基于WRK的多文件句柄进程的冷冻与解冻

Freezing and Unfreezing for Process with Multi-file Handles Based on WRK

针对Windows进程的冷冻与解冻问题,提出一种内核级的解决方案。基于Windows研究内核,给出进程冷冻和解冻的架构,完整保存进程内存映像,实现冷冻进程的自解冻。对于已打开多个文件句柄的进程冷冻情形,通过在内核进程对象中事先预留文件句柄的方法,使进程解冻后成功恢复文件句柄和数据。通过2个典型实验结果证明了该方案的正确性。

This paper presents a kernel-level solution for the freezing and unfreezing of process on Windows platform.Based on Windows Research Kernel（WRK）,it describes a whole skeleton of process freezing,which saves full image of process and support to self-unfreezing.For the process with multi-file handles,by reserving the file handles in process object of kernel ahead,the unfreezing process restores these file handles and corresponding data.Two typical experiments show the way is correct.