公开(公告)号：US08601584B1

公开(公告)日：2013-12-03

申请号：US13239112

申请日：2011-09-21

申请人： Royce Lu ,  Ming-Chang Shih ,  Wen-Chih Lee

发明人： Royce Lu ,  Ming-Chang Shih ,  Wen-Chih Lee

IPC分类号： G06F21/22 ,  G06F12/14 ,  G06F11/30 ,  G06F9/44

CPC分类号： G06F21/54 ,  G06F21/554

摘要： A computer is protected from argument switch attacks by intercepting a function call to terminate a process. The function call and a handle used as an argument in the function call are forwarded by an antivirus system service descriptor table to an antivirus. The antivirus is configured to evaluate the function call to determine whether or not the function call is terminating an antivirus process. A consistent handle table includes a listing of handles of processes employed as arguments in function calls that terminate processes and are approved by the antivirus. Instructions that close a handle are detected by the antivirus, which compares the handle to those in the consistent handle table. The antivirus blocks those instructions that close a handle that is included in the consistent handle table.

摘要翻译： 通过拦截函数调用以终止进程，计算机受到参数切换攻击的保护。 函数调用和用作函数调用中的参数的句柄由防病毒系统服务描述符表转发到防病毒软件。 防病毒配置为评估函数调用以确定函数调用是否终止防病毒进程。 一致的句柄表包括在终止进程并被防病毒软件批准的函数调用中作为参数使用的进程句柄列表。 关闭句柄的说明由防病毒软件检测到，该病毒将句柄与一致句柄表中的句柄进行比较。 防病毒程序会阻止关闭一致句柄表中包含的句柄的指令。

公开(公告)号：US09177146B1

公开(公告)日：2015-11-03

申请号：US13270965

申请日：2011-10-11

申请人： Wen-Chih Lee ,  Ming-Chang Shih ,  Wei-Chung Chou

发明人： Wen-Chih Lee ,  Ming-Chang Shih ,  Wei-Chung Chou

IPC分类号： G06F21/56

CPC分类号： G06F21/566

摘要： A database of known graphical user interface layouts is generated using samples of known executable files. An executable file having an unknown function is obtained; it is executed within a safe environment and its graphical user interface is identified. Layout analysis enumerates all of the windows within the interface and extracts the position values of each window and the dimension values of each window to form a set of layout information. If the layout database contains this layout information set then it is determined that the layout information is of the same type of software corresponding to the type of software contained within the database (or of the type of software to which the layout information is matched within the database). A match may occur if all the windows match, if only some percentage of the windows match, or if the windows do not match exactly but the dimensions of the corresponding window in the database are within a certain percentage.

摘要翻译： 使用已知可执行文件的样本生成已知图形用户界面布局的数据库。 获得具有未知功能的可执行文件; 它在安全的环境中执行，并且其图形用户界面被识别。 布局分析枚举界面中的所有窗口，并提取每个窗口的位置值和每个窗口的维度值，以形成一组布局信息。 如果布局数据库包含该布局信息集，则确定布局信息是与包含在数据库内的软件类型相对应的相同类型的软件（或者布局信息在该数据库内匹配的软件的类型） 数据库）。 如果所有窗口匹配，则只有一部分窗口匹配，或者窗口不完全匹配，但数据库中相应窗口的尺寸在一定百分比之内时，则可能会发生匹配。

公开(公告)号：US06535829B2

公开(公告)日：2003-03-18

申请号：US09878370

申请日：2001-06-12

申请人： Wen-Chih Lee ,  Yu-Ming Chuang

发明人： Wen-Chih Lee ,  Yu-Ming Chuang

IPC分类号： G01N2133

CPC分类号： G03F7/70558

摘要： The present invention provides a system, comprising an exposure apparatus and a control mean electrically connected to the exposure apparatus, for calculating exposure energy (Ee). The control mean executes an exposure energy calculation program according to mask data, comprising an actual transparency percentage parameter (Ta) and a mask error, and a critical dimension (CD) specification, comprising at least a basic transparency percentage parameter (Tb), a transparency constant (Tc), a CD energy constant (Cc) and a basic exposure energy, to calculate the exposure energy and output the exposure energy to the exposure apparatus. In the exposure energy calculation program, the basic transparency percentage parameter (Tb) is firstly subtracted from the actual transparency percentage parameter (Ta). The resulting difference is then multiplied together with the transparency constant (Tc) parameter to calculate a transparency percentage difference energy. A mask error energy is calculated by multiplying together the CD energy constant (Cc) parameter with the mask error parameter. The summation of the transparency percentage difference energy, the mask error energy and the basic exposure energy is finally calculated so as to determine the exposure energy.