The principle of driving layer of Chengdu winger Cloud Virtualization tool system

Cloud software, lightweight virtualization tools, provides registry-level, file-level virtualization capabilities.

Original: Chengdu Cloud Network Co., Ltd.
Now: Hangzhou winger Network Technology Co., Ltd.
Domain Name: http://www.yunduan.cn/
I have the following versions in my collection: Http://pan.baidu.com/s/1sjQ3F0D
Cloudsetup1.0beta4_0903.exe
Cloudsetup2.0beta_0117.exe
CloudSetup3.4.0428.3710 ( with network disk ). exe
Cloudsetup3.4.0514.3734.exe
Update log on the cloud website 120523.htm

Many of their own software is used it "green", so the dependence is very strong. It is a pity that the software has been discarded and updated.

The technical principle of the curiosity, although the official website has been briefly introduced, but only conceptual;

Coincidentally, Everedit update to the latest version, after joining the vmprotect Software Protection technology, and The cloud conflict, will be detected a debugger have been found running in your System. Unload it from memory and restart your program. when thinking about how to coexist with it by not uninstalling the cloud, a software ( AntiSpy a manual anti-virus aids to spy on its part of the principle, suddenly have a kind of, "Ah ha, so-so" feeling.

The key principles of guessing the cloud are the following:

• Use the SSDT system hooks to implement the virtual "registry".

• "file"-related virtual using the files filter driver.

• Use system callbacks to perceive which processes, threads are started by the captured program, and then hide the program to know which processes to end.

Hook-related references:

• Build one of your own hook engines ---SSDT hook engine

Imperfect Coexistence Solution with Everedit:

• Everedit can be opened normally after the AntiSpy tool has all "recovered" SSDT hooks!
Initial testing, the cloud activates certain software to start normally, but the registry is lost, and when the software is hidden, there is no normal sense of the process to force the end.

The principle of driving layer of Chengdu winger Cloud Virtualization tool system