利用Windows Hook技術與Windows Service設計與實作之防側錄系統

Abstract

在這資訊膨脹的時代，各行各業不斷地加速數位化的腳步，使數位內容日漸普及，人們在彈指之間就可以獲得許多訊息。隨著網際網路傳輸速度的增加，大量的資料可在世界各地迅速地傳遞，若是未經過保護的數位內容，如：圖片、聲音、視訊檔案等等，就很容易被下載與複製而導致數位內容盜版猖盛。根據Net Application數據顯示Windows作業系統的市占率高達九成以上，所以數位內容的使用主要在Windows作業系統上，因此亟需在Windows上保護數位內容的智慧財產權，以預防惡意的侵權行為以及保護數位內容產業的發展。

原本智慧財產權的演進已經跟不上數位時代的變遷，為了保護數位內容的智慧財產權，進而開始衍生了許多的數位內容保護技術，如：數位版權管理系統(Digital Rights Management System)、選擇性編碼(Selective Encryption)技術與可變轉碼(Scalable Encoding)、數位浮水印(watermark)、數位指紋(Fingerprinting)、防側錄技術等研究，目的都是在保護數位內容產業的發展以及兼顧創作者權利。

其中防側錄技術也是目前數位內容保護的一項重要技術，目的是為了防止使用者開啟數位內容之後，使用桌面或視窗錄影程式錄製數位內容。目前的防側錄技術作法有兩種：利用API Hook技術與特徵碼比對技術。API Hook技術主要用來監視系統中有關擷取螢幕畫面之API內容，進一步攔截或阻擋此行為之發生。特徵碼比對技術主要利用資料庫與系統中程式之特徵碼作比對，以達到辨識是否是側錄程式。

但是使用API Hook技術與特徵碼比對技術無法滿足所有防側錄之需求。例如：API Hook技術有可能被防毒軟體視為攻擊行為而無法發揮防側錄之功能、借由修改程式執行檔而產生不同特徵碼可躲過特徵碼比對技術之側錄偵測。所以本研究將在Windows上研發一套完善的防側錄系統，以偵測出所有側錄行為。

In this age of information expansion, every aspect of technology continues to accelerate its digital footsteps and become easily accessible. People can easily retrieve information at their fingertips. As Internet speeds increase, a huge amount of information can be passed quickly around the world. Without the protection of information, pictures, audio, video files and much more, can be easily downloaded and copied. The Net Application data that is based on the Windows operating system has over 90 percent of the market share; therefore, the digital content mainly used on the Windows operating system, is in urgent need of protection for its intellectual property rights of digital content. The purpose of this protection is to prevent malicious violations in the digital content industry.

The evolution of intellectual property rights has been trailing behind the rapid development of the digital age. The purpose is to protect the digital content industry and the rights of the creators. This has lead to a gradual rise in digital content protection technology, such as: Digital Rights Management System, Selective Encryption, Scalable Encoding, Watermark, Fingerprinting and Screen Capturing/Recording Prevention (SCRP) Technology.

SCRP is a vital part of protection of digital content. Its objective is to prevent desktop or window recording program users to from recording digital content. The current SCRP Technology has approaches: using API Hook technology or characteristic code matching technology. API Hook technology is operated to monitor the APIs of screenshots on the system and to further block or stop the occurrence of this behavior. Characteristic code matching technology compares the program's characteristic code and its database to identify whether or not it is a screenshot program.

However, using API Hook technology and characteristic code matching technology may not sufficient for the needs of SCRP, such as: API Hook technology which may be regarded as aggressive behavior by anti-virus software and disabling it from implementing the function of SCRP technology. Through the modification of the executable program file, a new characteristic code can be generated that allows it to escape the characteristic code matching technology. Therefore, this study will develop comprehensive SCRP software on Windows to detect all behaviors of screen capturing/recording.