TW446872B - Detection method of boot-up virus - Google Patents

Abstract

A detection method of boot-up virus is provided. At first, there are set up the pre-defined parameters in the relevant registers of computer system, including setup for diagnostics expansion bits, setup for address of hard disk status/command register concerning hard disk drive, the interrupt function generated when the CPU is set up to execute the IO interface actions, and the setup bit length. When debugging state takes place, it is first determined if the condition of the terminated point in the debugging state register is set up. Next, it is determined if the currently executing command is the output command for executing data transfer. Then, it is determined if the address data of the direct address of IO port or the indirect address of register is the address for writing data into the hard disk drive. Finally, it is determined if the IO port address is exactly the address of the boot sector of the hard disk drive. If yes, a warning is immediately issued to alert user that the computer might be infected with boot-up virus.

Description

V. Description of the invention (1) 1. Creative field: The present invention relates to a method for detecting computer viruses, and particularly to a method for detecting boot-type computer viruses. 2. Background: Among all types of computer viruses, there are unique virus types and transmission routes. These computer viruses can cause different degrees of damage to a computer system. The typical boot-type computer virus type usually infects the boot sector (B ο 〇 t S e c t 〇 r) of a hard disk device in a computer system, and uses these areas as a transmission medium. In order to detect computer viruses, many detection methods have been proposed. For example, when a program to be executed is to be executed in a computer, a self test is first performed to determine whether the program has been modified. If the code has been modified, it means that the program may have been infected by a computer virus. Infection. Another method is to check the code (C h e c k S inn) * Before executing the program, the check code will be checked first, so as to determine whether the program has been modified. Although the above-mentioned virus detection methods can achieve a certain degree of effectiveness, the prerequisite is that the computer system must complete the normal startup procedure before it can perform the virus detection function. That is, these virus detection methods are not applicable to some boot-type virus detection. In the case of boot-type viruses, the virus program exists in the boot sector of a data storage device (such as a hard disk device) that can perform booting. When using a hard disk infected with a bootable virus to start the computer system, the virus program will be loaded into the computer system memory and perform its virus function.

-------- II. 5. Description of the invention (2) Yes. The parts of the electroencephalography machine that are poisoned by the disease are mostly in the form of the Chinese Dai Club. Cheng Qinqi's Changzhengdai took the type 7 h process 3 poison NT ulcers ^ * -I to the sun. The discou jull / disc control that energy can be saved is that the amount of energy can be changed to the middle and the amount of the energy can be changed. Cheng Shijun 3h new T1-N in the direction of T1, the location of the fault in the middle of the path to spread the disease. Type and dyeing machine, feeling the systemic poison in the onset, is the disease, the brain and the moon are in the bank, and it keeps repeating one by one ^ 3 I together with the state of the disease. When the virus starts the disease, the source is new 1 ^^ »fr & \ lttul TpBT-type brain-brain circuit electrical and electronic deputy will meet a new drug every ancient mouth and Λ and sick type of large machine is very open. This meeting will test the anger and all the benefits. The initial funding and activation of the commander It is (< < & steroids) that the law is right. If it is, then. The threat of this is a summary of the present invention. Therefore, the method of the present invention, when the hard disk of the present invention starts up the user of the computer Another method of the present invention may be used. The method performs virus detection in the straightener and the breakpoint register to achieve the interruption in the control register of the present invention.

The main purpose of Ming is to provide a method to detect boot-type viruses. When the method of Ming-type detects any attempt to write to the computer system, it can issue a warning, so that the host can be infected with the boot-type virus in a timely manner. a σ -The purpose is to provide a kind of early detection and start-up, and then use the relevant control, debug control register 'and debug status register' in the central processing unit. To find the above purpose, first set the debug extension bit in it; in the central processor, 4 4 G ____ 5. Description of the invention (3) Set the hard disk device connected to the computer system in the point register. The address of the hard disk status / command register. In the debug control register, set the CPU to generate an interrupt function and set the bit length value when the input / output interface is executed. Determine whether a debug occurs Status; determine whether the corresponding breakpoint condition in the debug status register of the central processor is set; determine whether the instruction currently executed by the central processor is an output instruction to perform data transfer; Whether the address data of the direct address of the port address or the indirect address of the register is the address for writing data to the hard disk device; determine whether the address of the input / output port is exactly the address of the hard disk device's boot sector, if so An alert is issued to warn users that the computer may be infected with a boot virus. The other objects of the present invention and its further virus detection method will be further explained by the following preferred embodiments and attached drawings, wherein: (1) Brief description of the drawings: In a typical personal computer system, a schematic diagram of the central processing unit, the input / output interface, the hard disk device, and the memory; Figure 2 shows a schematic diagram of the internal registers of a Pentiu π-level CPU; Figure 3 shows Flow chart of the virus detection method of the present invention. (II) Drawing number description: 1 Central processing unit 21 address bus

Page 6 ψ 446872 (4) .. 22 Data bus 23 Control bus 3 I / O interface 4 Hard disk device 5 Memory 10 General purpose register 11 Section register 12 State and instruction register 13 Control register Register group 1 4 Debug register group CR0-CR4 Control register DR0-DR3 Breakpoint register DR6 Debug status register DR7 Debug control register Description of preferred embodiments: Figure 1 shows In a typical personal computer system, a schematic connection diagram between a central processing unit 1, an input / output interface 3, a hard disk device 4, and a memory 5, wherein the central processing unit 1 communicates with a hard disk via a system bus and an input / output interface 3 The device 4 is connected, and the central processing unit 1 is connected to a memory 5 via the system bus. The system bus includes an address bus 2 1, a data bus 2 2, and a control bus 23. In the following embodiments, a Pentium-class central processor from Intel Corporation is used as a preferred embodiment, and the hard disk device 4 is passed through an I / D interface.

SBB 446h V. Description of the invention (5) and connected to the central processing unit 1. As shown in FIG. 2, a typical Pentium-level CPU can be roughly divided into a general purpose register 10 (General Purpose Register), a section register 11 (state register), a state, and a 4 command according to its functions. Register 12 (Status and Instruction Register). Among them, the general register 10 is generally used to process byte data, and the section register Π is used to determine the memory address of the base address of the section, and the status and instruction register 12 is used to Specify the instruction to be executed and the result status after the instruction is executed. In addition, there are other system registers in the Pentium-level CPU. Among these system registers, the registers related to the virus detection method of the present invention include a control register group 3 and debugging Register group 丨 4. The control register group 13 includes several control registers CR0 to CR4. Among the bit definitions of the control register CR4, there are a total of bits 0 to 6, and bit 3 in f is for debugging. Extension function setting bit. When this bit is set to 1, the I / O interface breakpoint debugging extension function is enabled. When the bit is set to 0, the I / O interface breakpoint debugging extension function is cancelled. The debug register group 14 includes several registers dR0 ~ DR7, among which DRO DR3 疋 is used as a breakpoint register. Each breakpoint register contains a μ-bit breakpoint linear address e. DR6 is used as a debug status register which can be used to temporarily store the status of the breakpoint register DR0_DR3. DR7 is used as a slave control register (Debug Control Register), which is used to control the operation of breakpoint registers DR0 ~ DR3. Each breakpoint register DR0 ~ DK3 has its own control bit

Page 8 44β8-7-Description of the invention (6) 1 446872 (in the debug control register DR7), for example, the value of LEN determines the access length at the breakpoint address. When LEN = 00, the bit Tuple; LEN = Oi: statement: LEN = 1 1: double statement. The value of R / W determines the cause of the breakpoint at the breakpoint address 'R / W = 00' Instruction code access; R / W = 01, data write: R / W = ll, data read and write Into. '' The following will simultaneously refer to the structure of the internal register group of the central processing unit shown in FIG. 2 and the control flowchart shown in FIG. 3 to describe the virus detection method of the present invention in detail as follows. After the system is started, the present invention first sets a debug extension bit (Debug Extention) in the control register CR4 of the central processor in step 101. In this step, the third bit of the control register C R 4 in the central processing unit is set to 1 to enable the I / O breakpoint debug extension function. Then set the hexadecimal value data lF7h and 177h in any two registers in the breakpoint registers (DR0-DR3) of the CPU (step 102). The value 1 F 7h is the address of the first hard disk status / command register connected in the computer system *, and the value 1 77h is the address of the second hard disk status / command register. In step 103, a value of 1 is set in the corresponding R / W bit (read / write control bit) in the debug control register of the central processor, which means that when the central processor is in When I / O is executed, the interrupt function is executed. In addition, in this step, a value of 00 is also set in the len bit (length bit) corresponding to the debug control register DR7 (its value represents that the bit length value is j bits).

Page 9 7 ^ 46 8 V. Description of the invention (7) After Yuancheng has set the above-mentioned related register data, step 104 is executed. This step is to determine whether there is a debug status (Debug Exceptlon). , Then continue the loop test, if there is, then perform the next step 105, to further determine the status of the central processor order debug status register DR6, which is used to temporarily store the interrupt The status of the point registers DR0-DR3. In step 105, it is judged whether a corresponding interruption point condition (Breakpoint cone) in the debug status register DR6 of the CPU is set. If not, go back to step 104, and if so, go to the next step 106. In step 106, it is determined whether the instruction currently executed by the central processing unit is an output instruction (〇υτ or ⑽) to perform data transfer in the combined language. If not, go back to step 104, and if yes, go to the next step [0077]. Among them, the output instruction OUT is a simple input / output interface instruction in the combined language instruction. 'It performs a simple data transfer. The object of data transfer is a sequence of in-out ports. When transferring data, it passes through the center. A general-purpose register in the processor (for example, the register AL in 8-bit) is used to transfer data. The output instruction 〇UTS is a character string input / output interface instruction. This instruction outputs the memory byte data specified by the section register Ds and the index register sj in the central processing unit to the register. The output specified by DX is in the interface. In step 107, it is further judged whether the data of the register AL or DS: SI in the general purpose register 10 of the central processing unit (direct address of the input / output port address or indirect address of the register) is CAh, CBh , Or 30h, 3Ih, or C5h. If it is not these predetermined values, go back to step 丨 04.

ΙβΗΙ page 4 -7 5. Description of the invention (8) 'Set value, then proceed to the next step 108. The values CAh and CBh represent writing data to a DMA channel, 30h and 31h represent writing data to a magnetic zone, and C5h represents writing data to several magnetic zones. After judging by the foregoing steps, ' If it is just writing data to D Μ Α or magnetic sector ', it means that the virus program may be writing the virus code. At this time, in step 108, it is finally judged whether the magnetic sector address of lF3h-1F6h (or 173h-176h) of the input / output port is just the boot sector of the hard disk. If the result of the judgment is yes, it means that the virus program may be writing the virus code to the hard disk boot sector.

Make. At this time, a warning can be issued by the computer system (step 10g), so that the user β T uses the above-mentioned virus detection method and the use of a control register, a breakpoint register, The debug control register and the state register enable the present invention to effectively detect any virus that has mistakenly entered the hard disk boot sector of the computer system. Once the virus is detected, it can be issued- Warning 'U warns the user timely that the battery has been infected with a boot virus. In actual application, the month of the present invention ^ / can perform its virus detection in a computer system in the form of control software, and can also be stored in a system's firmware of a personal computer to provide a computer The system's real-time virus detection function. To sum up, the boot-type virus detection method provided by the present invention has high industrial utilization value and can achieve the expected effect, and before the special: ^, no same or similar technology has been disclosed before, which has already been in line with the profit Requirements': The application for an invention patent is filed according to law. early

Claims (1)

44 ^ 8γ2 VI. The patented patent-type boot-type virus detection method is used to detect whether a boot-type virus code is written to the boot sector of a hard disk device of a computer system. The computer system includes a The central processing unit is connected to the hard disk device through an input / output interface. The contention processing unit is internally provided with a control register, a breakpoint register, a debug control register, and a debug status register. The test method includes the following steps: 'Set one of the CPU's control registers to set the debug extension bit' to enable the I / O breakpoint debug extension function; • Set in the CPU's breakpoint register The address of the hard disk status / command register of the hard disk device connected to the computer system; c. In the debug control register, setting the CPU to generate an interrupt function when performing input / output interface actions, and Set the bit length value d · Judge whether a debug situation has occurred; e • Judge whether the corresponding breakpoint condition in the debug status register of the CPU is set; f. Judge whether the instruction currently executed by the CPU is Whether it is an output instruction to execute data transfer; g. Determine whether the address data of the direct input or indirect address of the input / output port address in the central processing unit is the address of the written data to the hard disk device; h. Judgment Whether the address of the input / output port is exactly the address of the hard disk device boot sector; i • Issue a warning. ^^ 8 y2 The six Chinese patent applicants Fan Guru applied for patent scope 1 Jg%. +. + Step b in the + includes the following steps: Open the virus detection method 'its dagger :: Ξ Γ hard disk status' command register The address value of the address; and the address value of the status / command register. In the first hard disk-like virus detection method, the address value of the% status dagger // command register is 01F7h ’, and the address value of the hard disk status / command register is 0177h. 2 Please refer to the bootable virus method described in the item of the patent, wherein step c includes the following steps: cl. Set a predetermined value in the read / write control bit of the debug control register of the central processing unit; And c2. Setting a numerical bit length in a length setting bit of the debug control register. 5. The boot-type virus detection method described in item 1 of the scope of patent application, wherein the data transfer output instruction of step f is 〇UT / 〇UTS. 6. According to the boot-type virus detection method described in item 1 of the scope of the patent application, the address value of the data written to the hard disk device in step g includes the address to the DMA channel carefully. 7. The address value of writing data to the hard disk device in step g of the boot-type virus detection method described in item 1 of the scope of patent application includes the address of the information to a magnetic sector. ^ Ma Jingong 8 As described in the method for detecting virus on booting in the first scope of the patent application, the address value of the data written to the hard disk device in the step 脒 g includes the answer to the address of several magnetic sectors < »'' 'Education Page 13 44 to 72 6. Scope of patent application 9. The boot-type virus detection method described in item 1 of the scope of patent application, wherein the address of the input / output port in h is lF3h ~ lF6h. 10. The boot-type virus detection method as described in item 1 of the scope of patent application, wherein the addresses of the input and output ports in step h are 173h to 176h. Page 14