KR20090067569A - Windows kernel protection system using virtualization - Google Patents

Abstract

A windows kernel protection system using virtualization is provided to make a security company use original security, thereby providing pre-processing for personal information protection. Original data of various kernel API(Application Program Interface) functions used in a window operating system are assigned to a virtual space so that the kernel is protected from hooking techniques of various malicious programs. A set program calls a kernel API before a change by calling a function newly configured in the virtual space rather than calling a changed kernel API. A hidden code included in the changed code is detoured. Therefore, the hidden code calls an API by a normal method.

Description

Windows Kernel Protection System using Virtualization

The present invention relates to a protection technology through the virtualization of the Windows kernel to prevent the Windows system from operating abnormally by changing the contents of the system kernel API from various malicious codes and viruses, and to prevent the kernel from malfunctioning from the changed kernel. .

1. Understand how concealment techniques work

Various concealment techniques are very diverse, but the most basic technique is hooking technique. Hooking technology is a technology that makes a specific function or a specific command executed, intercepts the contents of the command in the middle, and passes it to the original execution function after processing. (This technology, which is the basis of the concealment technique, can operate across multiple domains and is available in all operating systems and in all environments, so it is very likely that the variant will emerge.)

Figure 1-1 Windows  System basic structure

Such hooking technology can be divided into user mode and kernel mode. In User Mode, API Hooking and Message Hooking techniques are used.In Kernel Mode, SSDT Hooking, IDT Hooking and IRP Hooking techniques are used.

Figure 1-2 Windows Hooking position

1. API Hooking

2. IDT Hook

3. SYSTENTER Hook

4.SSDT Hook

5. Code Patching

6. Layered Driver

7. Driver Hook

In the case of the conventional concealment detection method, if you find the hooked module and recover only the hooking code, the rootkit can be naturally detected and removed. However, when the hooking code used by the rootkit is restored in modern times, the system is broken. In some cases, it is difficult to recover the existing method.

2. Detection Technique

The concealment technique is most important once it is present in the system. For detection, there can be a technique to detect by implementing the function directly without using the existing hooked code, or there can be a method of calling the original function by restoring the hooked code. The method of restoring the hooked code is widely used to detect the various hooking techniques mentioned below.

A. Import Address Table (IAT)

B. System Service Dispatch Table (SSDT) ◎ KeServiceDescriptorTable

C. Interrupt Descriptor Table (IDT) ◎ Per CPU

D. Drivers ◎ I / O Request Packet (IRP) handler

However, there are various risks in detecting the concealment technique by immediately restoring the above hooking techniques. Depending on the situation of the system it is difficult to produce a general purpose, even if the actual production is not easy to apply to all operating systems.

The proposed method is the virtualization method. Create a system kernel driver and use that driver in Windows The actual functions used in the system are mapped to the virtual memory and linked to the system entry so that the actual hooking functions do not work. Therefore, even if you hide the process, hide the file, hide the register value, or block other contents through various hooking techniques, you will use the function or command that is originally used in the system and call the original function that is not hooked at all to get the correct result. I will be able to bring.

Figure 2-1 Windows  System default state

Figure 2-2 In the rootkit  due to Hooking  Becoming

Figure 2-3 How to Propose This Project (Kernel API Virtualization )

As a result of actual test, if you define only functions that are mapped for each operating system without being influenced by CPU type or environment, it becomes a technique that can be used semi-permanently. In addition, even if a new hooking method is introduced, if only the function or type used for the corresponding hooking is determined, mapping the contents to the virtual space and connecting only the system entry can be done quickly.

3. Removal Techniques

If the concealment technique can be detected by the above method, it can be easily removed. Once the rootkit program is running, the process stops working. In order to interrupt the process, the module used by us through the above detection process calls the actual function that is not hooked. Therefore, we can stop the program by bypassing the blocking by hooking code such as preventing the program from stopping. At the same time, it can be easily removed by calling the original function to find and delete the main file of the hidden technique that was protected while the process was running. Even if the file hangs its own process on another system module or file, if the process stops working, the links that it hangs are released and can be removed as well.

Rootkit executable programs can be detected by common antivirus programs as long as they are not run by the user. However, they cannot be detected because they hide themselves while they are running on the system as a process. In other words, the system call to the general OS can not determine whether they exist. In the end, the OS running the rootkit itself is already contaminated by the rootkit, so even the antivirus program running on it will have unbelievable results. Some of the current security programs that can detect rootkits do not fully implement the ability of rootkits to hide themselves below the OS level.

Case Study 1 Scanning on not-running file system

In reality, the most basic way to detect a rootkit is to find the rootkit by connecting only the file system to another (non-rootkit-infected) system without booting the system on which the rootkit runs. Rootkit programs that are not running can be detected by antivirus programs because they do not have the ability to protect themselves.

Advantages: Rootkits can be detected directly on disk without being interrupted by rootkits.

- Limit: You can search only in the state made the system.

Figure 2.1-1

2. Case Study 2 Stealth Detector

If the rootkit hides itself while scanning the system to protect itself from the detector while the system is running, one way to detect it is to prevent the rootkit from being noticed by the rootkit detector. When a rootkit attempts to unload itself from the system temporarily, antivirus software finds it with fingerprint detection. However, implementing this leaves room for a new version of the rootkit to counter-attack it. Rootkits have kernel-level privileges that allow rootkit code to kill or prevent detectable antivirus software processes.

Advantage: You can try searching while the system is running.

- Limit: You can get the counter-attack of rootkits.

Rootkit detection software such as F-Secure Blacklight and AVG Anti-Rootkit detects rootkits in this way.

2. 3. Case Study 3 ◎ Cross Checking

Sysinternals' RootkitRevealer compares the type of process actually loaded on the OS with the type read from disk to determine whether it is a rootkit. This is a way for the rootkit to hide itself so that the response from the OS is delivered to the antivirus program in a malformed form compared to the result read from disk. Recent rootkits, however, have a list of these detection programs, and use a mechanism to prevent them from hiding themselves when they attempt to detect them.

Advantage: You can try searching while the system is running.

- Limit: rootkit detector that knows it is impossible to detect.

4. Case Study 4 Fingerprinting

In fact, monitoring the integrity of the system can be used to proactively identify rootkit intrusions before they are installed on the system. It records the fingerprint after the first secure system is installed, and checks the integrity of the system whenever there is a change in the kernel file. To implement this, a cryptographic hash function is used, where all bits of the kernel file are stored in fingerprint form. The fingerprint changes are calculated at regular intervals, compared, and detected.

Advantages: Prevents rootkits from entering itself by preventing rootkit detection in advance.

Limitations: Computing and comparing system fingerprints requires significant system process power and makes it impossible to expand or modify the required system kernel.

1. Detection Technique

The concealment technique is most important once it is present in the system. For detection, there can be a technique to detect by implementing the function directly without using the existing hooked code, or there can be a method of calling the original function by restoring the hooked code. The method of restoring the hooked code is widely used to detect the various hooking techniques mentioned below.

A. Import Address Table (IAT)

B. System Service Dispatch Table (SSDT) KeServiceDescriptorTable

C. Interrupt Descriptor Table (IDT) Per CPU

D. Drivers ◎ I / O Request Packet (IRP) handler

However, there are various risks in detecting the concealment technique by immediately restoring the above hooking techniques. Depending on the situation of the system it is difficult to produce a general purpose, even if the actual production is not easy to apply to all operating systems.

The proposed method is the virtualization method. It creates a system kernel driver and maps the actual functions used by the Windows System to virtual memory and connects them to the system entry so that the actual hooking functions do not work. Therefore, even if you hide a process, hide a file, hide a register value, or block other contents through various hooking techniques, you will use the function or command that was originally used in the system and call the original function that is not hooked at all. Will be able to bring.

Figure 1-1 Windows System Default Status

Figure 1-2 Hooking by Rootkit

Figure 1-3 This Project Proposal Method (Kernel API Virtualization)

As a result of actual test, if you define only functions that are mapped for each operating system without being influenced by CPU type or environment, it becomes a technique that can be used semi-permanently. In addition, even if a new hooking method is introduced, it is possible to map the contents to the virtual space and connect only the system entry if the function or type used for the hooking is determined.

2. Removal Techniques

If the concealment technique can be detected by the above method, it can be easily removed. Once the rootkit program is running, the process stops working. In order to interrupt the process, the module used by us through the above detection process calls the actual function that is not hooked. Therefore, we can stop the program by bypassing the blocking by hooking code such as preventing the program from stopping. At the same time, it can be easily removed by calling the original function to find and delete the main file of the hidden technique that was protected while the process was running. Even if the file hangs its own process on another system module or file, if the process stops working, the links that it hangs are released and can be removed as well.

Unlike the existing methods of complementing the hacking technology, rather than the development or design of the existing solutions, it can be said that they have found and devised other solutions. In this regard, it enables Windows users, who have a significant share of both domestic and international markets, to protect their computers and information that cannot be converted into money and to enable stable computer use. It seems to be able to make a big effect, and each security company will use the original security rather than follow-up after the virus and hacking technology has been developed so far, so that it can be pre-processed to protect each individual's information. It can be said that the greater effect than anything else.

In order to implement the present invention, a user generally needs to configure a system using a Windows operating system. In this case, various APIs used inside the kernel due to various malicious codes or hidden codes of viruses are loaded with the changed contents due to various malicious codes instead of pure kernel API states. At this time, if the program developed by the present invention is used, the program set in the present invention does not call the changed kernel API, but calls a newly configured function in the virtual space to induce a pure kernel API before the change.

As a result, the hidden code inside the modified code is bypassed and calls the API in the normal way, so that various malicious codes and viruses using the hidden technique are incapacitated to protect the Windows kernel system.

Claims (4)

How to protect kernel from hooking technique of malicious program by allocating original data of various kernel API functions used in Windows operating system to virtual space The method of claim 1, further comprising: extracting function contents required from a system file in which the kernel API is implemented in an assembly form in order to allocate an unchanged pure kernel API function to a virtual space (memory); Relocating the extracted function contents to kernel memory so as to be called with a newly placed function address; After the pure kernel API call is completed, connect the function to the function allocated on the system (not the virtual space, but the real space). According to claim 2, in order to make a call to the pure kernel API allocated to the virtual space, a newly created (new allocation to the virtual space) by modifying the contents of the association table of the API function allocated at the general user level and the API function allocated at the kernel level. Modified to a pure kernel API function address to make it work as desired The method of claim 2, wherein the method exports the contents of the function to the file contents to analyze the system file itself to determine whether the kernel contents have changed, and to apply the virtualization method only to the changed kernel API.