CN116089912A - Software identification information acquisition method and device, electronic equipment and storage medium - Google Patents

Abstract

The application provides a method and a device for acquiring software identification information, electronic equipment and a storage medium, wherein the method comprises the following steps: acquiring the dos header of the pe file of the target software; acquiring a pe header of the pe file based on the last byte of the dos header; determining a specified code segment in the main program according to the pe header; extracting a predetermined number of bytes from the specified code segment; and determining the hash value of the target software based on the bytes and a preset hash value calculation mode, and taking the hash value as the software identification information of the target software. According to the technical scheme, the software identification information can be kept unchanged during software updating, so that resources consumed by regenerating the software identification information are reduced, the cost of maintaining the software identification information is reduced, and the convenience and safety of software identification are improved.

Description

Software identification information acquisition method and device, electronic equipment and storage medium

【Technical field】

The present application relates to the field of computer technology, and in particular to a method and device for acquiring software identification information, electronic equipment, and a storage medium.

【Background technique】

In order to prevent illegal software from running in a timely manner, software identification information is set for the software in related technologies, and the software can be identified through the software identification information, so as to further determine whether it is identified as illegal software. However, the generation of existing software identification information depends on the software program itself. Once the software is updated and the software program changes, it is necessary to recalculate new software identification information for the software, and this calculation consumes a lot of background maintenance resources. .

Therefore, how to reduce the consumption caused by recalculating software identification information due to software updates has become a technical problem to be solved urgently.

【Content of invention】

Embodiments of the present application provide a method and device for acquiring software identification information, electronic equipment, and a storage medium, aiming to solve the technical problem in the related art that recalculation of software identification information due to software updates results in large background maintenance resources.

In the first aspect, the embodiment of the present application provides a method for acquiring software identification information, comprising: acquiring the dos header of the pe file of the target software; based on the last byte of the dos header, acquiring the pe header of the pe file; According to the pe header, determine a specified code segment in the main program; extract a predetermined number of bytes from the specified code segment; determine the target software based on the bytes and a predetermined hash value calculation method The hash value is used as the software identification information of the target software.

In a possible design, before obtaining the dos header of the pe file of the target software, it also includes: installing the target software, and updating the registry and system configuration information based on the installation operation; based on the registry or the The system configuration information is obtained to obtain the main program of the target software.

In a possible design, the determining the specified code segment in the main program according to the pe header includes: determining the target operating platform of the target software based on the first byte of the pe header; The pe header length determination method corresponding to the target operating platform determines the length of the pe header; offsets based on the first byte of the pe header and the length of the pe header to obtain multiple sections of the pe file Table; determine the target section table where the .text section is located in the plurality of section tables, and obtain the .text section in the target section table as the specified code segment.

In a possible design, the extracting the predetermined number of bytes from the specified code segment includes: extracting the predetermined number of bytes from the specified code segment according to a specified extraction rule.

In a possible design, the determining the hash value of the target software based on the byte and a predetermined hash value calculation method includes: performing an md5 algorithm, a sha1 algorithm, or an sm3 algorithm on the byte processing to obtain the hash value of the target software.

In the second aspect, the embodiment of the present application provides a software identification method, including: obtaining the software identification information of the target software in response to the running request of the target software; if the software identification information matches the specified identification in the software blacklist The information is matched to prevent the target software from running, wherein, before the acquisition of the software identification information of the target software, the software identification information is generated by executing any one of the methods in the first aspect above.

In a third aspect, an embodiment of the present application provides a device for acquiring software identification information, including: a first acquiring unit, configured to acquire the dos header of the pe file of the target software; a second acquiring unit, configured to acquire the The last byte obtains the pe header of the pe file; the code segment determination unit is used to determine the specified code segment in the main program according to the pe header; the byte extraction unit is used to obtain the specified code from the specified code Extracting a predetermined number of bytes from the segment; a hash calculation unit configured to determine the hash value of the target software as software identification information of the target software based on the bytes and a predetermined hash value calculation method.

In a possible design, the device for acquiring software identification information further includes: a software installation unit, configured to install the target software before acquiring the dos header of the pe file of the target software, and update the registration based on the installation operation. table and system configuration information; a main program acquiring unit, configured to acquire the main program of the target software based on the registry or the system configuration information.

In a possible design, the code segment determination unit is configured to: determine the target operating platform of the target software based on the first byte of the pe header; determine the length of the pe header corresponding to the target operating platform , determine the length of the pe header; offset based on the first byte of the pe header and the length of the pe header to obtain multiple section tables of the pe file; determine in the multiple section tables. The target section table where the text section is located, and obtain the .text section in the target section table as the specified code segment.

In a possible design, the byte extracting unit is configured to extract a predetermined number of bytes from the specified code segment according to a specified extraction rule.

In a possible design, the hash calculation unit is configured to: process the byte through an md5 algorithm, a sha1 algorithm or an sm3 algorithm, to obtain a hash value of the target software.

In a fourth aspect, an embodiment of the present application provides a software identification device, including: a software identification information generation unit configured to generate software identification information based on the software identification information acquisition device described in the third aspect above; an identification information acquisition unit configured to Acquire the software identification information of the target software in response to the running request of the target software; a software identification unit is configured to block the target software if the software identification information matches specified identification information in the software blacklist run.

In a fifth aspect, the embodiment of the present application provides an electronic device, including: at least one processor; and a memory connected in communication with the at least one processor; wherein, the memory stores information that can be processed by the at least one processor. An instruction executed by a device, the instruction being configured to execute the method described in the first aspect above.

In a sixth aspect, the embodiment of the present application provides a storage medium storing computer-executable instructions, and the computer-executable instructions are used to execute the method described in the above-mentioned first aspect.

The above technical solution can generate software identification information based on a predetermined number of bytes in the specified code segment. Since the specified code segment remains unchanged when the target software is updated, when the target software is updated, based on the specified code segment The software identification information generated by the predetermined number of bytes is also unchanged. In other words, compared with the technical solution of recalculating software identification information due to software update in the related art, the technical solution of the present application can keep the software identification information unchanged during software update, thereby reducing the resources consumed by regenerating software identification information, The cost of maintaining software identification information is reduced, and the convenience and security of software identification are improved.

【Description of drawings】

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the accompanying drawings that need to be used in the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 shows a flowchart of a method for acquiring software identification information according to an embodiment of the present application;

FIG. 2 shows a flow chart of a method for acquiring software identification information according to another embodiment of the present application;

Fig. 3 shows the flowchart of the software identification method according to one embodiment of the present application;

FIG. 4 shows a schematic diagram of an interaction process between the cloud and the local end according to an embodiment of the present application;

FIG. 5 shows a block diagram of an apparatus for acquiring software identification information according to an embodiment of the present application;

FIG. 6 shows a block diagram of an electronic device according to an embodiment of the present application.

【Detailed ways】

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 shows a flowchart of a method for acquiring software identification information according to an embodiment of the present application.

As shown in Figure 1, a method for acquiring software identification information according to an embodiment of the present application includes:

Step 102, obtaining the dos header of the pe file of the target software.

Step 104: Obtain the pe header of the pe file based on the last byte of the dos header.

pe file is an executable file in the windows system. Common file suffixes include but are not limited to exe, dll, sys, com, ocx, etc. The format of the pe file running on the 32-bit windows system is pe32, and the format of the pe file running on the 64-bit windows system is pe32+. One of the differences between the different formats of the pe files lies in the different pe headers.

The dos header of the pe file is a piece of binary data, and its last byte is used to reflect the position of the pe header in the pe file, so the pe header of the pe file can be obtained from this.

Step 106, according to the pe header, determine the specified code segment in the main program.

The pe header is equivalent to the position reference information of the specified code segment, in other words, the position of the pe header can be used as a condition for determining the position of the specified code segment. Among them, the specified code segment often has a feature segment that will not change due to software updates, and the software identification information of the software is determined on the basis of the feature segments that will not change due to software updates, so that the software can be guaranteed when the software is updated. The identification information remains unchanged, thereby avoiding software identification information resetting caused by software updates, and saving computing resources.

Specifically, the target operating platform of the target software may be determined based on the first byte of the pe header; the length of the pe header may be determined according to the pe header length determination method corresponding to the target operating platform; based on the pe The first byte of the header and the length of the pe header are offset to obtain multiple section tables of the pe file; determine the target section table where the .text section is located in the multiple section tables, and obtain the target The .text section in the section table is used as the specified code segment.

The first byte of the pe header reflects the target operating platform of the target software. The target operating platform includes but is not limited to a 32-bit platform and a 64-bit platform, and can also be any other platform capable of running the target software. Different operating platforms have different calculation methods for the length of the pe header. Therefore, the length of the pe header can be determined according to the determination method of the length of the pe header corresponding to the target operating platform.

Specifically, the size of the optional pe header is different in different operating platforms. On a 64-bit platform, the pe header is a structure of IMAGE_OPTIONAL_HEADER64, and the length of the pe header is obtained through sizeof(IMAGE_OPTIONAL_HEADER64).

On the 32-bit platform, the pe header is IMAGE_OPTIONAL_HEADER, use sizeof(IMAGE_OPTIONAL_HEADER) to get the length of the pe header.

After the length of the pe header is determined, since there are multiple section tables distributed after the pe header, multiple section tables can be obtained by offsetting the first byte of the pe header and the length of the pe header. Each section table is used to describe different functions involved in the software, such as storing initial data, storing and calling functions, and so on. Meanwhile, each section table includes multiple list items, or multiple code segments. Further, each section table can be traversed to determine the section table where the .text section is located, and the .text section can be extracted as a specified code segment.

Step 108, extracting a predetermined number of bytes from the specified code segment.

In a possible design, the extracting the predetermined number of bytes from the specified code segment includes: extracting the predetermined number of bytes from the specified code segment according to a specified extraction rule.

Wherein, the specified extraction rule may be: extract multiple bytes respectively located at multiple specified positions in the specified code segment, and the number of the multiple specified positions is a predetermined number.

The specified extraction rule may also be: extracting bytes at multiple specified positions in the specified code segment, wherein the number of bytes extracted at each specified position is a specified multiple.

Through the above technical solution, the acquired predetermined number of bytes can be made more complex, thereby increasing the complexity of the software identification information obtained with the predetermined number of bytes, and improving the uniqueness of the software identification information for the target software, Improved software security.

Optionally, the predetermined number is sixty. Of course, the predetermined number may be any number that meets the security requirements for software identification information, and is not limited to the example of 60.

Step 110: Determine the hash value of the target software as software identification information of the target software based on the bytes and a predetermined hash value calculation method.

Finally, software identification information is generated based on a predetermined number of bytes in the specified code segment. Since the predetermined number of bytes is a characteristic segment that will not change due to software updates in the specified code segment, when the target software is updated, based on the specified The software identification information generated by the predetermined number of bytes in the code segment is also unchanged. In other words, compared with the technical solution of recalculating software identification information due to software update in the related art, the technical solution of the present application can keep the software identification information unchanged during software update, thereby reducing the resources consumed by regenerating software identification information, The cost of maintaining software identification information is reduced, and the convenience and security of software identification are improved.

In a possible design, the determining the hash value of the target software based on the byte and a predetermined hash value calculation method includes: performing an md5 algorithm, a sha1 algorithm, or an sm3 algorithm on the byte processing to obtain the hash value of the target software.

Among them, the md5 algorithm is the MD5 information digest algorithm, which is a widely used cryptographic hash function, which can convert a predetermined number of bytes extracted from the specified code segment into a 128-bit (16-byte) hash Column value, as the software identification information of the target software. The sha1 algorithm is a kind of Hash algorithm, which can process a predetermined number of bytes extracted from the specified code segment in units of 512 bits, and output a 160-bit message digest as the software identification information of the target software. The sm3 algorithm is a cryptographic hash function standard. The predetermined number of bytes extracted from the specified code segment is used as the input of the hash function, and the message digest is output by the hash function as the software identification information of the target software.

It needs to be known that the predetermined hash value calculation methods in this application include but are not limited to md5 algorithm, sha1 algorithm or sm3 algorithm, and can also be any method that can convert the predetermined number of bytes extracted from the specified code segment into more How the short ciphertext is computed.

Fig. 2 shows a flowchart of a method for acquiring software identification information according to another embodiment of the present application.

As shown in Figure 2, a method for acquiring software identification information according to another embodiment of the present application includes:

Step 202, install the target software, and update the registry and system configuration information based on the installation operation.

Step 204, based on the registry or the system configuration information, acquire the main program of the target software.

To obtain the software identification information of the target software, it is necessary to obtain its pe file from its main program, and the main program can be obtained only when the target software is installed. Therefore, the target software can be installed, and its main program can be retrieved through the registry updated after installation or the system configuration information.

Step 206, obtaining the dos header of the pe file of the target software.

Step 208: Obtain the pe header of the pe file based on the last byte of the dos header.

pe file is an executable file in the windows system. Common file suffixes include but are not limited to exe, dll, sys, com, ocx, etc. The format of the pe file running on the 32-bit windows system is pe32, and the format of the pe file running on the 64-bit windows system is pe32+. One of the differences between the different formats of the pe files lies in the different pe headers.

The dos header of the pe file is a piece of binary data, and its last byte is used to reflect the position of the pe header in the pe file, so the pe header of the pe file can be obtained from this.

Step 210, based on the first byte of the pe header, determine the target operating platform of the target software.

The first byte of the pe header reflects the target operating platform of the target software. The target operating platform includes but is not limited to a 32-bit platform and a 64-bit platform, and can also be any other platform capable of running the target software. In different operating platforms, there are differences in determining the length of the pe header. Therefore, the target operating platform on which the target software is installed can be determined first, so that in the subsequent steps, the corresponding determining method of the length of the pe header can be selected for the target operating platform. .

Step 212: Determine the length of the pe header according to the pe header length determination method corresponding to the target operating platform.

The size of the optional pe header is different in different operating platforms. On the 64-bit platform, the pe header is the structure IMAGE_OPTIONAL_HEADER64, and the length of the pe header can be obtained by sizeof(IMAGE_OPTIONAL_HEADER64).

On the 32-bit platform, the pe header is IMAGE_OPTIONAL_HEADER, use sizeof(IMAGE_OPTIONAL_HEADER) to get the length of the pe header.

Step 214: Obtain multiple section tables of the pe file by offsetting based on the first byte of the pe header and the length of the pe header.

Step 216, determine the target section table where the .text section is located in the plurality of section tables, and obtain the .text section in the target section table as the specified code segment.

After the length of the pe header is determined, since there are multiple section tables distributed after the pe header, multiple section tables can be obtained by offsetting the first byte of the pe header and the length of the pe header. Each section table is used to describe different functions involved in the software, such as storing initial data, storing and calling functions, and so on. Meanwhile, each section table includes multiple list items, or multiple code segments. Further, each section table can be traversed to determine the section table where the .text section is located, and the .text section can be extracted as a specified code segment.

Step 218, extracting a predetermined number of bytes from the specified code segment.

Optionally, the predetermined number is sixty. Of course, the predetermined number may be any number that meets the security requirements for software identification information, and is not limited to the example of 60.

Step 220: Determine the hash value of the target software as software identification information of the target software based on the bytes and a predetermined hash value calculation method.

Finally, software identification information is generated based on a predetermined number of bytes in the specified code segment. Since the specified code segment remains unchanged when the target software is updated, when the target software is updated, based on the predetermined number of bytes in the specified code segment The software identification information generated by the byte is also unchanged.

Through the technical solution, the software identification information can be kept unchanged when the software is updated, thereby reducing the resources consumed for regenerating the software identification information, reducing the cost of maintaining the software identification information, and improving the convenience and safety of software identification.

Fig. 3 shows a flowchart of a software identification method according to an embodiment of the present application.

As shown in Figure 3, the software identification method according to one embodiment of the present application includes:

Step 302, in response to the running request of the target software, acquire software identification information of the target software.

Step 304, if the software identification information matches the specified identification information in the software blacklist, prevent the target software from running.

The software identification information can be used to identify the identity of the target software. By matching the software identification information of the target software with the specified identification information in the software blacklist, it can be judged whether the target software is a member of the software blacklist. In the case of being a member of the blacklist, the target software is prevented from running to protect system security and network security.

Wherein, before step 302, it further includes: generating software identification information by executing the technical solution described in any one of the above-mentioned embodiments. Therefore, this technical solution has all the above-mentioned technical effects, which will not be repeated here.

So far, it can be known that the process of generating the software identification information can be performed on the cloud or locally.

Fig. 4 shows a schematic diagram of an interaction process between the cloud and the local terminal according to an embodiment of the present application. As shown in Figure 4, an automatic download and installation module, an analysis main program module, a hash extraction module and a feature hash database are set on the cloud, while an external calling module is set on the local side.

Specifically, in the cloud, the automatic download and installation module installs the target software, and updates the registry and system configuration information based on the installation operation, so as to obtain the main program of the target software based on the registry or the system configuration information.

The analysis main program module then obtains the dos header of the pe file of the target software, and according to the last byte of the dos header, obtains the pe header of the pe file, and then, based on the first byte of the pe header, determines the The target operating platform of the target software, then, according to the pe header length determination method corresponding to the target operating platform, determine the length of the pe header, and then, based on the first byte of the pe header and the pe header The length is offset to obtain multiple section tables of the pe file, so far, determine the target section table where the .text section is located in the multiple section tables, and obtain the .text section in the target section table , as the specified snippet.

Next, the hash extraction module extracts a predetermined number of bytes from the specified code segment, and based on the bytes and a predetermined hash value calculation method, determines the hash value of the target software as the target software software identification information.

The feature hash database can store the software identification information of the target software generated by the hash extraction module.

On the local side, in response to the running request of the target software, the feature hash database in the cloud is accessed through the external calling module, and the software identification information of the target software is called. If the software identification information matches the specified identification information in the software blacklist, the local end prevents the target software from running; otherwise, the local end allows the target software to run.

In this technical solution, the software identification information can be used to identify the identity of the target software. By matching the software identification information of the target software with the specified identification information in the software blacklist, it can be judged whether the target software is a member of the software blacklist, thereby When the target software is a member of the software blacklist, the target software is prevented from running to protect system security and network security.

Fig. 5 shows a block diagram of an apparatus for acquiring software identification information according to an embodiment of the present application.

As shown in FIG. 5 , a software identification information acquisition device 500 according to an embodiment of the present application includes: a first acquisition unit 502, configured to acquire the dos header of the pe file of the target software; a second acquisition unit 504, configured to The last byte of the dos header obtains the pe header of the pe file; the code segment determination unit 506 is used to determine the specified code segment in the main program according to the pe header; the byte extraction unit 508 uses to extract a predetermined number of bytes from the specified code segment; the hash calculation unit 510 is configured to determine the hash value of the target software as the target based on the bytes and a predetermined hash value calculation method Software identification information for the software.

In a possible design, the software identification information acquisition device 500 also includes: a software installation unit, configured to install the target software before acquiring the dos header of the pe file of the target software, and update the target software based on the installation operation Registry and system configuration information; a main program acquiring unit, configured to acquire the main program of the target software based on the registry or the system configuration information.

In a possible design, the code segment determination unit 506 is configured to: determine the target operating platform of the target software based on the first byte of the pe header; determine the target software according to the length of the pe header corresponding to the target operating platform way, determine the length of the pe header; offset based on the first byte of the pe header and the length of the pe header to obtain multiple section tables of the pe file; determine in the multiple section tables The target section table where the .text section is located, and obtain the .text section in the target section table as the specified code segment.

In a possible design, the byte extracting unit 508 is configured to extract a predetermined number of bytes from the specified code segment according to a specified extraction rule.

In a possible design, the hash calculation unit 510 is configured to: process the bytes through an md5 algorithm, a sha1 algorithm or an sm3 algorithm to obtain a hash value of the target software.

The apparatus 500 for acquiring software identification information uses any of the solutions described in the foregoing embodiments, and therefore has all the technical effects described above, which will not be repeated here.

In addition, the embodiment of the present application also provides a software identification device, including: a software identification information generation unit, used to generate software identification information based on the software identification information acquisition device 500; an identification information acquisition unit, used to respond to the operation of the target software requesting to obtain the software identification information of the target software; a software identification unit configured to prevent the target software from running if the software identification information matches specified identification information in the software blacklist.

The software identification device uses software to identify all the technical effects of the information acquisition device 500, which will not be repeated here.

FIG. 6 shows a block diagram of an electronic device according to an embodiment of the present application.

As shown in FIG. 6, an electronic device 600 according to an embodiment of the present application includes at least one memory 602; and a processor 604 communicatively connected to the at least one memory 602; Instructions executed by at least one processor 604, the instructions are configured to implement the solutions described in any of the foregoing embodiments. Therefore, the electronic device 600 has the same technical effect as that in any of the foregoing embodiments, which will not be repeated here.

The electronic equipment of the embodiment of the present application exists in various forms, including but not limited to:

(1) Mobile communication equipment: This type of equipment is characterized by mobile communication functions, and its main goal is to provide voice and data communication. Such terminals include: smart phones, multimedia phones, feature phones, and low-end phones.

(2) Ultra-mobile personal computer equipment: This type of equipment belongs to the category of personal computers, has computing and processing functions, and generally has the characteristics of mobile Internet access. Such terminals include: PDA, MID and UMPC equipment, etc.

(3) Portable entertainment equipment: This type of equipment can display and play multimedia content. Such devices include: audio and video players, handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

(4) Server: A device that provides computing services. The composition of a server includes a processor, hard disk, memory, system bus, etc. The server is similar to a general-purpose computer architecture, but due to the need to provide high-reliability services, it is important in terms of processing power and stability. , Reliability, security, scalability, manageability and other aspects have high requirements.

(5) Other electronic devices with data interaction function.

It should be known that this application is based on the feature extraction of pe files under the windows system, so it can be applied to various Surface devices.

In addition, the embodiment of the present application provides a storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to perform the following steps: obtain the dos header of the pe file of the target software; Byte, obtain the pe header of the pe file; according to the pe header, determine the specified code segment in the main program; extract a predetermined number of bytes from the specified code segment; based on the byte and the predetermined The hash value calculation method is to determine the hash value of the target software as the software identification information of the target software.

It should be noted that, for the above functions or steps that can be implemented by the storage medium or the electronic device, reference may be made to the relevant descriptions in the foregoing method embodiments, and to avoid repetition, they are not described here one by one.

The technical solution of the present application has been described in detail above in conjunction with the accompanying drawings. Through the technical solution of the present application, the software identification information can be kept unchanged when the software is updated, thereby reducing the resources consumed by regenerating the software identification information and reducing the maintenance of software identification information. The cost has improved the convenience and security of software identification.

Depending on the context, the word "if" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if determined" or "if detected (the stated condition or event)" could be interpreted as "when determined" or "in response to the determination" or "when detected (the stated condition or event) )" or "in response to detection of (a stated condition or event)".

Terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of this application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined Or it can be integrated into another system, or some features can be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above-mentioned embodiments can be completed by instructing related hardware through computer programs, and the computer programs can be stored in a non-volatile computer-readable memory In the medium, when the computer program is executed, it may include the processes of the embodiments of the above-mentioned methods. Wherein, any references to memory, storage, database or other media used in the various embodiments provided in the present application may include non-volatile and/or volatile memory. Nonvolatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Chain Synchlink DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The above-described embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still carry out the foregoing embodiments Modifications to the technical solutions recorded in the examples, or equivalent replacement of some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should be included in within the protection scope of the present invention.

Claims (10)

1. A method for acquiring software identification information, comprising: Obtain the dos header of the pe file of the target software; Obtain the pe header of the pe file based on the last byte of the dos header; According to the pe header, determine the specified code segment in the main program; extracting a predetermined number of bytes from said specified code segment; Based on the bytes and a predetermined hash value calculation method, determine the hash value of the target software as software identification information of the target software. 2. the software identification information acquisition method according to claim 1, is characterized in that, before the dos header of the pe file of described acquisition target software, also comprises: Install the target software, and update the registry and system configuration information based on the installation operation; Obtain the main program of the target software based on the registry or the system configuration information. 3. The method for obtaining software identification information according to claim 1, wherein, according to the pe header, determining a specified code segment in the main program includes: Based on the first byte of the pe header, determine the target operating platform of the target software; Determine the length of the pe header according to the pe header length determination method corresponding to the target operating platform; Obtaining multiple section tables of the pe file by offsetting based on the first byte of the pe header and the length of the pe header; Determine the target section table where the .text section is located in the plurality of section tables, and obtain the .text section in the target section table as the specified code segment. 4. The software identification information acquisition method according to any one of claims 1 to 3, wherein said extracting a predetermined number of bytes from said specified code segment comprises: Extracting a predetermined number of bytes from the specified code segment according to a specified extraction rule. 5. The software identification information acquisition method according to any one of claims 1 to 3, wherein the hash value of the target software is determined based on the byte and a predetermined hash value calculation method, include: The bytes are processed through the md5 algorithm, the sha1 algorithm or the sm3 algorithm to obtain the hash value of the target software. 6. A software identification method, characterized in that, comprising: Acquiring software identification information of the target software in response to the running request of the target software; If the software identification information matches the specified identification information in the software blacklist, the target software is prevented from running, wherein, before the acquisition of the software identification information of the target software, by executing any one of claims 1 to 5 A said method generates said software identification information. 7. A software identification information acquisition device, characterized in that it comprises: The first obtaining unit is used to obtain the dos header of the pe file of the target software; The second obtaining unit is used to obtain the pe header of the pe file based on the last byte of the dos header; a code segment determining unit, configured to determine a specified code segment in the main program according to the pe header; a byte extraction unit, configured to extract a predetermined number of bytes from the specified code segment; A hash calculation unit, configured to determine the hash value of the target software as software identification information of the target software based on the bytes and a predetermined hash value calculation method. 8. A software identification device, characterized in that it comprises: A software identification information generation unit, configured to generate software identification information based on the software identification information acquisition device described in claim 7; an identification information acquiring unit, configured to acquire the software identification information of the target software in response to a running request of the target software; A software identification unit, configured to prevent the target software from running if the software identification information matches specified identification information in the software blacklist. 9. An electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication; Wherein, the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method according to any one of claims 1 to 6 above. 10. A storage medium, characterized by storing computer-executable instructions, the computer-executable instructions being used to execute the method according to any one of claims 1-6.

Images