CN102156649B - Patch installation method and device thereof - Google Patents

Abstract

The present invention provides a vulnerability repair method and device, wherein the method includes: obtaining a first patch installation package, extracting a first installation condition related file from the first patch installation package; using a second installation condition related file Replacing the first installation condition-related files; generating a second patch installation package according to the first patch installation package and the replaced result; using the second patch installation package to repair vulnerabilities. Through the present invention, it is beneficial to improve the success rate of loopholes existing in the repair program.

Description

A patch installation method and device

technical field

The invention relates to the technical field of computers, in particular to a patch installation method and device.

Background technique

For large-scale software systems (such as Microsoft operating systems, etc.), there are many factors that have not been considered during the development process, but some problems may be exposed during the use process, and the existence of these problems may make users When the system or software has problems such as interfering with work or harmful to safety, after discovering such problems, it is necessary to compile some additional small programs to repair the problems in the software itself. This small program is called a patch. Usually, the patch is made by the original author of the software. Software users can download the patch from the website and install it locally, so that the defects in the software can be effectively repaired, so as to correct program errors, reduce or eliminate security issues. risk, improve the utilization efficiency of the program, etc.

Of course, if all the patches are downloaded and installed, it does not necessarily make the machine more secure. Conversely, installing outdated, unnecessary, or even questionable patches can put your machine at risk. Therefore, when releasing a patch package (referring to a collection of upgraded patches released by a certain system at a certain period of time), the installation conditions of the patch are usually limited in the patch package, and when installing the patch to a certain machine, the test program is installed It is necessary to first judge whether the current machine environment satisfies the conditions according to the installation conditions in the patch package, and if so, install the corresponding patches; otherwise, do not install any more.

In this way of patch installation, there will be some problems. For example, Microsoft has restricted the version section of the released patches, and for most genuine Microsoft users in China, due to some technical reasons, when detecting the patch status information, it is found that the version information stored in the registry of the operating system, Or the version information stored in the specific file does not meet the version requirements required by the patch, thus causing the patch to not be installed normally, and thus the loopholes existing in the program cannot be effectively repaired in a timely and effective manner.

Contents of the invention

The invention provides a loophole repairing method and device, which is beneficial to improving the success rate of loopholes existing in a repairing program.

The present invention provides following scheme:

A vulnerability repair method, comprising:

Obtaining a first patch installation package, and extracting first installation condition related files from the first patch installation package;

replacing the first installation condition related file with a second installation condition related file;

Generate a second patch installation package according to the first patch installation package and the replaced result;

Vulnerabilities are repaired by using the second patch installation package.

Preferably, the first installation condition-related files include:

Installation test programs and/or configuration files in the first patch installation package.

Preferably, it also includes:

A new installation condition is generated, and files related to the second installation condition are generated according to the new installation condition.

Preferably, said generating new installation conditions includes:

Extracting the first installation condition from the first installation condition related file; generating a new installation condition according to the first installation condition.

Preferably, said generating new installation conditions includes:

Capture the installation condition information published on the webpage where the first patch installation package is located, the installation condition information includes operating system conditions and program/component conditions; generate new installation conditions according to the installation condition information.

Preferably, said generating new installation conditions includes:

If the version of the target program/component in the target machine environment is lower than the latest version in the program/component condition, it is determined that the corresponding patch file is suitable for installation;

or,

When the patch file in the first patch installation package can eliminate a loophole in a certain program/component, it is determined that the patch file is suitable for installation;

or,

If after installing a certain patch file in a certain machine environment, the loopholes in a certain program/component can be repaired, and there will be no system instability, then it is determined that the patch file is suitable for installation in this machine environment;

or,

If the target program/component corresponding to a patch file has nothing to do with the security or stability of the system operation, and the installation of other patch files will not be affected if the patch file is not installed, it is determined that the patch file is not suitable for installation.

A vulnerability repair device, comprising:

An extracting unit, configured to obtain a first patch installation package, and extract first installation condition related files from the first patch installation package;

a replacement unit, configured to replace the first installation condition related file with a second installation condition related file;

A generating unit, configured to generate a second patch installation package according to the first patch installation package and the replaced result;

A repairing unit, configured to use the second patch installation package to repair vulnerabilities.

Preferably, the first installation condition-related files include:

Installation test programs and/or configuration files in the first patch installation package.

Preferably, it also includes:

The condition generation unit is configured to generate a new installation condition, and generate the second installation condition related file according to the new installation condition.

Preferably, the condition generation unit includes:

The extraction subunit is used to extract the first installation condition from the first installation condition-related file; and generate a new installation condition according to the first installation condition.

Preferably, the condition generation unit includes:

The crawling subunit is used to grab the installation condition information published on the webpage where the first patch installation package is located, the installation condition information includes operating system conditions and program/component conditions; generate a new installation condition information according to the installation condition information condition.

Preferably, the condition generation unit includes:

The first condition generates a subunit, which is used to determine that the corresponding patch file is suitable for installation if the version of the target program/component in the target machine environment is lower than the latest version in the program/component condition;

or,

The second condition generates a subunit, which is used to determine that the patch file is suitable for installation when the patch file in the first patch installation package can eliminate the loopholes in a certain program/component;

or,

The third condition generates a subunit, which is used to determine that the patch file is suitable for use in a certain machine environment if the loopholes in a certain program/component can be repaired and there will be no system instability. Installed in the machine environment;

or,

The fourth condition generates a subunit, which is used to determine that the patch file is not suitable if the target program/component corresponding to the patch file has nothing to do with the security or stability of the system operation, and the installation of the patch file does not affect the installation of other patch files. Install.

According to the specific embodiments provided by the invention, the invention discloses the following technical effects:

The embodiment of the present invention can replace the installation condition-related files in the patch installation package, and then generate a new patch installation package, and use the new patch installation package to repair the loopholes in the program, wherein, in the replaced installation condition-related files The installation conditions can be obtained by reanalyzing the original installation conditions and optimizing the update. In this way, the installation conditions in the newly replaced installation condition related files are more suitable for user installation than those in the original installation condition related files, and the optimized The updated installation conditions can ensure that users can install patches in a timely and effective manner and reduce system risks. When installing patches with optimized and updated installation conditions, the success rate of fixing vulnerabilities in programs can be effectively improved.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is the flowchart of the method provided by the embodiment of the present invention;

Fig. 2 is a schematic diagram of a device provided by an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention belong to the protection scope of the present invention.

Referring to Fig. 1, the vulnerability repairing method that the embodiment of the present invention provides comprises the following steps:

S101: Obtain a first patch installation package, and extract first installation condition related files from the first patch installation package;

Wherein, the so-called first patch installation package here may refer to the patch installation package provided by the original author of the software, such as the patch installation package provided by Microsoft for its specific software product, and the like. The original author of the software usually publishes the patch installation package provided by it on the official website. Therefore, this patch installation package is also called the officially released patch installation package. You can obtain this officially released patch installation package by downloading it from the official website.

For a patch installation package, it will include a patch file, that is, a file actually used to fix program vulnerabilities, and also include an installation test program. Wherein, the installation test program includes an executable file for installing the patch. Specifically, the installation test program can determine whether the current machine environment can install the patch according to the preset installation conditions before performing the specific patch installation. Install the patch file in the package, if possible, install it, otherwise it will not perform the installation operation. In addition, in some cases, the installation test program may also include an executable file for testing. Specifically, the installation test program can run a test program with relevant data to determine whether the current patch file can repair the specified program. Vulnerabilities, or whether the installation of patch files brings system instability, etc.

Among them, the specific installation conditions may be written in the installation test program, as long as the installation test program is run, the machine environment can be judged automatically according to the written installation conditions. In addition, in another case, the specific installation conditions may be written in the configuration file. When the installation test program is running, it needs to read the configuration file, and then use the installation conditions in the configuration file to judge the machine environment.

Therefore, in the embodiment of the present invention, the installation condition-related files may refer to the installation test program and/or the configuration file in the patch installation package. That is, if all the installation conditions are written in the installation test program, then the installation condition-related files refer to the installation test program. When extracting the first installation condition-related files, only the installation test program in the officially released patch installation package can be extracted. ; If all the installation conditions are written in the configuration file, then the installation condition related file refers to the configuration file. When extracting the first installation condition related file, only the configuration file in the officially released patch installation package can be extracted; if the installation condition part Written in the installation test program and partly written in the configuration file, the installation condition related files refer to the installation test program and configuration file. When extracting the first installation condition related files, it is necessary to extract the installation test in the officially released patch installation package. programs and configuration files.

S102: Replace the first installation condition related file with the second installation condition related file;

The second installation condition-related file is corresponding to the first installation condition-related file, if the first installation condition-related file is an installation test program, then the second installation condition-related file should also be an installation test program, that is, use a new The installation test program replaces the original installation test program, so that when the patch file is installed, the new installation test program will be run, and the machine environment will be judged according to the installation conditions set in the new installation test program.

Similarly, if the first installation condition-related file is a configuration file, then the second installation condition-related file should also be a configuration file. Of course, since the installation test program in the patch installation package has not changed, in order to enable the installation test program to Read the configuration file normally, and the replaced configuration file can use the same file name as the original configuration file; in this way, the installation test program in the patch installation package can read the installation conditions set in the new configuration file when it is running , and judge the machine environment according to the installation conditions.

Alternatively, if the first installation condition-related file includes an installation test program and a configuration file, the second installation condition-related file should also include both an installation test program and a configuration file. Since the installation test program will also change, the replaced configuration file can use the same file name as the original configuration file, or it can use a different file name, as long as the replaced installation test program can read the configuration file normally. Yes; in this way, when installing the patch file, a new installation test program will be run. During the running process, the new installation test program will not only judge the machine environment according to the installation conditions set by itself, but also read the new The installation conditions in the configuration file, and judge the machine environment according to the installation conditions set in the new configuration file.

In a word, regardless of the above circumstances, the modification of the original installation conditions can be realized by replacing the installation condition-related files in the original patch installation package.

S103: Generate a second patch installation package according to the first patch installation package and the replaced result;

After the conditions related to the first installation condition are replaced with the files related to the second installation condition, the patch files in the first patch installation package and the files related to the second installation condition can be repackaged to generate the second patch installation package. In this way, it is equivalent to that the patch files in the patch installation package have not changed, but only the files related to the installation conditions have changed.

Wherein, when generating the second patch installation package, the same packaging method as that of the first patch installation package can be adopted, for example, the order of the patch files can be the same as in the first patch installation package, which is equivalent to adding the installation conditions in the patch installation package to Restoration of information other than related files.

S104: Use the second patch installation package to repair the vulnerability.

After the second patch installation package is generated, the second patch installation package can be used to repair program vulnerabilities in the machine.

It can be seen that in the embodiment of the present invention, the installation condition-related files in the patch installation package can be replaced, and then a new patch installation package can be generated, and the loopholes existing in the program can be repaired with the new patch installation package, wherein, the replaced installation The installation conditions in the condition-related files can be obtained by re-analyzing the original installation conditions, thereby optimizing and updating them. In this way, the installation conditions in the newly replaced installation-condition-related files are more suitable than those in the original installation-condition-related files. Users, and optimized and updated installation conditions can ensure that users can install patches in a timely and effective manner, reducing system risks, and using optimized and updated installation conditions to install patches can effectively improve the success rate of repairing vulnerabilities.

Wherein, regarding the second patch installation package, it may be manually written by a programmer or the like, or may be automatically written by a program. There are many ways to set the specific installation conditions, and one of them will be introduced below.

Usually, when the official patch installation package is released, the installation conditions of the patch installation package (usually in the form of text and independent of the patch installation package) will be released on the website. These conditions are usually only for the operating system version of the machine, for SOFTWARE AND SOFTWARE VERSION LIMITATIONS. For example, when a patch package is released on an official website, the following information is also released:

"OS: Windows XP sp3

software sp2

Native condition 1:

C:\Program Files\Microsoft Office\OFFICE11\\winword.exe

Native condition 2:

C:\Program Files\Microsoft Office\OFFICE11\\WINWORD.EXE”

It can be seen that these conditions only include operating system conditions and software conditions, that is, only the version of the operating system, the name and version of the software are restricted. Software can be repaired with this patch file. However, for the officially released patch installation package, the installation conditions set therein usually include other conditions in addition to the above conditions, for example, other conditions may also be included, such as file integrity, consistency, and dependencies, etc. Judgment, in this way, as long as any one of the conditions is not satisfied, the installation of the patch file cannot be realized.

Therefore, when generating the second installation condition-related file, new installation conditions can be set according to the operating system and software conditions published on the official website, and a new installation condition-related file can be generated. That is, in the second installation condition-related file, the setting of the installation condition may only consider factors such as operating system version and software version, and other factors such as file integrity, consistency, and dependency may not be considered. In addition, when considering the version information of the operating system and software, more versions can be included as much as possible. For example, the software version condition on the official website may be a closed interval, but in the embodiment of the present invention, it can be set as an open interval , so that as long as the software version in the target machine environment is lower than the latest value indicated on the official website, the corresponding patch file can be installed. The installation conditions generated in this way will be more suitable for user installation, so that some operating system versions and software versions meet the requirements, but the machine environment such as file integrity and dependencies do not meet the requirements, and the patch files can also be successfully installed.

Based on the above, in the case of manually generating the relevant files of the second installation condition, the programmer can obtain the operating system conditions and software conditions required by the patch installation package from the official website where the patch installation package is located or other channels, and then according to For this condition, rewrite the code for installing the test program, or rewrite the configuration file. Certainly, combined with experience, only some patch installation packages prone to installation failure can be processed according to the method described in the embodiment of the present invention.

In the case of automatically generating files related to the second installation condition, you can pre-set the installation test program or configuration file template, and automatically go to the designated official website through a program to capture the installation condition information corresponding to the patch installation package. After the installation condition information is obtained, it is automatically added to the installation test program or configuration file template to generate a new installation test program or configuration file.

Of course, in addition to using the installation condition information released on the official website, there are other ways to obtain new installation conditions, and use the new installation conditions to generate the second patch installation package. For example, it is also possible to extract the first installation condition from the file progress related to the first installation condition, and then obtain a new installation condition according to the first installation condition. Specifically, the file related to the first installation condition may be analyzed, for example, information on a specified location in the file related to the first installation condition may be obtained, or the file related to the first installation condition may be scanned using a preset keyword to obtain information corresponding to the keyword. information, etc., thereby extracting the first installation condition therefrom. Then, new installation conditions are obtained by modifying the first installation conditions or deleting some of the installation conditions.

Specifically, when generating a new installation condition, in addition to the aforementioned version information, other factors may also be considered. For example, if there is a program or component installed in the environment of a target machine, due to its existence, it may bring unsafe or unstable factors to the system operation, and a patch file can just eliminate the danger, then it should be installed in the machine. For the patch file, when the installation condition is set, the program or component can be set to be able to install the patch file. Specifically, when judging whether a patch file can repair a vulnerability of a certain program or component, it can be judged by checking historical repair records and the like. In addition, as mentioned above, the installation test program may also include a program for testing relevant data. Therefore, it is also possible to judge whether the patch file can fix the vulnerability of a certain program or component by running the test program.

In addition, the following situations may also exist in practical applications: Since the machine environment is usually complex and the specific configurations are also different, if only the operating system and software conditions are considered, the system may fail after installing some patch files. Instability and other negative effects, if so, the patch file should not be installed. In view of this situation, it can be carried out as follows: extract the patch file in the first patch installation package, simulate various possible machine environments under the condition that the operating system conditions and software conditions all meet the requirements, and in various possible machine environments After a period of observation, if it is found that the system is unstable in a certain machine environment, this machine environment will be excluded from the range where the patch file can be installed.

Of course, in actual applications, among the officially released patch files, some patch files are aimed at repaired programs or components (such as Office Help, etc.), which may not affect the security and stability of the system operation, and if not The installation of this patch file will not affect the installation of other patch files, so it is not necessary to install the patch file, which can improve efficiency and avoid unnecessary system overhead.

Of course, you can also run the test program installed in the original patch installation package to determine whether the installation of certain patch files will cause negative impacts such as system instability, or if some patch files are not installed, whether there will be Affect the installation of other patch files, etc.

Corresponding to the vulnerability modification method provided by the embodiment of the present invention, the embodiment of the present invention also provides a vulnerability repair device, see Figure 2, the device includes:

An extracting unit 201, configured to obtain a first patch installation package, and extract a first installation condition related file from the first patch installation package;

A replacement unit 202, configured to replace the first installation condition related file with a second installation condition related file;

A generation unit 203, configured to generate a second patch installation package according to the first patch installation package and the replaced result;

The repairing unit 204 is configured to use the second patch installation package to repair vulnerabilities.

Wherein, the first installation condition-related files include:

Installation test programs and/or configuration files in the first patch installation package.

In practical applications, a new installation condition can be automatically generated through a program, and then a second installation condition-related file can be generated. At this time, the device can also include:

The condition generation unit is configured to generate a new installation condition, and generate the second installation condition related file according to the new installation condition.

Wherein, in one embodiment, the condition generation unit may include:

The extraction subunit is used to extract the first installation condition from the first installation condition-related file; and generate a new installation condition according to the first installation condition.

In another implementation manner, the condition generating unit may include:

The crawling subunit is used to grab the installation condition information published on the webpage where the first patch installation package is located, the installation condition information includes operating system conditions and program/component conditions; generate a new installation condition information according to the installation condition information condition.

Wherein, when generating specific installation conditions, the condition generating unit may include:

The first condition generates a subunit for determining that the corresponding patch file is suitable for installation if the version of the target program/component in the target machine environment is lower than the latest version in the program/component condition.

In other implementation manners, the condition generating unit may also include:

The second condition generates a subunit, which is used to determine that the patch file is suitable for installation when the patch file in the first patch installation package can eliminate a loophole in a certain program/component.

Alternatively, the condition generation unit may also include:

The third condition generates a subunit, which is used to determine that the patch file is suitable for use in a certain machine environment if the loopholes in a certain program/component can be repaired and there will be no system instability. installed in the machine environment.

Furthermore, the condition generation unit may also include:

The fourth condition generates a subunit, which is used to determine that the patch file is not suitable if the target program/component corresponding to the patch file has nothing to do with the security or stability of the system operation, and the installation of the patch file does not affect the installation of other patch files. Install.

It can be seen that in the vulnerability repairing device provided by the embodiment of the present invention, the installation condition-related files in the patch installation package can be replaced, and then a new patch installation package can be generated, and the loopholes existing in the program can be repaired with the new patch installation package, wherein , the installation conditions in the replaced installation condition-related files can be obtained by re-analyzing the original installation conditions, thereby optimizing and updating. In this way, the installation conditions in the newly replaced installation-condition-related files are more The installation conditions are more suitable for users, and the optimized and updated installation conditions can ensure that users can install patches in a timely and effective manner, reducing system risks. When installing patches with optimized and updated installation conditions, it can effectively improve the success of repairing vulnerabilities. Rate.

A bug repair method and device provided by the present invention have been introduced above in detail. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The descriptions of the above embodiments are only used to help understand the present invention. method and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and application scope. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (4)

1. A patch installation method, comprising:

acquiring a first patch installation package, and extracting a first installation condition related file for judging a machine environment from the first patch installation package;

generating new installation conditions, and generating a second installation condition related file for judging whether the machine environment is suitable for installing the patch file according to the new installation conditions;

replacing the first installation condition-related file with the second installation condition-related file;

generating a second patch installation package by using other files in the first patch installation package except the files related to the first installation condition and the files related to the second installation condition;

utilizing the second patch installation package to carry out bug fixing;

the generating of the new installation condition includes:

acquiring information of a specified position in the first installation condition related file, or scanning the first installation condition related file by using a preset keyword to acquire information corresponding to the keyword so as to extract the first installation condition from the information; the new installation condition is obtained by modifying the first installation condition or deleting some of the first installation condition.

2. The method according to claim 1, wherein the first installation condition-related file includes:

and installing the test program and/or the configuration file in the first patch installation package.

3. A patch installation device, comprising:

the system comprises an extraction unit, a judgment unit and a processing unit, wherein the extraction unit is used for acquiring a first patch installation package and extracting a first installation condition related file for judging a machine environment from the first patch installation package;

a condition generating unit configured to generate a new installation condition and generate a second installation condition-related file for determining whether the machine environment is suitable for installing the patch file, based on the new installation condition;

a replacement unit configured to replace the first installation condition-related file with a second installation condition-related file;

a generating unit, configured to generate a second patch installation package by using the second installation condition-related file and other files in the first patch installation package except for the first installation condition-related file;

the repairing unit is used for utilizing the second patch installation package to repair the bug;

the condition generating unit includes:

an extracting subunit, configured to acquire information at a specified position in the first installation condition related file, or scan the first installation condition related file by using a preset keyword, acquire information corresponding to the keyword, so as to extract the first installation condition from the first installation condition related file; the new installation condition is obtained by modifying the first installation condition or deleting some of the first installation condition.

4. The apparatus according to claim 3, wherein the first installation condition-related file includes:

and installing the test program and/or the configuration file in the first patch installation package.