Analysis on the operating mechanism of cloud Software Platform

I followed the cloud software platform because he participated in the "innovation software Competition". At that time, a software that I followed also participated in the competition, I did not intend to see the "Cloud" in the Software List of the competition. At that time, I just felt that the software was interesting and did not conduct in-depth analysis. Later, a friend who went to Beijing to participate in the competition said that "Cloud" won the gold medal, which made me really pay attention to "Cloud. Now that I have taken the lead, it is estimated that there will be little fire in the future. Maybe there will be much to do after I get the venture capital? In fact, I am more concerned with technical aspects.

In the FAQ of the cloud website, I see this sentence:"When a software is activated, directories and files appear in the lower part, and hidden software disappears. The directory and file under C:/program files/is one of the virtual system locations of the software on the cloud, and does not occupy the actual hard disk space of the drive C. The actual storage location of software resources is cache, which only occupies the disk space of the cache. Some operations that need to be performed in the software installation directory can be performed in this virtual directory. Modifications to files in this directory will be recorded in the cache."This is an interesting part. Let's start from here.

I downloaded a "sogou Input Method" from "Cloud" for installation. The installation interface of sogou input method is not displayed throughout the process. Activate sogou Input Method in "Cloud". After confirming that the input method can be used properly, I came to C:/ProgramFiles and saw a "sogouinput" folder, open the sogou input method in this folder and check the system input method list. The "sogou PinYin Input Method" is also included, indicating that the related registry key also exists. Then I hid the sogou Input Method in "Cloud", and "sogouinput" instantly disappeared. The system's input method list also did not contain "sogou. First of all, I feel that at least part of the file is not a simple "copy" because there should be an observed process for copying or deleting over 30 m Files. However, this process does not exist when the software is activated or hidden on the cloud. The environment disappears along with the folder, but the window for running config.exe is still running.SeemdlineRun the command line tool to check whether the file "C:/program files/sogouinput/3.6.0.1653/config.exe" does not exist in the window. As we all know, running EXE cannot be deleted. Since I can delete "C: /program files/sogouinput/3.6.0.1653/config.exe "indicates that the real running config.exe is not under" C:/program files/sogouinput/",SeemdlineThe system is directly obtained from the system. It also says that the system is cheated and the files required by config.exe and sogou are no longer C disks. The "C:/program files/sogouinput/" we see is only a "shadow" of another real folder ". Where is the folder? Think of the FAQ "cloud"You can access this virtual directory. Modifications to files in this directory will be recorded in the cache", I have a solution. I created a file under "C:/program files/sogouinput/", and then searched in the cache directory of "Cloud", and found a trace. How does "Cloud" implement the "shadow" of files? I believe that friends who have done hook and so on should be able to think of something. Open the "Cloud" installation directory, and the two sys files are displayed. I think the "Cloud" should use the driver to enter ring0 and then hook... ... I don't want to talk about it anymore. It's everywhere on the Internet ;)

After a simple analysis of the operating mechanism of "Cloud", I think "Cloud" still has some technical content, at least the driver can not be written casually (at least I won't ). In fact, the technical content is secondary, and "creativity" is its highlight, right?