CN102930005A - Method and device for binding file in host file - Google Patents

Abstract

The invention discloses a method for binding files in a host file. The host file includes a plurality of sections arranged in a certain order for storing data. The method includes: converting the files to be bound into a format corresponding to the format of the host file The bundle file, and generate the configuration information of the bundle file; store the bundle file and configuration information in the last section of the host file; modify the structure information of the last section of the host file and the structure of the host file according to the bundle file and configuration information information. According to the method and corresponding device for bundling files in the host file of the present invention, files of any length can be bundled in the last section of the host file, thereby solving the problem of only bundling small scattered files in the prior art, and due to The amount of information in the header of the host file is too concentrated, which may lead to the problem of error reporting, and the beneficial effect of being able to bundle large files of any length and not being easily reported is achieved.

Description

Method and device for bundling files in host file

technical field

The invention relates to the communication field, in particular to a method and device for bundling files in a host file.

Background technique

File bundling can also be called file hiding. The specific method is to bundle other files in one file to achieve the effect of reducing the number of files or hiding some files. Wherein, the file bundled with other files is called a host file, and the file bundled into the host file is called a bundled file.

Because there is a lot of redundant space in the PE file structure itself, PE files are often used as host files, in which other files are bundled. The usually relatively large free space in the PE file is: (1) the redundant space generated by data alignment between adjacent section tables; (2) the redundancy generated by data alignment after the last section table of the PE file space. (3) The DOS Stub in the PE structure is reserved for DOS programs, and it will only play a real role when the file is executed under DOS. Therefore, under the Windows platform, DOS Stub has no effect at all, and this part of the content can be used to hide the file content. (4) Many fields in the PE file structure are reserved or have no effect on the execution of the executable program. This part of the space can also be used to hide the file content, such as the following structures in the PE file: MajorLinkerVersion, MinorLinkerVersion, ajorOperatingSystemVersion, MinorOperatingSystemVersion , CheckSum, SizeOfCode, SizeOfInitializedData, SizeOfUninitializedData, etc. At present, when bundling other files in a PE file, it is first necessary to find the redundant space in the PE file, and calculate the position and size of each redundant space. Figure 1 shows that after calculating the redundant space of the PE file The results obtained. As can be seen from Figure 1, there are 8 redundant spaces in the found PE file, among which, the free space in the DOS Stub part is 264B, the free space between the section table and the section is 3280B, and the space after the last section is The free space is 3328B. In addition, the reloc (relocation table information) section, rsrc (resource) section, idata (import file name table) section, rdata (read-only initialization data) section and text (.exe or .dll file can Executing code) sections also have redundant space, and the size of all redundant spaces is 17488B in total.

Then, according to the total amount of redundant space and the size of each redundant space, the bundled file is divided into several sub-files of specified size, wherein the number of sub-files can be less than or equal to the total amount of redundant space, and the sub-files The size of the file is basically the same as the size of the redundant space.

Finally, the divided sub-files are allocated to the redundant space of the PE file according to a certain algorithm.

However, when the above method is adopted, since the redundant space capacity in the PE file structure is small and discontinuous, it is more suitable for bundling scattered small files, and usually cannot be bundled for larger files. Moreover, since the redundant space in the PE file structure is basically concentrated in the header of the PE file, all the bundled files are concentrated in the header of the PE file, and the amount of information is too concentrated, so it is easy to be detected by the format checking tool For abnormalities and then report errors, resulting in false positives.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a method for bundling files in a host file and a corresponding device for bundling files in a host file, which overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for bundling files in a host file is provided, the host file includes a plurality of sections arranged in a certain order for storing data, the method includes: converting the file to be bundled into a host file The format of the file corresponds to the bundle file, and generate the configuration information of the bundle file; store the bundle file and configuration information in the last section of the host file; modify the structure information of the last section of the host file according to the bundle file and configuration information And the structural information of the host file.

Optionally, before the step of converting the file to be bundled into a bundled file corresponding to the format of the host file, it further includes: compressing and/or encrypting the content of the file to be bundled.

Optionally, the configuration information includes: parameter information used to indicate whether the bundled file is executable, location information used to locate the bundled file in the host file, and a jump instruction used to indicate a jump address when the bundled file is executed.

Optionally, the host file also includes a plurality of section tables arranged in a certain order for storing the structural information of the sections, then modifying the structural information of the last section of the host file specifically includes: modifying the last section table of the host file information, the last section table is used to store the structure information of the last section, wherein the information in the last section table includes: the size of the section data, and the attributes of the section data.

Optionally, the structural information of the host file includes: the file size of the host file and the entry function of the host file.

Optionally, the binding file and configuration information are stored in the last section of the host file; according to the size of the binding file and configuration information, the steps of modifying the structural information of the last section of the host file and the structural information of the host file specifically include: Apply for a memory space, copy the host file to the memory space, store the bundle file and configuration information in the last section of the copied host file; modify the structure of the last section of the copied host file according to the size of the bundle file and configuration information information and the structure information of the copied host file; copy the modified host file back to disk space.

Optionally, the host file is a PE file.

According to another aspect of the present invention, a device for bundling files in a host file is provided, the host file includes a plurality of sections arranged in a certain order for storing data, and the device includes: a conversion unit that converts the The file is converted into a bundled file corresponding to the format of the host file, and the configuration information of the bundled file is generated; the bundled unit stores the bundled file and configuration information in the last section of the host file; the modification unit is based on the bundled file and Configuration information, modify the structure information of the last section of the host file and the structure information of the host file.

Optionally, the configuration information includes: parameter information used to indicate whether the bundled file is executable, location information used to locate the bundled file in the host file, and a jump instruction used to indicate a jump address when the bundled file is executed.

Optionally, the host file also includes a plurality of section tables arranged in a certain order for storing the structural information of the sections, and the modification unit is specifically used to: modify the information in the last section table of the host file, and the last section table uses It is used to store the structural information of the last section, where the information in the last section table includes: the size of the section data, and the attributes of the section data.

Optionally, the structural information of the host file includes: the file size of the host file and the entry function of the host file.

According to the method and corresponding device for bundling files in the host file of the present invention, files of any length can be bundled in the last section of the host file, thereby solving the problem of only bundling small scattered files in the prior art, and due to The amount of information in the header of the host file is too concentrated, which may lead to the problem of error reporting, and the beneficial effect of being able to bundle large files of any length and not being easily reported is achieved.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to denote the same parts. In the attached picture:

FIG. 1 shows a schematic diagram of results obtained after calculating the redundant space of a PE file in the prior art;

Fig. 2 shows the flowchart of the method for bundling files in host files according to one embodiment of the present invention;

Fig. 3 shows the structural diagram of the original host file and the host file after three bundled files are bundled according to an embodiment of the present invention; and

Fig. 4 shows a structural diagram of an apparatus for bundling files in a host file according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Fig. 2 shows a method for bundling files in a host file provided by an embodiment of the present invention. Specifically, the host file may be a PE file, or other files having a similar structure to the PE file. In the following description, the host file is a PE file as an example for description.

In order to facilitate understanding, first briefly introduce the structure of the PE file. A PE file mainly includes several sections arranged in a certain order for storing data. Wherein, the storage space occupied by each section is the same, but the actual data length stored in each section may be different, therefore, each section may have valid space for storing data and remaining free space. In order to understand the data stored in each section, it is necessary to define the structural information of the section. The structural information of a section specifically includes: the actual data length stored in a section, the starting address of a section, and the like. Therefore, in order to store the structural information of each section, the PE file also includes several section tables arranged in a certain order for storing the above structural information of the section. Generally, the number of section tables is the same as the number of sections. Each section table is used to store the structural information of the corresponding section. For example, the first section table is used to store the structural information of the first section, and the second section table is used to store the structural information of the first section. Used to store structural information for the second section, and so on.

As shown in FIG. 2 , the method starts at step S210. In step S210, the file to be bundled is converted into a bundled file corresponding to the format of the host file, and configuration information of the bundled file is generated.

Among them, the format of the host file (that is, the PE file) is the format defined by the assembly language data structure. Therefore, in this step, it is first necessary to convert the file to be bundled into a file in the format defined by the assembly language data structure as the bundled file, so as to be compatible with The format of the host file corresponds. In addition, configuration information for the bundle file needs to be generated. Wherein, the configuration information may include: parameter information used to indicate whether the bundled file is executable, location information used to locate the bundled file in the host file, and a jump instruction used to indicate a jump address when the bundled file is executed.

Optionally, before step S210 is performed, the contents of the files to be bundled may be further compressed and/or encrypted, so as to reduce the volume of the files to be bundled, or to prevent the files to be bundled from being read by unauthorized persons, so as to Improve security.

After step S210 is executed to obtain the binding file and configuration information, step S220 is executed. In step S220, store the binding file and configuration information generated in step S210 in the last section of the host file.

After step S220 is executed, continue to execute step S230. In step S230, the structure information of the last section of the host file and the structure information of the host file are modified according to the size of the bundled file and configuration information.

Among them, in the original host file, that is, the PE file, the storage space occupied by each section is the same, and the section table corresponding to each section stores the structural information of the section, such as the actual data stored in the section length etc. However, after step S220 is executed, since the above-mentioned binding file and configuration information are further stored in the last section of the original host file, the actual data length of the last section increases. Therefore, the structural information of the last section It also changed accordingly, which in turn led to a change in the structure information of the entire host file. Therefore, in step S230, it is necessary to modify the structure information of the last section of the host file and the structure information of the host file according to the size of the above-mentioned bundle file and configuration information, so as to match the situation after adding the bundle file.

Wherein, according to the above description, it can be seen that the host file also includes a plurality of section tables arranged in a certain order for storing the structural information of the section, therefore, when modifying the structural information of the last section of the host file in step S230, only You need to modify the information in the last section table of the host file. In addition, the structural information of the host file mainly includes the file size of the host file and the entry function of the host file. Therefore, the above information needs to be modified accordingly in step S230.

Specifically, when performing the above steps S220 and S230, it can be realized in the following manner: First, apply for a piece of memory space, copy the host file into the memory space, store the binding file and configuration information; then, according to the bundled file and the configuration information, modify the structure information of the last section of the copied host file and the structure information of the copied host file; finally, copy the modified host file back to the disk space.

The above method can be used to bundle one or more files, and when the length of the bundled file is relatively long, the length of the last section of the host file can be extended, so the bundle of large files can be realized.

The method for bundling files in a host file provided by the present invention will be described in detail below with a preferred embodiment. In this method, the host file is a PE file. The method includes the following steps:

Step 1: Compress and/or encrypt the files to be bundled.

In this step, the contents of the files to be bundled can be compressed and/or encrypted. The volume of the file to be bundled can be reduced by compression, so that it can be bundled into the host file more conveniently. When compressing, various algorithms can be used, such as the aplib algorithm. Through encryption, the files to be bundled cannot be read by unauthorized persons, thereby improving the security of the files.

Step 2: Convert the compressed and/or encrypted file to be bundled into a file that is in the same format as the host file (that is, the format defined by the assembly language data structure) as the bundled file. Hereinafter, the content in the bundled file is also called a word section code.

Optionally, Step 1 may not be performed, and Step 2 may be directly performed, especially when the file to be bundled is also a PE file.

Step 3: Generate the configuration information of the bundled file.

After the bundle file is bundled into the host file, when the bundle file bundled in the host file is read, the bundle file will be released. In order to determine whether the released bundled file is executable and when to execute it, the configuration information generated in this step is needed. Specifically, the configuration information usually includes the following content: parameter information used to indicate whether the bundled file is executable, location information used to locate the bundled file in the host file, and a jump used to indicate the jump address when the bundled file is executed instructions etc.

Among them, the parameter used to indicate whether the bundled file is executable can be realized by a flag variable isInExeSequence, for example. If isInExeSequence=0, it means that the released bundled file is not executed, that is, the bundled file is not executable. If isInExeSequence=1, it means that the released The resulting bundled file executes the run operation, that is, the bundled file is executable. In addition, an additional parameter can be set to specify when the released bundled file will be executed, such as executing immediately or after 3 minutes. The location information for locating the bundled file in the host file can be realized by, for example, a dwFileOffset parameter indicating the position offset of the bundled file in the host file. In addition, you can also set a dwFileSize parameter to indicate the size of the bundled file in the host file, and you can also define a name parameter to indicate the name of the bundled file. The above parameters can be defined by the following structure:

Typedef struct

{

String name;

BOOL isInExeSequence;

DWORD dwFileOffset;

DWORD dwFileSize;

}FILE_BINDED_STRUCT;

The above structure can be stored before or after the content (ie bytecode) in the bundle file, or inserted in the middle of the bytecode.

In addition, the jump instruction used to indicate the jump address when the bundled file is executed can be implemented by the E9 instruction. Specifically, an E9 instruction with an empty operand can be appended to the end of the bytecode, and then, in subsequent steps, the operand of the E9 instruction can be modified according to the actual situation, so as to define the jump address when the bundled file is executed. The jump address generally points to the code corresponding to the bytecode, and the code is also stored in the host file to specifically execute the data content in the bytecode.

Step 4: Copy the host file into memory, and store the bundled file and configuration information generated in Step 2 and Step 3 into the last section of the host file.

Optionally, in order to more accurately locate the host file in this step, first obtain the size of the original host file, and then calculate the offset of the last section table of the host file in the file, so as to read the last section the data in the table. Among them, when calculating the offset of the last section table in the file, the following code can be used to realize: pSectionHeader=(PIMAGE_SECTION_HEADER)((BYTE*)pOptionalHeader+sizeof(IMAGE_OPTIONAL_HEADER));

nSectionNum=pFileHeader->NumberOfSections;

for(int i=0;i<nSectionNum-1;i++)

{

pSectionHeader++;

} Among them, pSectionHeader represents the offset of the last section table in the file. Through the above method, the position of the last section table can be determined and the data in it can be read. Specifically, the data contained in the section table includes: a SizeOfRawData parameter indicating the actual data length stored in the corresponding section, a PointerToRawData parameter indicating the start address of the section, and a Characteristics parameter indicating the attribute value of the section. In this step, the value of the SizeOfRawData parameter and the PointerToRawData parameter is mainly read. The starting address of the last section can be determined through the PointerToRawData parameter, and the end address of the data actually stored in the last section can be determined in combination with the SizeOfRawData parameter.

After the above-mentioned relevant information of the host file is determined through the above method, the bundled file and configuration information can be stored in the last section according to information such as the start address and end address of the last section of the host file. Since the original host file is stored on the disk, if the original host file is directly modified in the disk space, because the program stored in the file contains pointers, and the use of pointers is prone to errors, therefore, in this embodiment , first copy the host file to the memory, and then copy it back to the disk after completing the modification of the host file in the memory, thereby avoiding errors caused by pointer problems. To this end, it is necessary to first calculate the sum of the size of the original host file and the size of the bundled file and configuration information to obtain the size of the bundled host file. Then, apply for a piece of memory space according to the calculated size of the bundled host file, copy the original host file into the memory space, and store the bundled file and configuration information in the last section of the copied host file.

In addition, because the alignment granularity of the host file in the disk space and the alignment granularity in the memory space may be different, when the alignment granularity of the host file in the disk space and the alignment granularity in the memory space are different, in order to copy the host file To the memory space, it is necessary to further calculate the alignment granularity of the host file in the memory space. To this end, the last section of the host file can be aligned according to the alignment granularity in the memory space to determine the alignment of the last section of the host file in memory. Data length. For specific alignment, the following code can be used to achieve:

Among them, in the above code, the size parameter is defined to indicate the total length of the host file, ALIGN_BASE is used to indicate the alignment granularity of the host file when it is aligned in the memory space, and the returned result value ret is used to indicate the host file according to the alignment granularity After alignment, the remaining data length is the data length of the last section of the host file in memory.

Step 5: Modify the structure information of the last section of the host file and the structure information of the host file in the memory according to the bundled file and the size of the configuration information.

Since the bundled file and configuration information are added to the host file in step 4, the relevant information of the original host file needs to be modified adaptively. First of all, due to the addition of content in the last section of the host file, the structural information of the last section of the host file needs to be modified adaptively. In actual implementation, the actual data stored in the corresponding section can be represented by modifying the last section table In addition, the start address of the host file in memory can also be modified. At the same time, the attribute value of the last section in the section table needs to be set as executable, readable and readable. Write, ie 0c0000060h. In addition, the structural information of the host file also needs to be modified, for example, modify the value representing the file size of the host file, wherein the file size of the host file in memory is usually called the image file size, expressed by the SizeOfImage value. At the same time, modify the entry function of the host file, that is, the program entry point AddressEntryPoint, to determine the execution start point of the host file. Finally, it is also necessary to modify the E9 instruction whose operand is empty in step 3, so that the E9 instruction points to the code corresponding to the bytecode, so as to specifically execute the data content in the bytecode.

Step 6: Copy the modified host file from the memory back to the disk.

Through the above steps, the purpose of bundling other files in the host file is realized. After releasing the bundled files contained in the host file, it is possible to control whether the bundled files are executable and when to execute them according to the configuration information. Specifically, multiple bundle files can also be bundled in one host file. In this way, the execution order of multiple bundle files can be further defined in the configuration information, or multiple bundle files can also be executed sequentially by default.

Fig. 3 shows the structural diagram of the original host file and the host file after binding three bundled files, wherein, the left side of Fig. 3 shows the original host file 310, and the right side of Fig. 3 shows the bundled The host file 320 of.

In addition, in the host file, that is, the PE file, there are usually a data segment for storing data and a code segment for storing code. In this embodiment, both the data and code in the host program can be placed in the code segment Stored in the middle, thus avoiding frequent relocation between data and code, and improving execution efficiency.

Through the method in the embodiment of the present invention, other files can be bundled in the host file, so as to reduce the file size and the number of independent files in the system during release, thereby facilitating management and facilitating software release and online transmission. Moreover, it is possible to hide some files with special meaning (for example, to prevent competitors from cracking and reverse engineering). In addition, a series of small programs with individual functions can also be integrated into an executable file, and the series of small programs are executed sequentially, so that the execution of one executable program realizes the pipeline execution of multiple small programs, providing Another implementation similar to the pipeline command.

Moreover, the biggest feature of the present invention is that it can bundle files with a long length. Due to the structural characteristics of PE files, the length of the last section can be extended. Therefore, when the length of the bundled file and configuration information exceeds the length of the last section The storage space of the last section can be expanded to accommodate the bundled files and configuration information when the length of the free storage space is longer. Therefore, when using this method to bundle files, it is not limited by the size of the bundled files, and large files or even multiple files can be bundled. file, which broadens the scope of application, and because this method does not add too much information to the file header of the PE file, it will not be reported by the format checking tool.

The embodiment of the present invention also provides a device for bundling files in a host file, wherein the host file includes a plurality of sections arranged in a certain order for storing data. As shown in Figure 4, the device includes:

a conversion unit 410, which converts the file to be bundled into a bundled file corresponding to the format of the host file, and generates configuration information of the bundled file;

a binding unit 420, which stores the binding file and configuration information in the last section of the host file;

A modifying unit 430, which modifies the structure information of the last section of the host file and the structure information of the host file according to the binding file and the configuration information.

Optionally, the configuration information includes: parameter information used to indicate whether the bundled file is executable, location information used to locate the bundled file in the host file, and a jump instruction used to indicate a jump address when the bundled file is executed.

Optionally, the host file also includes multiple section tables for storing structural information of sections, and the modification unit is specifically used to: modify information in the last section table of the host file, and the last section table is used to store the last section structure information, wherein the information in the last section table includes: the size of the section data, and the attributes of the section data.

Optionally, the structural information of the host file includes: the file size of the host file and the entry function of the host file.

For the specific implementation manners of the conversion unit 410 , the binding unit 420 and the binding unit 430 described above, reference may be made to the descriptions in the above method embodiments.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings), as well as any method or method so disclosed, may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of some or all of the components in the device for bundling files in a host file according to an embodiment of the present invention Function. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (11)

1. the method for a bundled files in host's file, described host's file comprise a plurality of with certain tactic joint for the storage data, and the method comprises:

Be the bundled files corresponding with the form of described host's file with file conversion to be bundled, and generate the configuration information of described bundled files;

Described bundled files and described configuration information are stored in last joint of described host's file;

According to described bundled files and described configuration information, revise the structural information of last joint of described host's file and the structural information of described host's file.

2. the method for claim 1 further comprises before the described step of file conversion for the bundled files corresponding with the form of described host's file that will be to be bundled: file content described to be bundled is compressed and/or encryption.

3. method as claimed in claim 1 or 2, described configuration information comprises: be used to indicate bundled files whether executable parameter information, be used for the positional information in the described bundled files in described host's file location, and the jump instruction of the jump address when being used to indicate bundled files and carrying out.

4. such as any described method among the claim 1-3, described host's file also comprises a plurality of joint tables with certain tactic structural information for storing joint, and then the structural information of last joint of the described host's file of described modification specifically comprises:

Revise the information in last joint table of described host's file, described last joint table is used for the structural information of last joint of storage, and wherein, the information in described last joint table comprises: the size of joint number certificate, and the attribute of joint number certificate.

5. such as any described method among the claim 1-4, the structural information of described host's file comprises: the entrance function of the file size of host's file and host's file.

6. such as any described method among the claim 1-5, described described bundled files and described configuration information are stored in last joint of described host's file; According to the size of described bundled files and described configuration information, the step of revising the structural information of the structural information of last joint of described host's file and described host's file specifically comprises:

Apply for a memory headroom, described host's file copy to described memory headroom, is stored described bundled files and described configuration information in last joint of the host's file that copies;

According to the size of described bundled files and described configuration information, revise the structural information of last joint of the described host's file that copies and the structural information of the described host's file that copies;

Amended host's file copy is returned disk space.

7. such as any described method among the claim 1-6, described host's file is the PE file.

8. the device of a bundled files in host's file, described host's file comprise a plurality of with certain tactic joint for the storage data, and this device comprises:

Converting unit, the file conversion that it will be to be bundled are the bundled files corresponding with the form of described host's file, and generate the configuration information of described bundled files;

The binding unit, it is stored in described bundled files and described configuration information in last joint of described host's file;

Revise the unit, it is according to described bundled files and described configuration information, revises the structural information of last joint of described host's file and the structural information of described host's file.

9. device as claimed in claim 8, described configuration information comprises: be used to indicate bundled files whether executable parameter information, be used for the positional information in the described bundled files in described host's file location, and the jump instruction of the jump address when being used to indicate bundled files and carrying out.

10. device as claimed in claim 8 or 9, described host's file also comprise a plurality of joint tables with certain tactic structural information for the storage joint, and then described modification unit specifically is used for:

Revise the information in last joint table of described host's file, described last joint table is used for the structural information of last joint of storage, and wherein, the information in described last joint table comprises: the size of joint number certificate, and the attribute of joint number certificate.

11. such as any described device among the claim 8-10, the structural information of described host's file comprises: the entrance function of the file size of host's file and host's file.

Images