the read file function;

a first calling module, configured to: in the process of performing an opening operation on the target file, first calling the first hook function to determine whether the target file is located in a file list to be decrypted, and then calling the open file function to the target The file is opened, wherein if the target file is located in the list of files to be decrypted, the file handle of the target file is saved in the file handle list to be decrypted;

a second calling module, configured to: in the process of performing a read operation on the target file, first calling the second hook function to determine whether a file handle of the target file is located in the file handle list to be decrypted, if The file handle of the target file is located in the file handle list to be decrypted, then the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to the target file. Read it.
The device of claim 5, wherein the first calling module comprises:

An obtaining unit, configured to acquire the decryption key from a server.
The device of claim 5, wherein the second calling module comprises:

And a decryption unit, configured to perform a decryption operation on the target file by using a TEA algorithm.
The apparatus according to claim 5, wherein a parameter type of said first hook function is the same as a parameter type of said open file function, a parameter type of said second hook function and a parameter of said read file function The same type.
A computer readable storage medium having stored thereon a computer program, wherein the program, when executed by the processor, implements the following steps:

Obtaining a first hook function for hooking the open file function and a second hook function for hooking the read file function;

In the process of performing the opening operation on the target file, first calling the first hook function to determine whether the target file is located in the file list to be decrypted, and then calling the open file function to open the target file, where If the target file is located in the to-be-decrypted file list, save the file handle of the target file to the file handle list to be decrypted;

In the process of performing the read operation on the target file, first calling the second hook function to determine whether the file handle of the target file is located in the file handle list to be decrypted, if the file handle of the target file is located in the In the case of the decrypted file handle list, the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to perform a read operation on the target file.
A computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor performs the following steps when executing the program:

Obtaining a first hook function for hooking the open file function and a second hook function for hooking the read file function;

In the process of performing the opening operation on the target file, first calling the first hook function to determine whether the target file is located in the file list to be decrypted, and then calling the open file function to open the target file, where If the target file is located in the to-be-decrypted file list, save the file handle of the target file to the file handle list to be decrypted;

In the process of performing the read operation on the target file, first calling the second hook function to determine whether the file handle of the target file is located in the file handle list to be decrypted, if the file handle of the target file is located in the In the case of the decrypted file handle list, the decryption key is obtained, and the target file is decrypted by using the decryption key, and the read file function is called to perform a read operation on the target file.