CN101710375A - Anti-viral device in anti-viral software and anti-viral method thereof - Google Patents

Abstract

The invention relates to an anti-viral device embedded in anti-viral software and an anti-viral method for anti-virus by using the anti-viral device. The anti-viral device in the anti-viral software comprises an anti-viral characteristic loading device, a source code compiling device and a native code execution device, wherein the anti-viral characteristic loading device is arranged in an anti-viral software engine and used for loading encrypted and compressed source code characteristics and transferring a result to the source code compiling device; the source code compiling device is arranged in the anti-viral software engine and used for compiling, discovering and clearing away the source code characteristics of virus and generating a native code which can be recognized by an instruction architecture; and the native code execution device is arranged in the anti-viral software engine and used for executing the native code generated by the source code compiling device and associating the native code and a functional function in the anti-viral software engine so as to control and execute the native code generated by the source code compiling device. The device allows antivirus software to use a storage characteristic with smaller size and can execute by higher efficiency.

Description

Anti-virus device and anti-viral method thereof in the anti-viral software

Technical field

The present invention relates to the computer anti-virus software field, relate in particular to a kind of anti-virus device that is embedded in the anti-viral software, and use this anti-virus device to carry out anti-microbial method.

Background technology

In the anti-virus field, several viroids (as polymorphic virus, infection type virus) more complicated is arranged, adopt common aspect ratio very difficult this viroid of mode killing, at the virus of these kinds, anti-viral software need use complicated method could discern it or remove them.At present, general anti-viral software can adopt following technological means: script machine technology, virtual machine technique or primary instruction technique.But all there is certain shortcoming in these methods:

The script machine technology, the anti-virus script is inconvenient to debug in the process that virus analysis person writes;

Virtual machine technique, anti-virus code are to carry out in virtual machine, rather than directly carry out on CPU, so the more primary instruction of execution speed is slow, being whole system design and realizing very complicated of most critical;

Primary instruction technique exists and to stride instruction framework problem, and anti-viral software need all be prepared a primary instruction code separately for the instruction framework of its compatibility, and to relate to the reorientation so the storage volume of code bigger because of primary instruction.

Summary of the invention

First purpose of the present invention is to overcome deficiency of the prior art, a kind of anti-virus device that is embedded in the anti-viral software is provided, this anti-virus device can allow antivirus software use the storage feature of smaller size smaller, can carry out with higher efficient, and make things convenient for the virus analysis personnel to write this feature.

Second purpose of the present invention provides a kind of anti-viral method of above-mentioned anti-virus device.

In order to realize above-mentioned first purpose, by the following technical solutions: the anti-virus device in the anti-viral software, it comprises:

Be positioned at the anti-virus feature loading attachment of anti-viral software engine, it is used for loading encrypted and source code feature that compressed, and the result is passed to following compilation of source code device;

Be positioned at the compilation of source code device of anti-viral software engine, it is used for compiling the source code feature of finding and removing virus, generates the discernible primary code of place instruction framework;

Be positioned at the primary code actuating unit of anti-viral software engine, it is used for carrying out the primary code that the compilation of source code device produces, and the power function of described primary code and anti-viral software engine internal is carried out related, control and carry out the primary code that compilation device produces.

In order to realize above-mentioned second purpose, by the following technical solutions: the anti-viral method of the anti-virus device in the anti-viral software, its process be, source code feature encrypted or compression is decrypted and decompresses; Source code feature after deciphering and the decompression is compiled, produce the primary code of current anti-viral software place instruction framework; The power function of described primary code and anti-virus engine internal is carried out related, control and carry out described primary code.

Anti-virus device of the present invention and anti-viral method are that direct service routine source code carries out anti-virus.It has following advantage:

1, similar script machine technology, the program source code of use plain text format, ratio of compression is big, and final storage volume is less, the convenient editor of feature;

2, instruction framework onrelevant can be striden the instruction framework and be carried out, and a cover anti-virus feature can be suitable for all platforms;

3, middle compilation speed is fast, and final execution speed is fast, near the travelling speed of direct primary instruction;

4, debugging cost is low, and the virus analysis personnel can debug the anti-virus source code easily.

Embodiment

Anti-virus device in the anti-viral software, it comprises:

Be based upon an anti-virus feature loading attachment in the anti-viral software engine, be used for loading encrypted and source code feature that compressed, after being decrypted and decompressing, pass to the compilation of source code device and compile, produce the primary code of current place instruction framework;

Be based upon the device of compilation of source code efficiently of a lightweight in the anti-viral software engine, be used for compiling the source code feature of finding and removing virus, with the almost negligible speed of required time with respect to the magnetic disc i/o operation, generate the primary code of place instruction framework;

Be based upon a primary code actuating unit in the anti-viral software engine, be used for carrying out the primary code that the compilation of source code device produces; The primary code that this device is produced the compilation of source code device and the power function of anti-virus engine internal carry out related, and control and carry out the primary code that the compilation of source code device produces reaches the purpose of finding virus or removing virus.

Described source code feature is the virus characteristic that exists with the source code form that is stored in the virus base of anti-viral software.Source code is characterized as the program source code of plain text format.

Some is the feature that exists with the binary code form in the virus base of anti-viral software, and it is employed that these features are that anti-viral software is used for some street virus of killing.And being bogusware, the feature of these binary codes compiles out in advance.At special viruses such as the polymorphic virus described in the background technology of the present invention, infection type viruses.Adopt anti-virus device of the present invention to handle.The compilation of source code device that employing is present in the lightweight in the anti-viral software compiles.

The anti-viral method of above-mentioned anti-virus device is, source code feature encrypted or compression is decrypted and decompresses; Source code feature after deciphering and the decompression is compiled, produce the primary code of current anti-viral software place instruction framework; The power function of described primary code and anti-virus engine internal is carried out related, control and carry out described primary code.

1, the special case on x86 instruction framework:

This method is set up an anti-virus feature loading attachment in the anti-virus engine internal of x86 instruction framework, is responsible for loading the anti-virus feature database after encrypted and the compression;

Anti-virus feature loading attachment passes to one to the anti-virus source code with the C language compilation of the anti-virus feature database the inside that loads and is integrated with the compilation of source code device of lightweight C CompilerTools efficiently;

The compilation of source code device becomes the primary code of the very high x86 of execution speed to the anti-virus compilation of source code of the C language compilation that anti-virus feature loading attachment passes over;

Anti-virus engine internal on x86 instruction framework is set up a primary code actuating unit in addition, be responsible for carrying out related with the x86 machine code that the compilation of source code device produces the power function of anti-virus engine internal, and the x86 machine code of control and the generation of execution compilation of source code device, reach and on the computing machine of x86, find virus and the viral purpose of removing.

2, the special case on arm instruction framework:

This method is set up an anti-virus feature loading attachment in the anti-virus engine internal of arm instruction framework, is responsible for loading the anti-virus feature;

Anti-virus feature loading attachment passes to the anti-virus source code of the C language compilation of the anti-virus feature database the inside that loads in the compilation of source code device that lightweight C CompilerTools is arranged of an integrated efficient;

The compilation of source code device becomes the primary code of the very high arm of execution speed to the anti-virus compilation of source code of the C language compilation that anti-virus feature loading attachment passes over;

Anti-virus engine internal on arm instruction framework is set up a primary code actuating unit in addition, be responsible for carrying out related with the arm machine code that the compilation of source code device produces the power function of anti-virus engine internal, and the arm machine code of control and the generation of execution compilation of source code device, reach morbidity poison and the viral purpose of removing on the computing machine of arm.

Above embodiment is the unrestricted technical scheme of the present invention in order to explanation only.Any modification or partial replacement that does not break away from spirit and scope of the invention should be encompassed in the middle of the claim scope of the present invention.

Claims (6)

1. the anti-virus device in the anti-viral software is characterized in that, comprises

Be positioned at the anti-virus feature loading attachment of anti-viral software engine, it is used for loading encrypted and source code feature that compressed, and the result is passed to following compilation of source code device;

Be positioned at the compilation of source code device of anti-viral software engine, it is used for compiling the source code feature of finding and removing virus, generates the discernible primary code of place instruction framework;

Be positioned at the primary code actuating unit of anti-viral software engine, it is used for carrying out the primary code that the compilation of source code device produces, and the power function of described primary code and anti-viral software engine internal is carried out related, control and carry out the primary code that the compilation of source code device produces.

2. the anti-virus device in the anti-viral software according to claim 1 is characterized in that, described source code feature is the virus characteristic that exists with the source code form that is stored in the virus base of anti-viral software.

3. the anti-virus device in the anti-viral software according to claim 2 is characterized in that described source code is characterized as the program source code of plain text format.

4. the anti-viral method of the anti-virus device in the anti-viral software is characterized in that, source code feature encrypted or compression is decrypted and decompresses; Source code feature after deciphering and the decompression is compiled, produce the primary code of current anti-viral software place instruction framework;

The power function of described primary code and anti-virus engine internal is carried out related, control and carry out described primary code.

5. anti-viral method according to claim 4 is characterized in that,

Described source code feature is the virus characteristic that exists with the source code form that is stored in the virus base of anti-viral software.

6. anti-viral method according to claim 5 is characterized in that,

Described source code is characterized as the program source code of plain text format.