A Method and an Apparatus for Detecting Dynamic Defacement in Application

摘要

The technology disclosed in the present specification relates to a method and apparatus for detecting dynamic tampering of a Windows operating system-based application. The tamper detection method according to an embodiment generates a handle list of child objects inheriting a function of a parent object, and the handle list and inputting handle values of child objects included in the hash function to obtain a final hash value. In addition, the obtained final hash value is maintained by the detection process, and compared with the hash value of the process to be protected periodically, it is characterized in that it provides a technology capable of immediately detecting tampering by an external attack such as malicious code.