CN115237352B - Hidden storage method, device, storage medium and electronic equipment - Google Patents

Abstract

The present disclosure relates to a concealed storage method, device, storage medium and electronic equipment, wherein the method includes: obtaining a preset file to be stored; determining a target fragment storage space on a disk; and writing the preset file into the target fragment storage. The scheme of the present disclosure can write the files that need to be stored secretly into the fragmented storage space on the disk, that is, use the fragmented storage space to store the files that need to be hidden, so as to improve the concealment of storing attack program files in the system disk.

Description

Hidden storage method, device, storage medium and electronic equipment

technical field

The embodiments of the present disclosure relate to the technical field of computers, and in particular, to a hidden storage method, a hidden storage device, a computer-readable storage medium, and electronic equipment.

Background technique

At present, the concealment of the program in the target system is realized. For example, for the NTFS (New Technology File System) file system commonly used in the Windows operating system, the ways to store the program file safely and concealed in the system disk mainly include attribute hiding, modifying the file name, and using Hook technology, replacement of system DLL files, etc. are hidden, but the above-mentioned methods are low in concealment and are easily detected by disk detection tools. Therefore, a hidden storage solution with high concealment is urgently needed at present.

Contents of the invention

In order to solve the above technical problems or at least partly solve the above technical problems, embodiments of the present disclosure provide a hidden storage method, a hidden storage device, a computer-readable storage medium, and an electronic device.

In the first aspect, the embodiment of the present disclosure provides a hidden storage method, including:

Obtain the preset file to be stored;

Determine the target fragment storage space on the disk;

Writing the preset file into the target fragment storage space.

In one embodiment, the target fragment storage space includes one or more of the first fragment storage space, the second fragment storage space and the third fragment storage space;

Wherein, the first fragmented storage space includes idle storage space in one or more clusters on the disk, and the second fragmented storage space includes the reserved space of the master file table (Master File Table, referred to as MFT) on the disk. storage space, the third fragmented storage space includes reserved storage space of the master file table on the disk.

In one embodiment, the one or more clusters are clusters for storing specified system files; wherein, the specified system files are system files whose attribute of file records in the NTFS file system is non-resident.

In one embodiment, the first fragment storage space, the second fragment storage space and the third fragment storage space have different priorities, and the writing the preset file into the target fragment storage space, including:

Obtain respective priorities of the first fragmented storage space, the second fragmented storage space, and the third fragmented storage space;

Writing the preset file into a first designated fragment storage space; wherein the first designated fragment storage space is the first fragment storage space, the second fragment storage space and the third fragment storage space The highest priority fragmented storage space.

In one embodiment, the method also includes:

When it is determined that the file size of the preset file exceeds the size of the first designated fragment storage space, write the preset file into a second designated fragment storage space; wherein the second designated fragment storage space is the first designated fragment storage space A fragmented storage space, the fragmented space with the middle priority among the second fragmented storage space and the third fragmented storage space.

In one embodiment, the first fragmented storage space has the highest priority, the second fragmented storage space has a middle priority, and the third fragmented storage space has the lowest priority.

In one embodiment, the preset file is a file to which the attack program belongs; the acquisition of the preset file to be stored includes:

Obtain one or more files to which the attack program belongs;

The writing the preset file into the target fragment storage space includes:

Writing the one or more files to which the attack program belongs to corresponding storage units in the target fragment storage space, each of the storage units includes one or more sectors.

In one embodiment, also includes:

recording program file information and sector information of the attack program, the program file information including attribute information of the attack program, and the sector information is used to identify the one or more files to which the attack program belongs in the A sector corresponding to a corresponding storage unit in the target fragment storage space;

Based on the sector information, read the one or more files to which the attack program belongs from a sector corresponding to a corresponding storage unit in the target fragment storage space;

Restoring the attack program based on the read one or more files to which the attack program belongs and attribute information of the attack program.

In a second aspect, an embodiment of the present disclosure provides a hidden storage device, including:

An acquisition module, configured to acquire preset files to be stored;

A determining module, configured to determine the target fragmented storage space on the disk;

A writing module, configured to write the preset file into the target fragment storage space.

In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the hidden storage method described in any of the above-mentioned embodiments are implemented.

In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

processor; and

memory for storing computer programs;

Wherein, the processor is configured to execute the steps of the hidden storage method in any of the above embodiments by executing the computer program.

Compared with the prior art, the technical solutions provided by the embodiments of the present disclosure have the following advantages:

The concealed storage method, device, storage medium and electronic device provided by the embodiments of the present disclosure acquire a preset file to be stored, determine a target fragment storage space on a disk, and write the preset file into the target fragment storage space. In this way, the solution of this embodiment can write the files that need to be concealed into the fragmented storage space on the disk, that is, use the fragmented storage space to store the files that need to be concealed, so that the stored files are not easy to be detected, thereby improving the storage capacity of the system disk. Privacy of stored files.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure.

In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, In other words, other drawings can also be obtained from these drawings without paying creative labor.

FIG. 1 is a flowchart of a hidden storage method according to an embodiment of the present disclosure;

FIG. 2 is a flowchart of a hidden storage method according to another embodiment of the present disclosure;

FIG. 3 is a flowchart of a hidden storage method according to another embodiment of the present disclosure;

FIG. 4 is a schematic diagram of a hidden storage device according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of an electronic device implementing a hidden storage method according to an embodiment of the present disclosure.

Detailed ways

In order to more clearly understand the above objects, features and advantages of the present disclosure, the solutions of the present disclosure will be further described below. It should be noted that, in the case of no conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other.

In the following description, many specific details are set forth in order to fully understand the present disclosure, but the present disclosure can also be implemented in other ways than described here; obviously, the embodiments in the description are only some of the embodiments of the present disclosure, and Not all examples.

It should be understood that hereinafter, "at least one (item)" means one or more, and "multiple" means two or more. "And/or" is used to describe the association relationship of associated objects, which means that there can be three kinds of relationships, for example, "A and/or B" can mean: only A exists, only B exists, and A and B exist at the same time. Among them, A and B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c ", where a, b, c can be single or multiple.

Fig. 1 is a flow chart of a concealed storage method according to an embodiment of the present disclosure, the method includes the following steps:

Step S101: Obtain a preset file to be stored.

Exemplarily, the preset file may be a file belonging to a target program, such as an attack program for network security, which needs to be hidden in the system of the target computer device in a timely manner.

Step S102: Determine the target fragmented storage space on the disk.

Exemplarily, the target fragmented storage space may be free storage space in the storage space allocated for stored files by the NTFS file system on the target computer device, but it is not limited thereto.

Step S103: Write the preset file into the target fragment storage space.

Exemplarily, after the target fragment storage space is determined, files such as attack programs can be written into the target fragment storage space.

The scheme of this embodiment can write the files that need to be concealed into the fragmented storage space on the disk, that is, use the fragmented storage space to store the files that need to be concealed, so that the stored files are not easy to be detected, thereby improving the storage capacity of the system disk. file concealment.

In an embodiment, the target fragment storage space may include but not limited to one or more of the first fragment storage space, the second fragment storage space and the third fragment storage space. Wherein, the first fragmented storage space includes idle storage space in one or more clusters on the disk, that is, slack space, and the second fragmented storage space includes a master file table (Master File Table, MFT for short) on the disk reserved storage space, the third fragmented storage space includes the reserved storage space of the master file table on the disk.

Specifically, as an example, in order to realize the hidden storage of the attack program in the target computer equipment system, it is necessary to find a space that can be used to store the attack program in the NTFS file system on the basis of analyzing the NTFS file system of the target computer equipment system, The following lists some common fragmented storage spaces in NTFS, such as slack space, MFT reserved storage space, MFT reserved storage space, etc.

In order to improve the concealment of the hidden storage of the attack program in the target system, the form of the file is not directly created in the file system in this embodiment, because once the file is created in the system, a corresponding record will be left in the MFT, and By selecting the slack space, the reserved storage space of the MFT file and the reserved storage space of the MFT file as the "fragment" storage space for storing the attack program files in the target system.

Since the system uses clusters as the unit when allocating disk storage space for a file, if the size of the file is not an integer multiple of the cluster, the system will still allocate storage space for it that is an integer multiple of the cluster. Integer multiples of the cluster, so the slack space that can be used is the first fragment storage space. This part of the space is usually not used by the system, so it is safer and more stable to store the files of the attack program in the slack space.

The reserved storage space of the MFT is variable, that is, when the storage space of the MFT is insufficient, the system will allocate this part of the reserved storage space to the MFT, and when the storage space of the MFT is sufficient, the system will reserve this part of the reserved storage space again space. Therefore, storing the file of the attack program in the reserved storage space of the MFT file will not cause abnormality, and since this space will not be allocated under normal circumstances, it is safer and more stable to store the file of the attack program in this location.

The reserved storage space of the MFT is reserved for files. Therefore, the reserved storage space of the MFT file that stores the file of the attack program in the NTFS file system of the target system will not be overwritten. Therefore, it is safer to store the file of the attack program in this location. Stablize.

In one embodiment, the one or more clusters are clusters for storing specified system files; wherein, the specified system files are system files whose attribute of file records in the NTFS file system is non-resident.

Specifically, the size of the system metadata file is generally fixed, so the size of this space is also fixed, and this part of the space will not be reused by the system, so the attack program is stored in the metadata file of the NTFS file system of the target system The slack space is safer and more stable.

In a specific example, after the target fragment storage space (hereinafter referred to as fragment) is determined, the corresponding information of these fragment hosts can be recorded next. In addition to recording the number of all fragments, it is also necessary to record the basic information of each fragment. Concretely include: the serial number of the fragment, the starting sector number of the fragment, the number of free sectors, and whether the flag has been allocated. The specific recording steps are as follows:

Find the location of the MFT table and prepare to read the contents of the table. Read the contents of the DBR (since the DBR is located in the first sector of the NTFS file system partition, so just read the first sector directly), find the location of the BPB, and find the starting logical cluster number of the MFT table in the BPB , start to read the contents of the MFT table according to the starting logical cluster number.

First record the slack space of the system files. The first 16 records of the MFT table store the corresponding information of 16 system metadata files, so the slack space for recording system files depends on reading the first 16 records of the MFT table in order to obtain the corresponding information.

The slack space of the system file refers to the slack space where the data runs, and the slack space where the non-resident 08H attribute (data attribute) of the system file runs is used as the target fragment. When recording the slack space where the system file is not a resident 08H attribute, first check the resident attribute flag of the 08H attribute. If it is a resident attribute, this system file cannot be used as a target fragment. Continue to the next system file record, which is very The resident attribute calculates the expected starting sector number of the slack space of the system file and the number of sectors in this area according to the keyword information in the record, and sets the allocation flag to an unallocated state. After recording the relevant information, start the recording of the next system metadata file slack space, the recording method repeats the above steps until the slack space of 15 system files (removing MET system files) has been recorded.

In one embodiment, for the reserved storage space of the MFT, the starting sector number of the reserved storage space and the number of sectors in the area may be recorded. At present, when the storage space of the MFT is insufficient, when the NTFS file system allocates the reserved storage space of the MFT to the MFT, it first divides the reserved storage space into two parts, namely the former storage space and the latter storage space, and the system starts from the second Part, that is, the subsequent storage space starts to be allocated, so the former storage space of the reserved storage space is less likely to be used than the second part. Therefore, in this embodiment, 1/4 of the reserved storage space may be selected as the second fragmented storage space, but it is not limited thereto.

In one embodiment, the first fragmented storage space, the second fragmented storage space and the third fragmented storage space have different priorities. Exemplarily, the first fragmented storage space is the slack space The priority is the highest, the priority of the reserved storage space of the second fragmented storage space is the middle, and the priority of the reserved storage space of the third fragmented storage space is the lowest, but it is not limited thereto. As shown in Figure 2, writing the preset file into the target fragment storage space includes the following steps:

Step S201: Obtain respective priorities of the first fragmented storage space, the second fragmented storage space and the third fragmented storage space.

Exemplarily, the priority of the first fragmented storage space is slack space, the priority of the second fragmented storage space is the reserved storage space of MFT, and the priority of the third fragmented storage space is the reserved storage space of MFT.

Step S202: Write the preset file into the first designated fragment storage space; wherein the first designated fragment storage space is the first fragment storage space, the second fragment storage space and the third fragment storage space The fragmented storage space with the highest priority in the fragmented storage space.

Exemplarily, since the first fragmented storage space, that is, the slack space has the highest priority, the first designated fragmented storage space is the slack space, and then the file of the attack program is written into the slack space.

In this embodiment, corresponding priorities are defined for files stored in the fragmented storage space according to their security. The higher the priority, the higher the security of the stored files. When selecting fragments, the high-level fragment storage space is selected according to its priority, which can provide the security of hidden storage.

In one embodiment, the method further includes the steps of:

Step A: When it is determined that the file size of the preset file exceeds the size of the first designated fragment storage space, write the preset file into a second designated fragment storage space; wherein the second designated fragment storage space is The fragment space with the middle priority among the first fragment storage space, the second fragment storage space and the third fragment storage space.

Exemplarily, when it is determined that the file size of the attack program exceeds the slack space, the file of the attack program may be written into the second designated fragment storage space, that is, the reserved storage space of the MFT, that is, the fragment storage space of the second priority.

In one embodiment, the preset file is a file to which the attack program belongs, and correspondingly, the acquiring the preset file to be stored includes the following steps: acquiring one or more files to which the attack program belongs; Writing the preset file into the target fragment storage space includes: writing the one or more files to which the attack program belongs to a corresponding storage unit in the target fragment storage space, each of the storage A unit consists of one or more sectors.

Exemplarily, in this embodiment, multiple files contained in the attack program are stored in blocks in the target fragment storage space such as slack space, MFT reserved storage space, etc., so that the hidden storage of the attack program is realized, and the efficiency of hidden storage is improved. Concealment makes the attack program difficult to be detected.

In one embodiment, as shown in Figure 3, the method also includes the following steps:

Step S301: Record the program file information and sector information of the attack program, the program file information includes the attribute information of the attack program, and the sector information is used to identify the one or more files to which the attack program belongs A sector corresponding to a corresponding storage unit in the target fragment storage space.

Exemplarily, the attribute information may include, but not limited to, the name of the attacking program, the length of the data, and whether it is in memory or not. The sector information may be a unique number such as a sector identifier such as a sector serial number. The sector information can be pre-recorded, that is, when a file is written into the target fragment storage space, one or more sector numbers where the file is located in the target fragment storage space are recorded.

Step S302: Based on the sector information, read the one or more files to which the attack program belongs from the sector corresponding to the corresponding storage unit in the target fragment storage space.

Exemplarily, when the hidden attack program needs to be recovered, multiple files belonging to the attack program are read from the target fragment storage space based on the recorded sector information such as the sector sequence number.

Step S303: Restoring the attack program based on the read one or more files to which the attack program belongs and the attribute information of the attack program.

Exemplarily, the attack program is restored based on the read multiple files to which the attack program belongs and the attribute information of the attack program such as the name of the attack program.

In a specific example, some basic information of the attack program, such as attribute information, such as the name and data length of the attack program, is needed when the attack program is hidden and stored. Specifically, the basic information of the attack program that can be recorded includes but is not limited to: the name of the attack program, the length of the attack program, the number of attack program files, the sector number of the attack program file in the corresponding fragment storage space, whether it is in memory or not. After the attack program is stored in the corresponding fragment storage space, based on the recorded sequence number of the sector storing the attack program file in the fragment storage space, it is convenient to find the corresponding file in the fragment storage space according to the sequence number when restoring the attack program. The starting sector number and the number of sectors, and then read the attack program file for recovery processing.

In a specific example, after the information of the corresponding target fragment storage space is determined and recorded, the file of the attack program can be stored in blocks. If an attack program has not been loaded by the main process for a long time, the system will choose to store the attack program hidden in the disk. During the storage process, according to the determined priority of the fragmented storage space, sectors in the unallocated fragmented storage space with high priority are preferentially selected for storage and corresponding information is recorded. The specific process is:

First read the fragmented storage space information, for example, sequentially read from the first item in the recorded fragmented storage space information table. The fragmented storage space information table can record the sector number and allocation status of each sector in the target fragmented storage space, such as allocated sectors (that is, written data) and unallocated sectors (that is, free and unwritten data).

Then judge whether the currently read fragment storage unit has been allocated, if allocated, continue to read the next item, if not allocated, record its starting sector number and sector number.

Then, calculate the number of bytes in the free area according to the number of sectors above and compare it with the number of bytes of the remaining attack program file in the current memory, if the number of bytes in the remaining attack program file is less than or equal to the number of bytes in the free area number, write all the attack program files in the memory into the free area, and end the storage. If the number of bytes of the remaining attack program file is greater than the number of bytes in the free area, the attack program file is divided into blocks, and the attack program file whose length is the number of bytes in the free area is first intercepted, and this part of the file is stored in the free area. Based on the remaining attack program files in the current memory, the previous steps are repeated for storage.

Whenever the file of the attacking program is stored in a fragmented storage space, the corresponding sector serial number recorded in the fragmented storage space information table of the sector storing the file in the fragmented storage space can be recorded in another storage space for storing the basic information of the attacking program. table, so that the attack program can be resumed later.

It should be noted that although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be performed in this specific order, or that all shown steps must be performed to achieve achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc. In addition, it is easy to understand that these steps may be executed synchronously or asynchronously in multiple modules/processes/threads, for example.

As shown in Figure 4, an embodiment of the present disclosure provides a hidden storage device, including:

An acquisition module 401, configured to acquire a preset file to be stored;

A determining module 402, configured to determine the target fragmented storage space on the disk;

A writing module 403, configured to write the preset file into the target fragment storage space.

The scheme of this embodiment can write the files that need to be concealed into the fragmented storage space on the disk, that is, use the fragmented storage space to store the files that need to be concealed, so that the stored files are not easy to be detected, thereby improving the storage capacity of the system disk. file concealment.

In one embodiment, the target fragmented storage space includes one or more of the first fragmented storage space, the second fragmented storage space, and the third fragmented storage space; wherein, the first fragmented storage space includes Idle storage space in one or more clusters, the second fragmented storage space includes the reserved storage space of the master file table (MasterFile Table, referred to as MFT) on the disk, and the third fragmented storage space includes the reserved storage space on the disk Reserved storage space for the master file table.

In one embodiment, the one or more clusters are clusters for storing specified system files; wherein, the specified system files are system files whose attribute of file records in the NTFS file system is non-resident.

In one embodiment, the first fragment storage space, the second fragment storage space and the third fragment storage space have different priorities, and the writing module 403 is configured to: acquire the first fragment storage space, the respective priorities of the second fragment storage space and the third fragment storage space; write the preset file into the first designated fragment storage space; wherein the first designated fragment storage space is the The fragment storage space with the highest priority among the first fragment storage space, the second fragment storage space and the third fragment storage space.

In one embodiment, the writing module 403 is further configured to: write the preset file into the second designated fragment when determining that the file size of the preset file exceeds the storage space of the first designated fragment Storage space; wherein the second designated fragmented storage space is the fragmented space with the middle priority among the first fragmented storage space, the second fragmented storage space and the third fragmented storage space.

In one embodiment, the first fragmented storage space has the highest priority, the second fragmented storage space has a middle priority, and the third fragmented storage space has the lowest priority.

In one embodiment, the preset file is a file to which the attack program belongs; the obtaining module is configured to obtain one or more files to which the attack program belongs. The writing module is configured to write the one or more files to which the attack program belongs to corresponding storage units in the target fragment storage space, each storage unit including one or more sectors.

In one embodiment, the device further includes a recording module, configured to: record the program file information and sector information of the attack program, the program file information includes attribute information of the attack program, and the sector information is used to identify A sector corresponding to a storage unit corresponding to the one or more files to which the attack program belongs in the target fragment storage space; a reading module, configured to read from the target fragment storage space based on the sector information Read the one or more files to which the attack program belongs in the sector corresponding to the corresponding storage unit in the storage unit; the recovery module is used to read the one or more files to which the attack program belongs, and The attribute information of the attack program restores the attack program.

With regard to the apparatus in the above embodiments, the specific manner in which each module performs operations and the corresponding technical effects brought about have been described in detail in the embodiments related to the method, and will not be described in detail here.

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. Actually, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided to be embodied by a plurality of modules or units. Components shown as modules or units may or may not be physical units, may be located in one place, or may be distributed over multiple network elements. Part or all of the modules can be selected according to actual needs to realize the purpose of the disclosed scheme. It can be understood and implemented by those skilled in the art without creative effort.

An embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the hidden storage method described in any one of the above-mentioned embodiments are implemented.

Exemplarily, the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

The computer readable storage medium may include a data signal carrying readable program code in baseband or as part of a carrier wave traveling as a data signal. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable storage medium may also be any readable medium other than a readable storage medium that can send, propagate or transport a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the readable storage medium may be transmitted by any suitable medium, including but not limited to wireless, cable, optical cable, RF, etc., or any suitable combination of the above.

An embodiment of the present disclosure also provides an electronic device, including a processor and a memory, where the memory is used to store a computer program. Wherein, the processor is configured to execute the steps of the hidden storage method in any one of the above embodiments by executing the computer program.

An electronic device 600 according to this embodiment of the present invention is described below with reference to FIG. 5 . The electronic device 600 shown in FIG. 5 is only an example, and should not limit the functions and scope of use of this embodiment of the present invention.

As shown in FIG. 5, electronic device 600 takes the form of a general-purpose computing device. Components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, and the like.

Wherein, the storage unit stores program codes, and the program codes can be executed by the processing unit 610, so that the processing unit 610 executes the various exemplary implementations according to the present invention described in the hidden storage method section of this specification. A step of. For example, the processing unit 610 may execute the steps of the hidden storage method as shown in FIG. 1 .

The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 6201 and/or a cache storage unit 6202 , and may further include a read-only storage unit (ROM) 6203 .

The storage unit 620 may also include a program/utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include the realization of the network environment.

Bus 630 may represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local area using any of a variety of bus structures. bus.

The electronic device 600 can also communicate with one or more external devices 700 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable the user to interact with the electronic device 600, and/or communicate with Any device (eg, router, modem, etc.) that enables the electronic device 600 to communicate with one or more other computing devices. Such communication may occur through input/output (I/O) interface 650 . Moreover, the electronic device 600 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and/or a public network such as the Internet) through the network adapter 660 . The network adapter 660 can communicate with other modules of the electronic device 600 through the bus 630 . It should be appreciated that although not shown, other hardware and/or software modules may be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to enable a computing device (which may be a personal computer, a server, or a network device, etc.) to execute the above-mentioned hidden storage method according to the embodiments of the present disclosure.

It should be noted that in this article, relative terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these No such actual relationship or order exists between entities or operations. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above descriptions are only specific implementation manners of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (9)

1. A concealed storage method, characterized in that, comprising: Obtaining a preset file to be stored, where the preset file is a file to which the attack program belongs; Determine the target fragment storage space on the disk; Writing the preset file into the target fragment storage space; The target fragment storage space includes one or more of the first fragment storage space, the second fragment storage space and the third fragment storage space; Wherein, the first fragment storage space includes idle storage space in one or more clusters on the disk, the second fragment storage space includes the reserved storage space of the master file table on the disk, and the third fragment storage Space includes reserved storage for the main file table on disk; The first fragment storage space, the second fragment storage space and the third fragment storage space have different priorities, and writing the preset file into the target fragment storage space includes: Obtain respective priorities of the first fragmented storage space, the second fragmented storage space, and the third fragmented storage space; Writing the preset file into the first designated fragment storage space; wherein the first designated fragment storage space is the priority among the first fragment storage space, the second fragment storage space and the third fragment storage space The highest level of fragmented storage space. 2. The method according to claim 1, wherein the one or more clusters are clusters for storing specified system files; wherein, the specified system files are file records in the NTFS file system whose attributes are very resident system files. 3. The method according to claim 1, wherein the method further comprises: When it is determined that the file size of the preset file exceeds the size of the first designated fragment storage space, write the preset file into a second designated fragment storage space; wherein the second designated fragment storage space is the first designated fragment storage space A fragmented storage space, the fragmented space with the middle priority among the second fragmented storage space and the third fragmented storage space. 4. The method according to claim 1 or 3, wherein the priority of the first fragmented storage space is the highest, the priority of the second fragmented storage space is in the middle, and the priority of the third fragmented storage space is lowest level. 5. The method according to any one of claims 1 to 3, wherein said obtaining the preset file to be stored comprises: Obtain one or more files to which the attack program belongs; The writing the preset file into the target fragment storage space includes: Writing the one or more files to which the attack program belongs to corresponding storage units in the target fragment storage space, each of the storage units includes one or more sectors. 6. The method according to claim 4, further comprising: recording program file information and sector information of the attack program, the program file information including attribute information of the attack program, and the sector information is used to identify the one or more files to which the attack program belongs in the A sector corresponding to a corresponding storage unit in the target fragment storage space; Based on the sector information, read the one or more files to which the attack program belongs from a sector corresponding to a corresponding storage unit in the target fragment storage space; Restoring the attack program based on the read one or more files to which the attack program belongs and attribute information of the attack program. 7. A hidden storage device, comprising: An acquisition module, configured to acquire a preset file to be stored, where the preset file is the file to which the attack program belongs; A determining module, configured to determine the target fragmented storage space on the disk; A writing module, configured to write the preset file into the target fragment storage space; The target fragment storage space includes one or more of the first fragment storage space, the second fragment storage space and the third fragment storage space; Wherein, the first fragment storage space includes idle storage space in one or more clusters on the disk, the second fragment storage space includes the reserved storage space of the master file table on the disk, and the third fragment storage Space includes reserved storage for the main file table on disk; The first fragment storage space, the second fragment storage space and the third fragment storage space have different priorities, and the writing module is configured to write the preset file into the target fragment storage space, including: The write module is used for: Obtain respective priorities of the first fragmented storage space, the second fragmented storage space, and the third fragmented storage space; Writing the preset file into the first designated fragment storage space; wherein the first designated fragment storage space is the priority among the first fragment storage space, the second fragment storage space and the third fragment storage space The highest level of fragmented storage space. 8. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the steps of the concealed storage method according to any one of claims 1 to 6 are implemented. 9. An electronic device, characterized in that it comprises: processor; and memory for storing computer programs; Wherein, the processor is configured to execute the steps of the hidden storage method according to any one of claims 1 to 6 by executing the computer program.