TW448402B - Virus detecting method for IDE hard disk device set in PIO access mode - Google Patents

Abstract

A virus detecting method for IDE hard disk device set in PIO access mode that first determines if the interrupt condition of instruction register corresponding to IDE hard disk in the debug status register is set. If the condition is set, it determines if the present executing instruction is the data transmission output instruction, and if the action of writing data into hard disk device is in PIO access mode and sets a flag if it is. Then, when the determined debug status register corresponding to the data register of IDE hard disk and the determined flags are set, it writes the general register AX or 16 bit data of the memory address DS:SI into the selected memory buffer. It scans and compares pre-stored known virus codes after entire data disk areas or sectors are written into memory buffer and sends a warning message when finding the match known virus codes.

Description

4434 0 2 V. Description of the invention (l) —- 1. Creative field: The present invention relates to a method for detecting computer viruses, in particular-a method used for primary testing-[DE hard disk device set to P 10 transmission wheel Diseases in the mode ^ Inert test method 'can detect any possible virus in real-time when any writing action of the DE hard disk device is set in the p I 0 pass mode. 2 * Background note: Due to the rapid development of computer technology, the functions of personal computers have become more and more powerful. Therefore, the paperwork, accounting operations, work arrangements, etc. of modern industrial and commercial clubs rely heavily on computer assistance. Therefore, the security of computer data is increasingly important. However, 'computer systems or computer data are often damaged by computer viruses, especially after the widespread use of the Internet.' The probability of exchange and transmission of data in the project is getting higher and higher, and the chance of computer virus infection is increasing. . In various types of computer viruses, they have their own unique virus types and transmission routes. These computer viruses can cause different degrees of damage to a computer system. Generally speaking, computer viruses can be classified into file type, open type, compound type, and macro change type. Some types of computer viruses use special virus codes written to hard disk devices in the computer system, and use these areas as a medium of transmission to block, execute, or activate the data on the computer system. damage. Therefore, if you want to prevent virus codes from damaging the computer system, you must detect and warn the virus codes before writing them to the hard disk, so that you can effectively prevent the damage of computer viruses. In addition, since the interface specifications and working modes used by various computer systems are not the same, it is necessary to effectively prevent electricity

Page 4 44840 ^ V. Description of the invention (2) For brain viruses, an effective virus detection method should be designed for the configuration of the computer system and the specific interface specifications and working modes used by the computer system. Works. Check again that the hard drives used in current personal computer systems are still based on the I DE interface. Earlier I DE interfaces used 16-bit ISA buses for data transmission, while more recent I DE interfaces have gradually changed to 32-bit PC I buses for data transmission. [IDE devices connected to the DE interface can be divided into PI0 transmission mode and DMA transmission mode according to their transmission mode and maximum transmission rate. For example, currently widely used Pent ium-class personal computer systems can generally be connected to four IDE devices at the same time, and these IDE devices can be divided into PI transmission mode (P0Access Mode) and DMA transmission mode according to their data transfer mode 〇ΜΑ Access Mode) two modes, of which PI〇 transmission mode can be divided into four modes according to its maximum rate Pl0M〇de 〇 ～ ρι〇Μ〇 & 3, and dma transmission M type can also be The transmission rate is divided into several chess styles. The difference between DMA transfer mode and PI0 transfer mode. The former is _ ΐϋίϊΓ4 private, while the latter is controlled by the central processing unit. Therefore, if you want to effectively prevent computer systems, you need to design viruses for their specific execution status under different working modes, such as specific R & Detection method, purpose. For example, Xiao Yi ’s iDE interface ’s hard disk device II has reached a valid data transfer mode. It is set to be private by the machine, and “If the hard disk ’s eight-series device is 6 and then transferred to PI 0, Based on the characteristics of the modular configuration, it is necessary to respond to this detection method of beggar silkworm in order to truly achieve

Page 5 5. Invention Description (3) Purpose of virus control. Summary of the invention: Therefore, the main purpose of the present invention is to provide a method, which can be written in a virus-type attempt to check and test the computer virus and issue a warning. A timely warning is provided by providing a coffee hard disk device set at PI0 method. When the virus program attempts to write any data, the possible virus code can be detected immediately. 'Another purpose of the present invention is to connect with the county ^. 丨 Real-time detection 15 ... Transmission mode: = Military poison method, this method combines electricity ^ in the 中 7! Control register, error address register, delete Error control register, debug state register, etc. & ° In order to achieve the above-mentioned purpose of the present invention: wait for the second to control the virus]. In the method, when the debug status issued by the central processing unit is measured / first, it is judged whether the interruption point conditions of the central processing unit's debug state temporarily stored in and are set. If yes, judge the command is W㈣ or 〇UTS 'If yes', judge the write operation of the disc device M is PH) transfer mode $ H judge the general register AL or DS: S in the processor Whether the data of the address is 3, 31h, or C5h, which makes the value 30h, 31h means to write one magnetic zone in the data, and C5h means the purpose of this step of writing data to several magnetic zones It is to judge whether the operation of writing data to the hard disk device ^

Η ^ 44840 ^

10 pass mode. If so, set a flag. Then set 117 °} 1 and 17〇11 in the other two debug address registers in the central area, and set the value 1 in the R / w bit corresponding to the debug control register of the CPU. 0, then, continue to make a false test of the debug status. When it is determined that the interruption point conditions corresponding to the 10-port lFOh and 17 Oh in the debug status register have been set, and then it is judged that the flag has been set, 'the general register AX or the memory address DS..S1 address The 16-bit data is written into the specified memory buffer. After the data of an entire sector or sector is completely written into the memory buffer, it is scanned and compared with the pre-stored known disease code. If a match is found, If a virus pattern is known, an alert is issued. The other objects of the present invention and its detailed virus detection steps will be further explained by the following description of the preferred embodiments and the accompanying drawings, wherein: (1) Brief description of the drawings: In a typical personal computer system, the schematic diagram of the central processing unit, the input / output interface, the hard disk drive, and the memory; Figure 2 is a schematic diagram showing the relevant registers in a Pentium-level central embedded device; Figure 3 is a schematic The flow chart of the method of the virus in the present invention is shown in FIG. 4; FIG. (2) Explanation of 圄 #: _ 1 Bus at the center of Caoyuan 21

~ 4-48 40 d—— V. Explanation of the invention (5) _ — --- 22 Data bus 23 Control bus 3 Wheel access interface 4 Hard disk device 5 1 Memory device 10 Universal register 11 Section temporary Register 12 Status and instruction temporary storage 13 Control register group 14 Debug register group CR0-CR4 Control register DR0-DR3 Debug address register DR6 Debug status register DR7 Debug control register Description of the preferred embodiment of the device: FIG. 1 is a schematic diagram showing the connection between a central processing unit 1, an input / output interface 3, a hard disk device 4, and a memory 5 in a typical personal computer system. The central processing unit 1 The system bus and the input / output interface 3 are connected to the hard disk device 4, and the central processing unit 1 is connected to a memory 5 via the system bus. The system bus includes an address bus 21, a data bus 22, and a control bus 23. In the following embodiment t, a Pen t ium-level central processor from Inte 1 is described as a preferred embodiment. The hard disk device 4 is connected to the central processing unit 1 through an interface.

Page 8 448 4 Ο 2 V. Description of the invention (6) Please refer to Figure 2. ′ Inside a typical Pentium-class CPU can be roughly divided into general temporary storage 10 (General Purpse) according to its function.

Register), section register u (segment register), status and status 7 register 12 (Status and Instruction Register). Among them, Xuan general purpose registers include AX, BX, CX, DX, BP, SP, SI, D I and other registers. Generally used to process byte data. The section register j j includes registers such as SS, DS, ES, FS, and GS. It is used to determine the base address of the memory address section. The status and instruction registers 2 include ιρ, FLAGS registers', which are used to specify the instruction to be executed and to indicate the result status after executing the instruction. In addition, other system registers are included in the Pentium-level CPU. Among these system registers, the registers related to the virus detection method of the present invention include a control register group 3 and debugging. The register group 14 ^ The control register group 13 includes several control registers ~ CR4. Among the bit definitions of the control register CR4, there are bits 0 to 6, and bit 3 is This is the setting bit for the debug extension function. When this bit is set to 1, it is to enable the I / O interface breakpoint debug extension function. When this bit is set to 0, it is to cancel the I / O interface breakpoint debug extension. Features. The debug register group 14 includes eight registers dr0 ~ DR (?, where DR0 ~ DR3 are used as debug address registers (Debug Address

Resister), each debug address register contains a 32-bit Breakpoint Linear Address dDR6 is used as a debug status register (Debug Status Register), which can be used when a debug status occurs 'Inform the conditions of the debug status. DR 7 series is used as a debugging control

448402 V. Description of the Invention (7) Register (je bug Control Register), which can be used to enable or disable the breakpoint function, and can be used to set breakpoint conditions. Each debug address register DR0 ~ DR3 has its own control bits in the debug control register DR7). For example, the value of the LEN bit in DR7 determines the access length of the breakpoint address When LEN = 〇〇, its bit length is one bit; when LEN = 〇l, its bit length is two bits, and when LEN = 1 j, its bit length is four bits. The value of R / w determines the cause of the breakpoint at the breakpoint address. When R / w = 〇〇 means instruction code access, R / w = 〇i means data writing, when R / w When it is 10, it means 1/0 read or write. When R / ff = ll, it means data read and write. The following will simultaneously refer to the architecture of the internal register group of the central processing unit shown in FIG. 2 and the control flowcharts shown in FIGS. 3 and 4 for a detailed description of the virus detection method of the present invention as follows. As shown in FIG. 7F, after the system is started, the present invention first designates a buffer in the memory of the computer system in step 丨 〇. Then in step 101, a debug extension bit (Debug Extent Ion) is set in the control register CR4 of the CPU. The purpose of this step is to set the third bit of the control register CR4 in the central processor to i, so as to start the round-trip breakpoint debug extension function. Then set the hexadecimal value data 1F7h & 17? H in two registers of the CPU's debug address register (DR0_DR3) (step 102). The value lF7h is the address of the first IDE hard disk status / command register (IDE c) registered in the computer system, and the value 177h is the second hard disk status / command temporary storage. Device position

Page 10 V. Description of Invention (8) Address. In step 103, a value of 10 is set in the R / W bit (read / write control bit) corresponding to the debug control register 控制 7 of the CPU, which means that when the CPU is executing When the wheel is in and out, the interrupt function is executed. In addition, in this step, a value of 00 is also set in the len bit (length bit) corresponding to the debug control register DR7 (its value represents the bit length value is! Bit). After completing the above-mentioned related register data setting, it is judged whether there is a debug status (Debug Exception) (step 104). Otherwise, if the detection is repeated, the debug status is generated. When it is, then execute step 105 (that is, the CPU executes the NT1 interrupt subroutine) to determine the status of the debug status register 卯 6 in the CPU. The debug status register DR6 can be used to temporarily store Status of the debug address register DR0_DR3. In step 105, determine the interruption point conditions (Breakp〇int is set to "Breakp〇int" if the port 10 addresses 1F7h and 177h in the debug status register DR6 of the CPU are set to "If not, the steps skip to Step n 丨 of four steps (described later), if it is', then proceed to the next step 1 06. In step 106, determine whether the instruction currently being executed by the central processing unit is? Is an output instruction for performing data transfer in f language ( OUT or OUTS). If not, go back to step 1 〇 04, if yes, go to the next step 1 007. Among them, the output instruction OUT is in the Gori people * 514 4 people π *, in the combination swulu instruction China is a simple input and output bounds ^ perform simple data transfer, the object of the data transfer is a 3? 47 ♦ = port in the transfer of data, it is through the general purpose register in the central processing unit (For example, the 8-bit register is the AL register) to transfer data from 4484 0 to 5 'Invention Description (9). The output of this instruction will be entered from the memory bit specified by the central location into the interface port. The instruction 0UTS is Temporarily store tuple data for the section in the character processor and output it to the string output Enter the interface instruction, register DS and index register si register DX, and specify the input in step 107, push the register u in step Λ, 10 or two steps: j two t central office: device General register # # — un + fly ° Hidden body DS: s address data (input and output port address ± ^ ^ 15 indirect addressing) whether it is 30h, 31h, or C5h, if not these If it is the preset value, go back to step 104. If it is just these preset values, proceed to step -10. The values of 3 G h and 3 1 h indicate the magnetic field written to the hard disk. Write Sector), and C5h is a table that does not write data to several multiple sectors (Write Multiple Sectors). The purpose of this step is to determine whether the action of writing data to the hard disk I is in the PI0 transmission mode. After the judgment in the foregoing steps, if the data of the register AL or DS: SI in the general register 10 is 30h, 31h, or C5h, a representative write hard disk device is set in step 108 The flag of CMITELSECTOR FLAG) is used for identification purposes. Refer to Figure 4, which is the continuation of the control flow in Figure 3. In step 109 ', the hexadecimal value data 1F0h and 7oh are set in the other two registers in the debug address register (DR0_DR3) of the ordering processor. The value 1 F 0 h is the address of the first [DE hard disk data register (H) E Data Register) connected in the computer system, and the value 170h is the second hard disk data temporary The address of the register. In step 110, set a value of 10 in the R / W bit (read / write control bit) of the corresponding R / W bit (read / write control bit) in the debug control register of the central processor (7 pairs 448402). Decay means that when the central processing unit executes the input and output, it will perform the interrupt function. In addition, in this step, a value of 00 is also set in the LEN bit (length bit) corresponding to the debug control register DR 7 (its value represents a bit length value of 1 bit). Then 'return to step 104 and continue to perform the debt measurement of the debugging status η in step 105' If it is judged that the CPU's debugging status register DR6 is the interruption point conditions corresponding to ports 0F7h and 177h (BreakpollU Cond iti on) is not set, then in step 1 1 1 1 it is further judged whether or not the Yin breakpoint conditions corresponding to the 10 port lFOh and 170h in the debug status register DR6 are set. If not, the procedure returns to step 104, and if so, proceed to the next step 112. In step 1 12 ', it is judged whether the aforementioned WRITE_SECTOR flag is set. The purpose of this step is to judge whether it is the normal pIO access mode (PIO Access Mode) or simply to access the data in the IDE data register. If it is determined that the WRITE_SECTOR flag is not set, return to step 104. If the WRITE_SECTOR flag written by the representative to the hard disk sector has been set (that is, it is indicated as P 10 transmission mode), step 3 will be executed at this time. In this step, the general temporary The 16-bit data of the register AX or the memory address DS: SI address is written into the memory buffer pointed to by the memory in the previous step 丨 〇〇. Then, it is determined in step 1 1 4 whether the entire magnetic sector (Sec tor) or block (Block) has been written. When the writing operation is completed ', the tfRITE_SECT〇R flag is cleared in step II5. 4 4 8 4 0 V. Description of the invention (π) = After the E_SE⑽ flag, the pre-stored known virus codes are compared and compared in step ιΐ6. If a matching pre-scanned virus code is found (step 117) , Bei 4 by Thunder brain 糸 0 disease 7 ... Tiandian Yuezhi system issued a warning (step 11 8), ..., warn the user. X applies the computer virus detection method of the present invention described above and cooperates with related control registers, debug address registers, debug address registers, debug status registers, etc. in the middle management unit. The present invention can effectively detect possible viruses that attempt to write to the IDE system of the IDE hard disk device in the computer system. To sum up, the computer virus detection method provided by the present invention does have a high industrial use value 'can achieve the expected effect' and has not disclosed the same or similar technology before the patent application, which has already accorded with the invention For the essentials of the patent, an application for an invention patent was filed in accordance with the law.

Page 14

Claims (1)

^ ^ 8 4 ϋ. —_S £ l_15_ (L3 Six application patents ®. An IDE hard disk device is set in the! ^^ pass mode method to detect whether the virus code is written to the disease of electricity ^ In the IDE hard disk device in square mode, the central processor is internally allocated with P0: carousel register, debug control register, and debug state register '# 海 virus detection method includes the following steps' a. Specify in the computer system's memory—buffer b. Start the CPU's I / O breakpoint debug extension function. c. Two of the CPU's debug address registers: Temporarily set the address of the IDE hard disk status / command temporary ^ connected to the computer system; " d. Set the CPU to generate an interrupt function when it executes input / output operations; e. Determine whether a debugging condition has occurred F. Determine whether the CPU's debug status register Yin corresponds to the breakpoint condition of the hard disk status / command register address of the ⑽ hard building device; g. Determine the CPU Whether the currently executed instruction is an output instruction to perform data transfer; h. Determine whether the action of writing data to the hard disk is in ρι〇 transmission mode; i. Set the IDE hard disk device connected to the computer system in the other two debug address registers of the edge CPU. The address of the hard disk data register; j. In the debug control register of the central processor, set the central processor to generate an interrupt function when it executes the input and output, and then return to the previous step on page 15 448402. 6. Apply for the patent scope e I to determine whether a debugging situation has occurred; in step f, if it is determined that the CPU's debugging status = sub, second, corresponding to the hard disk status / command temporary of the 1DE hard disk device # ^^ address breakpoint condition is not set, then continue to determine whether the breakpoint condition corresponding to the hard disk data temporarily stored in the 丨 DE hard disk I temporary storage address is set, if not Go to the foregoing step L to write the bit data of the profit register Aχ or the memory address DS: SI in the central processing H to the specified memory buffer t in the foregoing memory; m. After the block data is completely written, the pre-stored known virus mom 'is scanned and compared, and an alert is issued when a matching known virus code is found. 2 · If the scope of patent application is the first! Which IDE hard disk device is set in? {() Virus detection method in transmission mode, where step b is to set the third bit of the control register CR4 in the central processing unit to 1 to start the I / O breakpoint debug extension function. 3. As described in item 1 of the scope of patent application, the virus detection method of the IDE hard disk set in ροο transmission mode 'where step c is two of the temporary registers in the debug address register of the central processing unit. Set hexadecimal value data lF7h and 1 77h in the register, where the value iF7h is the address of the first IDE hard disk status / command register connected to the computer system, and the value 177h is the second Address of hard disk status / command register. 4. The IDE hard disk device described in item 1 of the patent application is set to p 丨 〇 Page 丨 6 L 448 4 υ 6. The method for detecting sickness and disease in Shenjing patent range wheel mode, wherein step d includes: dl. Set a value of 1 in the read / write control bit corresponding to the debug control register of the central processing unit. In order to start the central processor to generate an interrupt function when performing round in and out; d2. Set a value of 0 0 in the length setting bit corresponding to the debug control register, and the value represents the bit length value is 1 bit yuan. 5. The virus detection method in which the IDE hard disk device described in item 1 of the patent application is set to the p 10 transmission mode, wherein the data transfer output instruction in step g is 0UT / 0UTS. 6. The virus detection method of the IDE hard disk device set in the PI0 transmission mode as described in the first item of the patent application scope, wherein step h is to judge the general-purpose register AL or the memory DS: SI in the CPU. Whether the address data is a value written to one sector in the hard disk or a number of sectors. 7. The virus detection method in which the IDE hard disk device described in item 6 of the scope of patent application is set in the p 丨 〇 transmission mode, wherein the value of writing data to one of the magnetic disks in the hard disk is 30h. And 31h, and the value written to several magnetic zones is C5h. 8. The virus detection method in which the IDE hard disk device described in item 6 of the scope of the patent application is set to ρ [〇] transmission mode, wherein: 'If it is determined that the action of writing data to the hard disk device is in step h In the case of PI 〇 transmission mode, this step further includes setting a flag to write data to the hard disk sector; in step k, if it is judged that the central processing unit's debug status register The breakpoint on the address of page 17 of the patented patent document 范 Broken Disk Data Register corresponds to the [DE Hard Disk Device's Hard Drive—Check whether the flag condition has been set, and more Package ## Step; after step 1, it further includes clearing the flag = of: step. 9. The virus detection method of setting the iDE hard disk device in the transmission mode as described in item 1 of the scope of the patent application, wherein step 丨 is to set hexadecimal value data in the debug address register of the central processing unit. lFOh and 17 0 h 'where the value 1 F 0 h is the address of the first IDE hard disk data register connected in the computer system' and the value 17〇h is the second 1 0 = disk The address of the data register. The IDE hard disk device described in item 1 of the patent application is set to PI0: Virus detection method under the above formula, where after step 1, it also includes a judgment -fit 7Γ ^ 1 Steps for specifying entire sectors or blocks. Page 18