SEP Client Architecture (I)

Main client process, smc.exe, is a service.

 

 

smc.exe will load the tray icon, which named smcgui.exe, if you open the client management console (symcorpUI.exe) from the pop-up menu of smcgui (right click on the tray icon, you will see the pop-up menu)

 

 

check the call relationship between these three processes by process explorer:

 

 

if you start the console from the program menu, then the process symcorpUI.exe will be a sub process of explorer.exe.

 

Three Key DLLs of smc.exe:

 

SyLink.dll - implements the SYLINK communications module that communicates with the SEPM.
SyLog.dll - implements the logging mechanism for the client
NetPort.dll - implements the location sensing for the client

 

用于实现与Manager的通讯，日志和位置感知。

 

 

There are also a set of plug-ins that implement the remaining significant features
of the client:

 

 

AVMan调用RTVScan(rtvscan.exe)，实现防病毒功能，devman和sfman用于实现设备和应用程序控制(sysplant.sys)，GUProxy用于实现更新代理的功能，LuMan自然是LiveUpdate的调用(sesclu.dll)，NacManager就是SNAC(snac.exe or snac64.exe)的部分了。

 

Some configuration files of SEP client:

Sylink.xml 服务器连接参数文件
SerDef.dat 来自manager的策略定义
CltDef.dat 客户端的策略定义
Default.dat 客户端采用的定义，混合模式下由上述两种策略合并而成
CltState.dat 记录客户端状态

以上四个文件是加密文件，内容不能直接查看。

 

Two registry keys related to the SEP client,most of the configuration parameters are in HKLM tree:

 

HKEY_CURRENT_USER\Software\Symantec\Symantec Endpoint Protection

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection

 

There are several local log files that are generated in the client directory:

 

 

本文出自 “西蒙[爱生活，爱学习]” 博客，谢绝转载！