CN102736978A - Method and device for detecting installation status of application program - Google Patents

Abstract

The present invention discloses a method and device for detecting the installation status of application programs. The method includes: establishing a cloud database, in which reference feature codes of all files collected for each application program are stored; maintaining a terminal configuration list, wherein The installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file are recorded; the application program to be detected is extracted according to the terminal configuration list The feature code of each file is compared in the cloud database, and according to the comparison result, it is determined whether the application program to be detected is correctly installed on the terminal and fed back to the terminal. The invention can comprehensively and meticulously check the installation of application programs in combination with multiple angles.

Description

A method and device for detecting the installation state of an application program

technical field

The invention belongs to the field of computers, and in particular relates to a method and a device for detecting the installation status of application programs.

Background technique

At present, the method of detecting whether the application program is installed correctly is mainly realized by detecting the version of the file of the application program and the version of the registry file of the application program. However, in this way it is not possible to truly detect whether the application is installed correctly.

First, detecting the file version of an application is not enough. Because the version of the application file is correct, it does not mean that the content of the file has not been tampered with. The version number can't really reflect whether the application is installed correctly. In addition, except for the PE file (Portable Execute portable execution file), other files of the application program have no version. At this time, the detection cannot be completed by checking the version number, and it is impossible to detect whether the application program is installed correctly.

Furthermore, it is not enough to detect only the version of the application's registry file. The registry file is static, and it may not correspond to the real version of the application file. For example, if an application file is deleted, the version of the file also changes, but the registry file and the file version will not be deleted accordingly. Its version, the registry file of the application program is not consistent with the real version of the file of the application program at this time, and it is impossible to really detect whether the application program is installed correctly by checking the version number of the registry file.

Contents of the invention

In view of this, the technical problem to be solved by the present invention is to provide a method and device for detecting the installation status of application programs, which can comprehensively and carefully check the installation of application programs from various angles.

In order to solve the above-mentioned technical problems, the present invention discloses a method for detecting the installation state of an application program, including: establishing a cloud database in which reference feature codes of all files collected for each application program are stored; maintaining a terminal configuration list, The installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file are recorded; the application to be detected is extracted according to the terminal configuration list The feature code of each file of the program is compared in the cloud database, and it is determined whether the application program to be detected is correctly installed on the terminal according to the comparison result and fed back to the terminal.

Further, the feature code is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code obtained through information digest algorithm MD5 operation, secure hash algorithm verification code and cyclic redundancy check code.

Further, said maintaining the terminal configuration list also includes: when each application program adds a new file and/or deletes a file and/or modifies the file content and/or modifies the file storage path, it also updates the terminal configuration list corresponding records.

Further, the cloud database also saves the reference key values written in registry entries collected for each application; the terminal configuration list also records the information created by each application installed on the terminal. The path of the registry entry and the key value of each application written to the registry entry obtained according to the path of the registry entry; the key of the registry entry of the application to be detected is also extracted according to the terminal configuration list The values are compared in the cloud database, and according to the comparison result, it is determined whether the application program to be detected is correctly set in the registry on the terminal and fed back to the terminal.

Further, the maintenance terminal configuration list also includes: modifying the path of the registry item and/or adding a registry item and/or deleting the registry item and/or modifying the content of the registry item and/or When modifying the content of the system registry item, the corresponding record is also updated in the terminal configuration list.

Further, the collected reference main process and supporting processes and/or all dynamic link libraries and/or services created by each application program running are also stored in the cloud database; the terminal configuration list also records There is a main process created by each application installed on the terminal during operation and the process and/or dynamic link library and/or service called by the main process; the application to be detected is extracted according to the terminal configuration list. The main process created during runtime and the process and/or dynamic link library and/or service called by the main process are compared in the cloud database, and it is determined whether the application program to be detected is on the terminal according to the comparison result runs correctly and feeds back to said terminal.

Further, the maintenance terminal configuration list also includes: when each application program adds a new process and/or adds a supporting process and/or adds a dynamic link library and/or adds a service and/or deletes a process, also Corresponding records are updated in the terminal configuration list.

Further, according to the comparison result, it is determined that the application to be detected is correctly installed on the terminal, and the feedback sent to the terminal includes: prompting that the application to be detected is correctly installed on the terminal; The feedback sent to the terminal when the comparison result determines that the application to be detected is correctly set in the registry on the terminal includes: prompting that the application to be detected is set in the registry on the terminal Correctly set; according to the comparison result, the feedback sent to the terminal when the application program to be detected is determined to be running correctly on the terminal includes: prompting that the application program to be detected is running correctly on the terminal; according to the comparison As a result, when it is determined that the application program to be detected is not correctly installed on the terminal and/or is not correctly set in the registry on the terminal and/or is not running correctly on the terminal, the The feedback sent by the terminal includes a combination of one or more of the following: prompting incorrect information of the application to be detected, prompting to repair the application to be detected, prompting to terminate the operation of the application to be detected, prompting to clean up The application program to be detected prompts to reinstall the application program to be detected.

In order to solve the above technical problems, the present invention also discloses a device for detecting the installation state of an application program, including: a cloud database, a cloud database management module, a terminal configuration list, a terminal configuration list maintenance module, and a comparison analysis module; The database management module is used to establish a cloud database; the cloud database is used to save the reference feature codes of all files collected for each application program; the terminal configuration list maintenance module is used to maintain the terminal configuration list; the described The terminal configuration list is used to record the installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file; the comparison and analysis module , for extracting the feature code of each file of the application program to be detected according to the terminal configuration list and comparing it in the cloud database, judging whether the application program to be detected is correctly installed on the terminal according to the comparison result and Feedback to the terminal.

Further, the feature code extracted by the comparison and analysis module is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code, secure hash algorithm check code and cyclic redundancy check code.

Further, the terminal configuration list maintenance module, when maintaining the terminal configuration list, is also used for adding new files and/or deleting files and/or modifying file content and/or modifying file storage paths for each application program, when The corresponding record is updated in the terminal configuration list.

Further, the cloud database is also used to store the reference key values written in registry entries collected for each application; the terminal configuration list is also used to record each application installed on the terminal The path of the registry entry created and the key value of each application written to the registry entry obtained according to the path of the registry entry; the comparison and analysis module is also used to extract the terminal configuration list according to the terminal configuration list. The key value written in the registry entry of the detection application is compared in the cloud database, and according to the comparison result, it is determined whether the application to be detected is correctly set in the registry on the terminal and fed back to the terminal .

Further, the terminal configuration list maintenance module, when maintaining the terminal configuration list, is also used to modify the path of the registry item and/or add a new registry item and/or delete the registry item and/or When modifying the content of the registry item and/or modifying the content of the system registry item, the corresponding record is updated in the terminal configuration list.

Further, the cloud database is also used to save the collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application is running; the terminal configuration list is also It is used to record the main process created by each application program installed on the terminal during operation and the process and/or dynamic link library and/or service called by the main process; the comparison and analysis module is also used to According to the terminal configuration list, extract the main process created by the application to be detected at runtime and the process and/or dynamic link library and/or service called by the main process, compare them in the cloud database, and judge according to the comparison result Whether the application program to be checked is running correctly on the terminal is fed back to the terminal.

Further, when the terminal configuration list maintenance module is maintaining the terminal configuration list, it is also used to add new processes and/or add supporting processes and/or add dynamic link libraries and/or add new services to each application program. And/or when deleting a process, update the corresponding record in the terminal configuration list.

Further, the comparison and analysis module determines the feedback sent to the terminal when the application to be detected is correctly installed on the terminal according to the comparison result, including: prompting that the application to be detected is installed on the terminal The terminal is correctly installed; the comparison and analysis module determines the feedback sent to the terminal when the application to be detected is correctly set in the registry on the terminal according to the comparison result, including: prompting the The application program to be detected is correctly set in the registry on the terminal; the comparison analysis module determines the feedback sent to the terminal when the application program to be detected is running correctly on the terminal according to the comparison result , including: prompting that the application program to be detected runs correctly on the terminal; the comparison and analysis module determines that the application program to be detected is not installed correctly on the terminal according to the comparison result and/or when When the registry on the terminal is not correctly set and/or when the terminal is not running correctly, the feedback sent to the terminal includes a combination of one or more of the following: prompting the application to be detected Incorrect information of the program, repairing the application program to be detected, terminating the operation of the application program to be detected, cleaning the application program to be detected, and reinstalling the application program to be detected.

Compared with existing solutions, the technical effects obtained by the present invention are:

1) The damage caused by virus, Trojan horse infection and poor fault tolerance of the application program itself will cause the application program to be damaged, including non-PE data files such as dat files, lib files, etc., and even system files, which may be damaged or lost at any time. The present invention can identify The content of the file is damaged, and an intelligent, fast and convenient detection method is especially necessary.

2) Registry items are damaged or modified, or the application itself fails to write into the registry due to its own problems during installation. At this time, it is impossible to start and use the application normally. The invention can identify the damage of the registry items , Through this detection method, it can be thoroughly traced whether the software can be started correctly after installation.

3) Assume that the static information such as the file and registry entries of the application is correct, but in a certain environment, such as a 64-bit system, the 32-bit process and the dll and services supporting the process cannot be loaded. In this case It can also be considered as a failed installation, and the present invention can identify the damage of the memory add-on, so as to thoroughly trace out the reason why it cannot be started correctly after installation.

Description of drawings

Fig. 1 is the method flowchart of the embodiment of the present invention;

Fig. 2 is the flowchart of step S10 of the embodiment of the present invention;

Fig. 3 is the flowchart of step S20 of the embodiment of the present invention;

Fig. 4 is the flowchart of step S30 of the embodiment of the present invention;

Fig. 5 is a device structure diagram of an embodiment of the present invention.

Detailed ways

The implementation of the present invention will be described in detail below in conjunction with the drawings and examples, so that the realization process of how to use technical means to solve technical problems and achieve technical effects in the present invention can be fully understood and implemented accordingly.

Main idea of this application

Separately detect the signature of each file of the application to be detected, the key value written to the registry key, and the memory add-on at runtime;

The signature of any file is unique. After the application is installed, if other viruses, Trojan horses or hooks replace and modify the file content of the application, or the application itself has poor fault tolerance, the files of the application will be destroyed or deleted or replaced. , it can be verified by the feature code.

After the application is installed, different registry items will be created in the registry, including installation items, service items, startup items, user registration information, etc. For example, antivirus software will load service items with high priority after booting and before logging in. The service item must be started before the virus Trojan horse is started, so as to ensure the normal operation of the anti-virus software, so it is also necessary to detect the key value written into the registry item.

After the application is installed, it will start the main process, and then the main process will call other supporting processes, dynamic link libraries (dll), and services by itself. In some environments, the application cannot start the process normally and load supporting processes, dll and In addition, if other third-party processes or dlls or other incorrect module applications are injected, errors will also occur, so it is also necessary to detect memory add-ons at runtime, and the memory add-ons include: the created main process and all Processes and/or dynamic link libraries and/or services called by the main process.

Application scenarios of this application

1) After the application is installed by the user, they will encounter a series of problems in use and even cannot start the software; at this time, the user often turns to the customer service personnel, but it is difficult for the customer service personnel to trace the reason remotely, such as the application is not installed correctly. The installation is still damaged, or it is a functional problem of the application program itself; at this time, it is suitable to apply the present invention to intelligently check whether the file is installed, whether the registry entries (such as installation information, service items, user information, etc.) are written, Whether to start the process, load the dll module, and start the service in a specific user environment.

2) When testing an application, testers often first test whether the application is installed correctly, and then can further check whether the function of the software itself is correct. For example, if you install a large office software with a size of 1G, there will be tens of thousands of files in it. , also need to write thousands of registry entries, after the installation is complete, if any link occurs in the middle, it is difficult to track down whether the software is installed by mistake or the BUG of the software itself, and it is suitable for applying the present invention to carry out intelligent investigation.

3) When developers of application programs develop large-scale software, each developer will not be responsible for the development of all modules, but only for the development and integrated debugging of some modules. In order to ensure the integrity of debugging, it is suitable to apply the intelligent Check if the file is installed.

Of course, the present application is not limited to the above application scenarios, and there are other scenarios applicable to massive data browsing and data format editing.

Example description

The method of the present invention is described below with an embodiment. As shown in Figure 1, it is a flowchart of a method for detecting the installation state of an application program according to an embodiment of the present invention, and the following operations are performed:

Step S10, detecting the feature code of each file of the application program to be detected, and judging whether the application program to be detected is correctly installed on the terminal according to the detection result.

Step S20, detecting the key value written by the application program to be detected into the registry entry, and judging whether the application program to be detected is correctly set on the terminal according to the detection result.

Step S30, detecting the memory add-on of the application program to be detected when it is running, and judging whether the application program to be detected is running correctly on the terminal according to the detection result.

The installation state of the application program includes: whether the application program to be detected is correctly installed, correctly set and/or correctly operated on the terminal. The steps S10 , S20 , and S30 above have no order of execution, and can be executed simultaneously, or sequentially in any order, to three-dimensionally detect the status of the application program to be detected from the above three parallel angles.

The above step S10 is described below with an embodiment. As shown in Figure 2, it is a flowchart of step S10 in the embodiment of the present invention, and the following operations are performed:

Step S102, establishing a cloud database, wherein the reference signature codes of all files collected for each application are stored;

The feature code is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code obtained through information digest algorithm MD5 operation, secure hash algorithm SHA1 check code and Cyclic redundancy CRC check code.

The reference signature code may be correct, a reference value determined to be installed correctly, implemented through a whitelist; the reference signature code may also be an incorrect reference value determined to be installed incorrectly, implemented through a blacklist.

Step S104, maintaining the terminal configuration list, which records the installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file;

Obtain the installation path of each application program installed on the terminal through an API (Application Programming Interface) function that has a function of whether a file or directory exists, such as the PathFileExists function, which is used to determine the file system object of a file or directory Whether the path is valid; according to the installation path, all the files installed by each application are obtained through the API function with the function of enumerating files or folders, such as the FindFirstFile function and the FindNextFile function, and the FindFirstFile function is used according to the file name To find a file, the FindNextFile function is used to find the next file according to a file name specified when calling the FindFirstFile function.

When each application program adds files and/or deletes files and/or modifies file content (including system files) and/or modifies file storage paths, corresponding records are also updated in the terminal configuration list.

Step S106, extracting the feature code of each file of the application program to be detected according to the terminal configuration list and comparing it in the cloud database, and judging whether the application program to be detected is correctly installed on the terminal according to the comparison result and Feedback to the terminal.

When the reference feature code is stored in the white list of the cloud database, if after comparison, it is found that the feature codes in the terminal configuration list are all hit by the reference feature code in the cloud database, then it can be determined that the application to be detected is in the white list. If the feature code in the terminal configuration list is not matched by the reference feature code in the cloud database after the comparison, it can be determined that the application program to be detected has not been detected on the terminal. Install correctly.

When the reference feature code is stored in the blacklist of the cloud database, if after comparison, it is found that only one feature code in the terminal configuration list is hit by the reference feature code in the cloud database, then it can be determined that the application to be detected The program is not installed correctly on the terminal; if none of the feature codes in the terminal configuration list are matched by the reference feature codes in the cloud database after comparison, it can be determined that the application program to be detected is on the terminal is installed correctly.

The feedback sent to the terminal when determining that the application to be detected is correctly installed on the terminal according to the comparison result includes: prompting that the application to be detected is correctly installed on the terminal;

The feedback sent to the terminal when it is determined that the application to be detected has not been correctly installed on the terminal according to the comparison result includes a combination of one or more of the following: prompting incorrect information about the application to be detected Prompting to repair the application program to be detected, prompting to terminate the running of the application program to be detected, prompting to clean the application program to be detected, and prompting to reinstall the application program to be detected.

The above step S10 is described below with an application example. Take Fetion as an example for the application to be detected, and MD5 as an example for the feature code, and the MD5 value can be obtained through a hash algorithm.

The reference MD5 value of all files collected for each application program is saved in the cloud database, and the reference MD5 value is a correct reference value, for example including at least:

Fetion.exe&8af829e342a6b15696af9650ad5f805c

fxWebBrowser.exe&8af829e342a6b15696af9650ad5f8051

Fetion.lib&8af829e342a6b15696af9650ad5f8052

Among them, Fetion.exe, fxWebBrowser.exe, and Fetion.lib are files, 8af829e342a6b15696af9650ad5f805c is the MD5 value corresponding to Fetion.exe, 8af829e342a6b15696af9650ad5f8051 is the MD5 value corresponding to fxWebBrowser.exe, and 8af829e352a6b156096ad5f8 is the corresponding MD5 value of Fetion.lib.

The file path, file and file MD5 value are recorded in the terminal configuration list, for example:

File1="C:\Program Files\ChinaMobile\Fetion\Fetion.exe"&8af829e342a6b15696af9650ad5f805c

File1="C:\Program Files\ChinaMobile\Fetion\fxWebBrowser.exe"&8af829e342a6b15696af9650ad5f8051

File1="C:\Program Files\ChinaMobile\Fetion\Fetion.lib"&8af829e342a6b15696af9650ad5f8052

In the above format, Fetion.exe, fxWebBrowser.exe, Fetion.lib are files, C:\ProgramFiles\ChinaMobile\Fetion\ is the file path, 8af829e342a6b15696af9650ad5f805c is the MD5 value corresponding to Fetion.exe, 8af829e342a6b15696af9650ad5f8051 is the MD5 value corresponding to fxWebBrowser.exe , 8af829e342a6b1596af9650ad5f8052 is the MD5 value corresponding to Fetion.lib, and Fetion.lib is a non-PE file.

When the application program Fetion adds files (including temporarily generated files), deletes files, modifies file content (including modifying windows system files), and file storage paths, the parameters recorded in the terminal configuration list will be automatically updated and adjusted.

Extract the MD5 values of Fetion.exe, fxWebBrowser.exe, and Fetion.lib of Fetion according to the terminal configuration list and compare them in the cloud database. If the value is hit, it can be determined that the application program to be detected is correctly installed on the terminal; if there is only one MD5 in the terminal configuration list after the comparison is not hit by the reference MD5 value in the cloud database, it can be determined at this time It is determined that the application program to be detected has not been correctly installed on the terminal.

The above step S20 will be described below with an embodiment. As shown in FIG. 3, it is a flowchart of step S20 in the embodiment of the present invention, and the following operations are performed:

Step S202, establishing a cloud database, which saves the reference key values written into registry entries collected for each application;

The reference key value may be a correct reference value determined to be correctly installed, which is implemented through a white list; the reference key value may also be an incorrect reference value determined to be incorrectly installed, and implemented through a blacklist.

Step S204, maintaining the terminal configuration list, which records the path of the registry entry created by each application installed on the terminal and the path of each application written to the registry entry obtained according to the path of the registry entry. key value;

Obtain the path of the registry entry created by each application and the key value written to the registry entry through the API function with the function of reading and writing under the specified registry entry, such as SHGetValue function and RegCreateKeyEx function, SHGetValue function It is used to read and write operations under the specified registry key; the RegCreateKeyEx function is used to create a new key under the specified registry key in a complex way, and is used in the Win32 environment.

When each application modifies the path of the registry item and/or adds a new registry item and/or deletes the registry item and/or modifies the content of the registry item and/or modifies the content of the system registry item, the terminal The corresponding record is updated in the configuration list.

Step S206, according to the terminal configuration list, extract the key value written in the registry entry of the application to be detected and compare it in the cloud database, and determine whether the application to be detected is registered on the terminal according to the comparison result The table is correctly set and fed back to the terminal;

When the reference key value is stored in the white list of the cloud database, if after comparison, it is found that the key values in the terminal configuration list are all hit by the reference key value in the cloud database, then it can be determined that the application to be detected is in the white list. It is correctly set on the above-mentioned terminal; if only one key value in the terminal configuration list is not hit by the reference key value in the cloud database after the comparison, it can be determined that the application program to be detected is not correctly set on the terminal. set up.

When the reference key value is stored in the blacklist of the cloud database, if after comparison, it is found that as long as one key value in the terminal configuration list is hit by the reference key value in the cloud database, it can be determined that the application program to be detected It has not been correctly set on the terminal; if the key values in the terminal configuration list are not hit by the reference key values in the cloud database after comparison, it can be determined that the application program to be detected has been detected on the terminal. set correctly.

The feedback sent to the terminal when it is determined that the application to be detected is correctly set in the registry on the terminal according to the comparison result includes: prompting that the application to be detected is in the registry on the terminal is set correctly;

The feedback sent to the terminal when it is determined that the application to be detected is not correctly set in the registry on the terminal according to the comparison result includes a combination of one or more of the following: prompting the application to be detected incorrect information, prompting to repair the application program to be detected, prompting to terminate the running of the application program to be detected, prompting to clean up the application program to be detected, and prompting to reinstall the application program to be detected.

The above step S20 is described below with an application example. The application to be detected takes Fetion as an example.

The cloud database stores the reference key values written into the registry entries collected for each application, and the reference key values are correct reference values, for example including at least:

″\″C:\\Program Files\\China Mobile\\Fetion\\Fetion.exe\″\″%1\″″.

The path of the registry item and the key value written to the registry item are recorded in the terminal configuration list, for example:

[HKEY_CLASSES_ROOT\Applications\Fetion.exe\shell\open\command]="\"C:\\Program Files\\China Mobile\\Fetion\\Fetion.exe\″\″%1\″″

In the above format, [HKEY_CLASSES_ROOT\Applications\Fetion.exe\shell\open\command] is the path of the registry key, ″\″C:\\Program Files\\China Mobile\\Fetion\\Fetion.exe\″\ "%1\"" is the key value of the registry key written.

When the application program Fetion modifies the registry path, adds registry entries (including temporarily generated registry entries), deletes registry entries, and modifies registry entry contents (including modifying windows registry entries), the terminal configuration list records The parameters will be automatically updated and adjusted.

According to the terminal configuration list, the key value of the registry entry written by Fetion is extracted and compared in the cloud database, if after the comparison, it is found that the key values in the terminal configuration list are all hit by the reference key value in the cloud database. At this time, it can be determined that the application program to be detected is correctly set on the terminal; if only one key value in the terminal configuration list is not hit by the reference key value in the cloud database after comparison, it can be determined that the application program to be detected is correctly set on the terminal. The detection application is not properly set up on the terminal in question.

The above step S30 will be described below with an embodiment. As shown in FIG. 4, it is a flowchart of step S30 in the embodiment of the present invention, and the following operations are performed:

Step S302, establishing a cloud database, which saves the collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application is running;

The reference main process and supporting processes and/or all dynamic link libraries and/or services may be correct and determined to be correctly installed reference values, which are realized through a white list; the reference main process and supporting processes and/or All dynamic link libraries and/or services may also be erroneous reference values determined to be incorrectly installed, and implemented through a blacklist.

Step S304, maintaining a terminal configuration list, which records the main process created by each application program installed on the terminal when running, and the process and/or dynamic link library and/or service called by the main process;

Obtain the main process created by each application program at runtime and the process and/or dynamic link library and/or dynamic link library called by the main process through the API function with the function of establishing a snapshot for the specified process, the heap used by the process, the module, and the thread /or services, such as the CreateToolhelp32Snapshot function, the CreateToolhelp32Snapshot function is used to create a snapshot for the specified process, the heap [HEAP], module [MODULE], and thread [THREAD] used by the process.

When each application program adds a new process and/or adds a supporting process and/or adds a dynamic link library and/or adds a service and/or deletes a process, the corresponding record is also updated in the terminal configuration list.

Step S306, according to the terminal configuration list, extract the main process created by the application to be detected when running and the process and/or dynamic link library and/or service called by the main process, and compare them in the cloud database, according to the comparison Determine whether the application program to be detected is running correctly on the terminal and feed back to the terminal according to the result;

When the reference value is saved in the white list of the cloud database, if it is found after comparison that the main process in the terminal configuration list and the process and/or dynamic link library and/or service called by the main process are all referenced in the cloud database If the value is hit, it can be determined that the application program to be detected is correctly set on the terminal; if there is only one main process and the process and/or dynamic link library called by the main process in the terminal configuration list after comparison And/or the service is not hit by the reference value in the cloud database, at this time it can be determined that the application program to be detected is not correctly set on the terminal.

When the reference value is stored in the blacklist of the cloud database, if it is found after comparison that there is only one main process in the terminal configuration list and the processes and/or dynamic link libraries and/or services invoked by the main process are all included in the cloud database At this time, it can be determined that the application program to be detected has not been correctly set on the terminal; if the main process in the terminal configuration list and the process and/or dynamic Neither the link library nor the service is hit by the reference key in the cloud database, and at this point it can be determined that the application program to be checked is correctly set on the terminal.

According to the comparison result, the feedback sent to the terminal when the application program to be detected is determined to be running correctly on the terminal includes: prompting that the application program to be detected is running correctly on the terminal;

The feedback sent to the terminal when it is determined that the application to be detected is not running correctly on the terminal according to the comparison result includes a combination of one or more of the following: prompting incorrect information of the application to be detected, Prompting to repair the application program to be detected, prompting to terminate the running of the application program to be detected, prompting to clean the application program to be detected, and prompting to reinstall the application program to be detected.

The above step S30 is described below with an application example. The application to be detected takes Fetion as an example.

The collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application is running are stored in the cloud database. The reference main process and supporting processes and/or all dynamic link libraries are stored in the cloud database. Link libraries and/or services to the correct reference values, for example which include at least:

Main process Fetion.exe, supporting dynamic link libraries ADVAPI32.dll and AvatarX.dll.

The terminal configuration list records the main process created by each application at runtime and the processes and/or dynamic link libraries and/or services invoked by the main process, for example:

Exe1=Fetion.exe&ADVAPI32.dll&AvatarX.dll

Exe2=…

In the above format, Fetion.exe is the main process, ADVAPI32.dll is the supporting dynamic link library of the main process Fetion.exe, and AvatarX.dll is also the supporting dynamic link library of the main process Fetion.exe.

When the application Fetion adds a new process (including a temporarily loaded process), adds a supporting dll (including a process or dll that needs to be injected into the windows system), adds a supporting service, or deletes a process, the parameters recorded in the terminal configuration list will automatically Update adjustments.

According to the terminal configuration list, the reference main process and supporting processes and/or all dynamic link libraries and/or services created during Fetion runtime are extracted and compared in the cloud database, if the main process in the terminal configuration list is found after the comparison The process and supporting processes and/or all dynamic link libraries and/or services are hit by the reference value in the cloud database, and at this time it can be determined that the application program to be detected is correctly run on the terminal; if after comparison As long as one of the main process and supporting processes and/or all dynamic link libraries and/or services in the terminal configuration list is not hit by the reference value in the cloud database, it can be determined that the application program to be detected is on the terminal. is not running correctly.

The device of the present invention will be described below with three device embodiments. The device corresponds to the flow of the above-mentioned method. For the deficiencies, please refer to the part of the above-mentioned method. As shown in FIG. 5 , the device for detecting the installation state of an application program includes: a cloud database 1 , a cloud database management module 2 , a terminal configuration list 3 , a terminal configuration list maintenance module 4 and a comparison analysis module 5 .

First device embodiment

The cloud database management module 2 is used to establish a cloud database 1;

The cloud database 1 is used to save the reference signature codes of all files collected for each application program;

The terminal configuration list maintenance module 4 is used to maintain the terminal configuration list 3;

The terminal configuration list 3 is used to record the installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file;

The comparison and analysis module 5 is used to extract the feature code of each file of the application program to be detected according to the terminal configuration list 3 and compare it in the cloud database 1, and determine whether the application program to be detected is determined according to the comparison result. correctly installed on the terminal and fed back to the terminal.

The terminal configuration list maintenance module 4, when maintaining the terminal configuration list 3, is further used to obtain the installation path of each application program installed on the terminal through the application programming interface API function with the function of whether the file or directory exists ; It is further used to obtain all files installed by each application program through an API function having a function of enumerating files or folders according to the installation path.

The terminal configuration list maintenance module 4 is also used to add new files and/or delete files and/or modify file content (including system files) and/or modify file storage in each application program when maintaining the terminal configuration list 3. When the path is selected, the corresponding record is updated in the terminal configuration list 3.

The feature code is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code obtained through information digest algorithm MD5 operation, secure hash algorithm check code and loop Redundancy check code.

The comparison and analysis module 5 determines the feedback sent to the terminal when the application to be detected is correctly installed on the terminal according to the comparison result, including: prompting that the application to be detected is on the terminal correctly installed; the feedback sent to the terminal when it is determined that the application to be detected has not been correctly installed on the terminal according to the comparison result includes a combination of one or more of the following: prompting the application to be detected incorrect information, repair the application program to be detected, terminate the operation of the application program to be detected, clean up the application program to be detected, and reinstall the application program to be detected.

Second device embodiment

The cloud database management module 2 is used to establish a cloud database 1;

The cloud database 1 is used to save the reference key value of the registry entry collected for each application;

The terminal configuration list maintenance module 4 is used to maintain the terminal configuration list 3;

The terminal configuration list 3 is used to record the path of the registry entry created by each application installed on the terminal and the key of each application written to the registry entry obtained according to the path of the registry entry value;

The comparison and analysis module 5 is used to extract the key value written in the registry entry of the application to be detected according to the terminal configuration list 3 and compare it in the cloud database 1, and determine the application to be detected according to the comparison result Whether the program is correctly set in the registry on the terminal and is fed back to the terminal.

The terminal configuration list maintenance module 4, when maintaining the terminal configuration list 3, is further used to obtain the registry entries created by each application program through the API function with the function of reading and writing under the specified registry entries. path and key value written to the registry key.

The terminal configuration list maintenance module 4, when maintaining the terminal configuration list 3, is also used to modify the path of the registry item and/or add a new registry item and/or delete the registry item and/or modify the registry item in each application program. When modifying the contents of the registry entries and/or modifying the contents of the system registry entries, the corresponding records are updated in the terminal configuration list 3 .

The comparison and analysis module 5 determines the feedback sent to the terminal when the application to be detected is correctly set in the registry on the terminal according to the comparison result, including: prompting that the application to be detected is The registry on the terminal is set correctly; according to the comparison result, the feedback sent to the terminal when it is determined that the application to be detected is not correctly set in the registry on the terminal includes the following one or A combination of items: prompting incorrect information of the application to be detected, repairing the application to be detected, terminating the operation of the application to be detected, cleaning up the application to be detected, reinstalling the application to be detected program.

Third device embodiment

The cloud database management module 2 is used to establish a cloud database 1;

The cloud database 1 is used to save the collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application is running;

The terminal configuration list maintenance module 4 is used to maintain the terminal configuration list 3;

The terminal configuration list 3 is also used to record the main process created by each application installed on the terminal during operation and the process and/or dynamic link library and/or service called by the main process;

The comparison and analysis module 5 is also used to extract the main process created by the application program to be detected at runtime and the process and/or dynamic link library and/or service called by the main process according to the terminal configuration list 3. The comparison is performed in the cloud database 1, and according to the comparison result, it is determined whether the application program to be detected is running correctly on the terminal and fed back to the terminal.

The terminal configuration list maintenance module 4, when maintaining the terminal configuration list 3, is further used to obtain each application program at runtime through an API function having the function of setting up a snapshot for the specified process, the heap, the module, and the thread used by the process. The created main process and the processes and/or dynamic link libraries and/or services invoked by the main process.

The terminal configuration list maintenance module 4, when maintaining the terminal configuration list 3, is also used to add a new process and/or a new supporting process and/or a new dynamic link library and/or a new service and /or when deleting a process, update a corresponding record in the terminal configuration list 3 .

The comparison analysis module 5 determines the feedback sent to the terminal when the application program to be detected is running correctly on the terminal according to the comparison result, including: prompting that the application program to be detected is correct on the terminal Running; the feedback sent to the terminal when it is determined that the application program to be detected is not running correctly on the terminal according to the comparison result includes a combination of one or more of the following: prompting that the application program to be detected is not correct information, repair the application program to be detected, terminate the running of the application program to be detected, clean up the application program to be detected, and reinstall the application program to be detected.

It should be noted that, in the case of no conflict, the embodiments of the present invention and the features in the embodiments can be combined arbitrarily with each other.

Certainly, the present invention also can have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding changes All changes and modifications should belong to the scope of protection of the appended claims of the present invention.

Those of ordinary skill in the art can understand that all or part of the steps in the above method can be instructed by a program and completed by related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

Claims (16)

1. A method for detecting the installation state of an application program, comprising: Establish a cloud database, which saves the reference signatures of all files collected for each application; Maintaining a terminal configuration list, which records the installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file; According to the terminal configuration list, the feature code of each file of the application to be detected is extracted and compared in the cloud database, and whether the application to be detected is correctly installed on the terminal is determined according to the comparison result and fed back to the terminal. described terminal. 2. The method of claim 1, wherein The feature code is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code obtained through information digest algorithm MD5 operation, secure hash algorithm check code and loop Redundancy check code. 3. The method according to claim 1 or 2, wherein the maintenance terminal configuration list further comprises: When each application program adds files and/or deletes files and/or modifies file content and/or modifies file storage paths, the corresponding records are also updated in the terminal configuration list. 4. The method according to any one of claims 1-3, wherein The cloud database also saves the reference key value of the registry entry collected for each application; The terminal configuration list also records the path of the registry entry created by each application installed on the terminal and the key value of each application written to the registry entry obtained according to the path of the registry entry ; Also according to the terminal configuration list, extract the key value of the application program to be detected written into the registry item and compare it in the cloud database, and determine whether the application program to be detected is in the registration form on the terminal according to the comparison result is correctly set and fed back to the terminal. 5. The method according to any one of claims 1-4, wherein the maintenance terminal configuration list further comprises: When each application modifies the path of the registry item and/or adds a new registry item and/or deletes the registry item and/or modifies the content of the registry item and/or modifies the content of the system registry item, the terminal The corresponding record is updated in the configuration list. 6. The method according to any one of claims 1-5, wherein The collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application program is running are also stored in the cloud database; The terminal configuration list also records the main process created by each application program installed on the terminal when running, and the process and/or dynamic link library and/or service called by the main process; According to the terminal configuration list, extract the main process created by the application to be detected at runtime and the process and/or dynamic link library and/or service called by the main process, compare them in the cloud database, and judge according to the comparison result Whether the application program to be checked is running correctly on the terminal is fed back to the terminal. 7. The method according to any one of claims 1-6, wherein the maintenance terminal configuration list further comprises: When each application program adds a new process and/or adds a supporting process and/or adds a dynamic link library and/or adds a service and/or deletes a process, the corresponding record is also updated in the terminal configuration list. 8. The method according to any one of claims 1-7, wherein The feedback sent to the terminal when determining that the application to be detected is correctly installed on the terminal according to the comparison result includes: prompting that the application to be detected is correctly installed on the terminal; The feedback sent to the terminal when it is determined that the application to be detected is correctly set in the registry on the terminal according to the comparison result includes: prompting that the application to be detected is in the registry on the terminal is set correctly; According to the comparison result, the feedback sent to the terminal when the application program to be detected is determined to be running correctly on the terminal includes: prompting that the application program to be detected is running correctly on the terminal; According to the comparison result, when it is determined that the application program to be detected is not correctly installed on the terminal and/or is not correctly set in the registry on the terminal and/or is not correctly running on the terminal , the feedback sent to the terminal includes a combination of one or more of the following: prompting incorrect information of the application to be detected, prompting to repair the application to be detected, prompting to terminate the operation of the application to be detected , prompting to clean up the application program to be detected, and prompting to reinstall the application program to be detected. 9. A device for detecting the installation state of an application program, comprising: a cloud database, a cloud database management module, a terminal configuration list, a terminal configuration list maintenance module, and a comparison and analysis module; The cloud database management module is used to establish a cloud database; The cloud database is used to save the reference signature codes of all files collected for each application program; The terminal configuration list maintenance module is used to maintain the terminal configuration list; The terminal configuration list is used to record the installation path of each application program installed on the terminal, all files installed by each application program obtained according to the installation path, and the feature code of each file; The comparison and analysis module is used to extract the feature code of each file of the application program to be detected according to the terminal configuration list and compare it in the cloud database, and determine whether the application program to be detected is in the The terminal is installed correctly and feeds back to the terminal. 10. The apparatus of claim 9, wherein The feature code extracted by the comparison and analysis module is a feature code that uniquely identifies the file and file content, including one or more of the following combinations: MD5 verification code obtained through the information digest algorithm MD5 operation , Secure Hash Algorithm Check Code and Cyclic Redundancy Check Code. 11. Apparatus as claimed in claim 9 or 10, characterized in that, The terminal configuration list maintenance module, when maintaining the terminal configuration list, is also used for adding files and/or deleting files and/or modifying file content and/or modifying file storage paths in each application program, The corresponding record is updated in the configuration list. 12. The device according to any one of claims 9-11, characterized in that, The cloud database is also used to save the reference key value of the registry entry collected for each application; The terminal configuration list is also used to record the path of the registry item created by each application program installed on the terminal and the key written into the registry item by each application program obtained according to the path of the registry item value; The comparison and analysis module is also used to extract the key value written in the registry entry of the application program to be detected according to the terminal configuration list and compare it in the cloud database, and determine whether the application program to be detected is based on the comparison result. It is correctly set in the registry on the terminal and fed back to the terminal. 13. The device according to any one of claims 9-12, wherein The terminal configuration list maintenance module is also used to modify the path of the registry item and/or add a new registry item and/or delete the registry item and/or modify the registry in each application program when maintaining the terminal configuration list When modifying the item content and/or modifying the system registry item content, the corresponding record is updated in the terminal configuration list. 14. The device according to any one of claims 9-13, wherein The cloud database is also used to save the collected reference main process and supporting processes and/or all dynamic link libraries and/or services created when each application is running; The terminal configuration list is also used to record the main process created by each application installed on the terminal during operation and the processes and/or dynamic link libraries and/or services invoked by the main process; The comparison and analysis module is also used to extract the main process created by the application to be detected at runtime and the process and/or dynamic link library and/or service called by the main process according to the terminal configuration list in the cloud database comparison, and determine whether the application program to be detected is running correctly on the terminal according to the comparison result, and feed back to the terminal. 15. The device according to any one of claims 9-14, wherein The terminal configuration list maintenance module, when maintaining the terminal configuration list, is also used to add new processes and/or add supporting processes and/or add dynamic link libraries and/or add new services and/or When a process is deleted, a corresponding record is updated in the terminal configuration list. 16. The device according to any one of claims 9-15, wherein The comparison and analysis module determines the feedback sent to the terminal when the application to be detected is correctly installed on the terminal according to the comparison result, including: prompting that the application to be detected is installed on the terminal Install correctly; The comparison and analysis module determines the feedback sent to the terminal when the application to be detected is correctly set in the registry on the terminal according to the comparison result, including: prompting that the application to be detected is correctly set in the registration form on the terminal is correctly set in the registry on the above-mentioned terminal; The comparison and analysis module determines the feedback sent to the terminal when the application to be detected runs correctly on the terminal according to the comparison result, including: prompting that the application to be detected runs correctly on the terminal ; The comparison and analysis module, according to the comparison result, determines that the application program to be detected is not correctly installed on the terminal and/or is not correctly set in the registry on the terminal and/or is not correctly installed on the terminal. When the terminal does not run correctly, the feedback sent to the terminal includes a combination of one or more of the following: prompting incorrect information of the application program to be detected, repairing the application program to be detected, terminating the application program to be detected Detecting the running of the application program, cleaning the application program to be detected, and reinstalling the application program to be detected.

Images