WO2014048367A1

WO2014048367A1 - Method and apparatus for processing malicious program in master boot record

Info

Publication number: WO2014048367A1
Application number: PCT/CN2013/084467
Authority: WO
Inventors: 邵坚磊
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2012-09-29
Filing date: 2013-09-27
Publication date: 2014-04-03

Abstract

Disclosed are a method and an apparatus for processing a malicious program in a master boot record. The method comprises: in a procedure of starting an operating system, and during kernel initialization, loading a safe driver; invoking the safe driver after the completion of hardware initialization; after the safe driver is invoked, monitoring a read operation on a magnetic disk through the safe driver; when it is monitored that the read/write operation is performed on the magnetic disk, detecting read/written data, and if it is detected that the read/written data comprises malicious codes, returning disk reading failure information, so as to block the correlation between the malicious program in the master boot record and a malicious driver in a magnetic disk partition. The present invention can effectively prevent the malicious program in the master boot record from damaging the computer.

Description

Method and device for processing host boot record malicious program

The present invention relates to the field of computer security technologies, and in particular, to a method and apparatus for processing a master boot record malicious program. Background technique

The master boot record (MBR) of the disk is located on the 0 head of the disk. 0 sector 1 sector. There is a fixed size storage area, which is the first area read by the computer after accessing the disk. The master boot record typically consists of three parts: the main boot program, the disk partition table, and the end flag word. Among them, the main boot program is used to check whether the partition table is correct when the computer starts, and hand over control to the system boot program on the disk after the system hardware completes the self-test. The main boot program in the MBR has independence from the operating system. This independence is reflected in the startup process of the computer: The general calculation startup process is to perform a self-test after the computer is powered on, and when it is determined that the disk is used as the startup source, the basic The input/output system reads the MBR into the memory, and the control is given to the main boot program. The master boot program checks the partition table, finds the active partition, and then passes control to the system boot program of the active partition, which is loaded by the system boot program. operating system. The loading of the main bootloader and the loading of the operating system are two relatively independent processes throughout the process, so the main bootloader in the MBR has independence from the operating system, that is, the main bootloader in the MBR is loaded before the operating system. And does not depend on, nor belongs to the operating system.

Because of the independence of the main boot program in the MBR relative to the operating system, the MBR area has become the object of some malicious programs, and the "ghost" virus is the representative. The virus is hosted in the master boot record of the disk, can be booted before the computer is booted, and can cause the infected computer to load another malicious driver B that has been carefully hidden at system startup. The malicious driver B succeeds. After loading, it will implement operations such as shutting down anti-virus software and downloading other malicious programs to achieve theft of user information and damage to the user's computer. Since the virus is hosted in the disk master boot record, after the successful operation, usually no exception is found in the operating system, and since the disk's master boot record is usually not rewritten due to reinstallation, the virus can even Still exists after the user reinstalls the operating system, and still works after the computer is started, visible The degree of stubbornness of the virus. Therefore, the technical problem that is urgently needed by those skilled in the art is how to effectively prevent such malicious programs from damaging the computer system. Summary of the invention

In view of the above problems, the present invention has been made in order to provide a method for processing a master boot record malicious program that overcomes the above problems or at least partially solves the above problems, and a corresponding apparatus for processing a master boot record malicious program.

According to an aspect of the present invention, a method for processing a master boot record malicious program is provided, including:

During the startup of the operating system, when the kernel is initialized, the secure driver is loaded;

Calling the secure driver after the hard disk initialization is completed;

Monitoring the read operation of the disk by the secure driver;

When the read/write operation to the disk is detected, the read/write data is detected. If it is detected that the read/write data contains malicious code, the return disk read fails to block The link between a malicious program in the master boot record and a malicious driver in the disk partition.

Optionally, when the kernel is initialized during the startup of the operating system, loading the security driver includes:

The security driver is registered as a system reservation type in the operating system's registry so that the operating system loads the security driver during kernel initialization during startup.

Optionally, the invoking the secure driver after the hard disk initialization is completed includes: when the secure driver is loaded, registering a callback function with the system, so that the secure driver is invoked by the operating system after the hard disk initialization ends .

Optionally, the method further includes:

Clearing malicious programs in the master boot record.

Optionally, the clearing the malicious program in the master boot record comprises: reconstructing a master boot record.

Optionally, the method further includes:

Delete the malicious driver in the disk partition.

According to another aspect of the present invention, an apparatus for processing a master boot record malicious program is provided, including: a loading unit, configured to load a security driver during kernel initialization during startup of the operating system;

a calling unit, configured to invoke the secure driver after the hard disk initialization is completed; and a monitoring unit, configured to monitor, by the secure driver, a read operation of the disk;

a detecting unit, configured to detect read/write data when a read/write operation to the disk is detected, and if the detected read/write data includes malicious code, return to the disk to read Failed to block the connection between the malicious program in the master boot record and the malicious driver in the disk partition.

Optionally, the loading unit includes:

A registry write unit that registers a secure driver as a system reservation type in the operating system's registry so that the operating system loads the secure driver during kernel initialization during startup.

Optionally, the calling unit includes:

A callback function registration unit is configured to register a callback function with the system when the secure driver is loaded, so that the secure driver is called by the operating system after the hard disk initialization is completed.

Optionally, the method further includes:

A clearing unit, configured to clear a malicious program in the master boot record.

Optionally, the clearing unit includes:

Rebuild subunit for rebuilding the master boot record.

Optionally, the method further includes:

A delete unit is used to delete a malicious driver in the disk partition.

According to another aspect of the present invention, there is provided an apparatus for processing a master boot record malicious program, comprising the apparatus for processing a master boot record malicious program according to any of the preceding claims.

According to a specific embodiment provided by the present invention, the present invention discloses the following technical effects: The method and apparatus for processing a master boot record malicious program according to the present invention may be capable of initializing MBR, B00TL0ADER, B00TMGR, etc. in an early stage of system startup After that, when the system initializes the kernel, the security driver is loaded, and then the H00K system reads and writes the disk. When the read sector contains malicious code, the return fails, so that the malicious driver cannot be loaded, completely cut off. MBR and the connection with the malicious driver System, the MBR malicious program is completely invalid, and then the residual MBR virion can be easily handled, effectively preventing the damage of such malicious programs to the computer system.

The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below. DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not intended to limit the invention. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 shows a flow chart of a method in accordance with one embodiment of the present invention; and FIG. 2 shows a schematic diagram of an apparatus in accordance with one embodiment of the present invention. detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the exemplary embodiments of the present invention are shown in the drawings, it is understood that the present invention may be embodied in various forms and not limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be more fully understood, and the scope of the disclosure can be fully disclosed to those skilled in the art.

Referring to FIG. 1, a method for processing a master boot record malicious program according to an embodiment of the present invention includes the following steps:

S101: When the kernel is initialized during the startup of the operating system, the security driver is loaded;

In modern operating systems, applications do not have direct access to the hardware, but rather use hardware by calling interfaces provided by the operating system, which rely on kernel space to manage and schedule these applications. The kernel space consists of four major parts: process management (responsible for allocating CPU time), file access (provisioning the device into a file system, and providing a consistent interface for upper-level program calls), security control (responsible for mandatory processes) Specific permissions and separate memory ranges to avoid conflicts between processes) and memory management (responsible for the allocation, use, release, and reclamation of memory resources while the process is running). The kernel is A data structure, Rootki t technology hides the process, files, network communication and other related information of other programs (such as the registry and system logs that may be generated by modification) by modifying the data structure of the kernel.

Bootki t is a more advanced Rootki t. Bootki t bypasses kernel checking and starts stealth by infecting MBR (Master Boot Record). Bootki t is an MBR-based Rootki t. It can be considered that all technologies that load and implement kernel hijacking earlier than the Windows kernel at startup can be called Bootki t, such as later BIOS Rootki t, VBootki t, SMM Rootki t and so on. Since the MBR virus (MBR BOOTKIT) is parasitic in the MBR, the virus release driver can destroy most security tools and system aids. When the system restarts again, the virus program will load earlier than the operating system kernel.

In order to be able to combat this MBR virus, it is necessary to load the security driver before the MBR virus loads the malicious driver. In order to achieve the goal, in the embodiment of the present invention, the security driver can be loaded before the hard disk drive is initialized. When the MBR, BOOTLOADER, BOOTMGR, etc. are initialized, the system initializes the NT KERNEL. The secure driver is loaded in order to get executed before the malicious driver in the MBR area is loaded.

Among them, BOOTLOADER is a system boot program that runs before the operating system kernel runs. Through this system boot program, you can initialize the hardware device and establish a memory space map to bring the system's hardware and software environment to a suitable state, in order to prepare the correct environment for the final call of the operating system kernel. In an embedded system, there is usually no firmware program like the BIOS (Basic Input Output System) (some embedded CPUs also embed a short startup program), so the entire system is loaded and started. The task is completely done by the BootLoader. BOOTMGR is an acronym for Boot Manager. It is a boot manager used in Windows Vi sta and Windows 7, similar functions, as well as a boot manager in Windows XP, NTLDR, and so on. NT KERNEL is the system kernel.

Take the Windows system as an example. Under normal circumstances, the boot process of the computer system is: Power on self-test 1. The motherboard BIOS starts from the floppy disk, hard disk or CD-ROM drive according to the boot sequence specified by the user. The system BIOS reads the master boot record MBR. Memory> Control is given to the main boot program.> The main boot program checks the status of the partition table, looking for the active partition.> The main boot program passes control to the boot record of the active partition, and the boot record is loaded. System startup file.

It can be seen from the above that the MBR is powered on by the computer. After the self-test of the motherboard is completed, the first read position is located at the 0 head of the hard disk, and the size of the disk is 512 bytes. It does not belong to any operation. The system cannot be read by the disk operation commands provided by the operating system.

When the computer is powered on, the BIOS program is first started. After the BIOS self-test is completed, the main boot record MBR on the hard disk is found. The MBR reads the DPT (Disk Partition Table), finds the active primary partition, and then finds the active primary partition. Read the PBR (Partition Boot Record) of the active primary partition, and the PBR searches for the boot manager file B00TMGR in the partition. After the BOOTMGR is found, the control is given to the BOOTMGR. BOOTMGR reads the \B00T\BCD file (BCD=Boot Configuration Data, startup configuration data). If there are multiple operating systems and the waiting time for selecting the operating system is not 0, then the operating system selection will be displayed on the display. interface. If you choose to start Windows 7, BOOTMGR will go to the boot disk to find WIND0WS\system32\winload.exe, and then use the winload.exe to load the Windows7 kernel, thus booting the entire Windows7 system. In short, in the Windows 7 operating system, this process can be summarized as follows: BIOS-->MBR-->DPT-->PBR-->BOOTMGR-->BCD--> Winload. exe--> kernel loading- -> The entire windows7 system. After the kernel is loaded, the entire _{W indows7} system boot, the kernel needs to be initialized, and initializes the hard disk, while in the embodiment of the present invention, that is part of the kernel initialization, the driver is loaded safety.

In the specific implementation, in order to ensure that during the process of starting the operating system, when the kernel is initialized, the security driver is loaded, and the security driver can be registered as the system reservation type in the registry of the operating system (that is, registered as system reserved). This allows the system to load the secure driver as early as possible. In addition, the system that comes with the simple file reading and writing system inside the system has already read the file into the memory through INT13 in real mode, and then accesses it in protected mode. So the system will automatically load the driver with BOOT TYPE 0 in the registry into memory without having to go through disk drive and file drive.

S102: calling the security driver after the hard disk initialization ends;

After the secure driver is loaded, the security driver needs to be called by the operating program to perform the related operations and play a real role. For this reason, when the security driver is loaded, the callback function can be registered with the system, so that After the hard drive initialization is complete, the operating system immediately calls the secure driver, allowing the secure driver to run immediately.

The reason why the callback function is registered with the system is because the secure driver needs to hook up the operation of the hard disk drive, but the operation must be performed after the hard disk drive is initialized, so it is necessary to register a callback function to the system so that the hard disk drive is initialized. , the security driver can get the execution in time.

S103: monitoring, by the secure driver, a read/write operation of the disk after the secure driver is called;

Once the secure driver is executed, it can monitor the read operation of the disk. Since the malicious program in the MBR area wants to contact the malicious driver in the disk partition, it needs to read the malicious driver code in the disk partition into the memory, thereby loading the malicious driver in the disk partition. In the process of reading into the memory, the disk needs to be read. On the other hand, the security driver in the embodiment of the present invention is loaded earlier than the malicious driver, and therefore, the malicious program reads and writes to the disk. It can be monitored by the secure driver. In the specific implementation, the H00K disk drive read and write related operations can be used to monitor the disk read and write operations.

S104: When the read/write operation to the disk is detected, the read/write data is detected, and if the read/write data is detected to contain malicious code, the returning disk fails to be read. To block the connection between a malicious program in the master boot record and a malicious driver in the disk partition.

After monitoring the disk read operation, the security driver can intercept the read data and perform security detection. If it finds that the read data contains malicious code, it proves that the malicious program in the MBR area may be Read the malicious driver code on the disk, so you can directly return to the disk to read the failure, so that the malicious driver code can not be read into the memory, it can not run, and then, can block malicious programs and disks in the MBR The connection between the malicious drivers in the partition, after the connection between the two is blocked, the malicious programs and malicious drivers in the MBR will not cause any harm to the user's computer even if they still exist. For example, ghost 5, when reading a disk sector, will verify a certain feature code. If it matches, it will think that the code of the malicious driver is read, so that the code will be executed. By modifying these, let it think that it has not been read. Skip, avoid running malicious code. For the related implementation of detecting whether there is a malicious code in the data to be read, refer to the method in the prior art, and details are not described herein again. Of course, in order to further ensure the security of the user's computer, after blocking the connection between the malicious program in the MBR and the malicious driver on the disk, the malicious program in the MBR can also be cleared, and in addition, the disk partition can be Malicious driver removed. Among them, the malicious driver is saved on the disk, so it can be deleted directly through the disk operation command. However, the malicious program in the MBR is located in the MBR. Since the MBR is located on the 0 head of the hard disk, the sector 1 is 512 bytes. It does not belong to any operating system, nor can it use the disk operation commands provided by the operating system. Read, therefore, when the malicious program in the MBR is cleared, it can be implemented by rebuilding the MBR or the like. Among them, regarding how to perform MBR reconstruction, an existing application for MBR reconstruction can be called. In a specific implementation, the default MBR of the system can be written into the MBR area or the system command FDISK /MBRo to restore the MBR area by using the program in the embodiment of the present invention.

In short, since the malicious program in the MBR is executed after the MBR is executed, it will mount INT13, when loading B00TMGR, perform H00K, and when loading NT KERNEL, perform H00K, and then load its own malicious driver code to complete Self-protection. For example, a malicious program in the MBR will mount the underlying driver ATAPI.SYS and the file system driver NTFS.SYS, which causes the security program to fail to obtain the information of the original disk file or obtain the original MBR information. The false information redirected, that is, after the malicious driver is loaded, it is difficult for the security program to detect and clear it.

Therefore, in the early stage of system startup, after the initialization of the MBR, B00TL0ADER, B00TMGR, etc., the system loads the security driver when the NT KERNEL is initialized, and then the H00K system reads and writes the disk operation. When the read sector contains malicious code, the return fails, so that the malicious driver can not be loaded, completely cut off the connection between the MBR and the malicious driver, completely invalidating the MBR malicious program, and thus can easily handle the residual MBR virion.

The device for processing the malicious program of the master boot record is provided in the embodiment of the present invention. The embodiment of the present invention further provides a device for processing the malicious program of the master boot record. Referring to FIG. 2, the device may specifically include:

The loading unit 201 is configured to load a security driver when the kernel is initialized during the startup of the operating system;

The calling unit 202 is configured to invoke the secure driver after the hard disk initialization is completed; and the monitoring unit 203 is configured to perform a read/write operation on the disk by the secure driver after the secure driver is called. monitor; The detecting unit 204 is configured to detect read/write data when the read/write operation of the disk is detected, and return to the disk if it is detected that the read/write data contains malicious code The read failed to block the connection between the malicious program in the master boot record and the malicious driver in the disk partition.

In a specific implementation, the loading unit 201 may include:

The calling unit 202 can include:

In order to further ensure the security of the user's computer, after blocking the connection between the malicious program in the MBR and the malicious driver on the disk, the malicious program in the MBR can also be cleared. In this case, the device may further include:

Since the MBR is located on the hard disk's 0 head 0 track 1 sector, its size is 512 bytes, it does not belong to any operating system, and it cannot be read by the disk operation command provided by the operating system. Therefore, the malicious in the MBR When the program is cleared, it can be implemented by rebuilding the MBR, etc., correspondingly, the clearing unit includes:

Rebuild subunit for rebuilding the master boot record.

In addition, in order to further ensure the security of the user computer, the device may further include: a deleting unit, configured to delete the malicious driver in the disk partition.

Since the malicious driver is saved in the disk partition, the malicious driver code in the disk partition can be deleted using the disk operation command.

In summary, in the foregoing apparatus provided by the embodiment of the present invention, after the MBR, B00TL0ADER, B00TMGR, etc. are initialized in the early stage of system startup, the system loads the security driver when the kernel is initialized, and then the H00K system reads and writes the disk. Operation, when the read sector contains malicious code, the return fails, so that the malicious driver can not be loaded, completely cut off the connection between the MBR and the malicious driver, completely invalidating the MBR malicious program, and thus can be easily The residual MBR virion is treated.

In addition, the embodiment of the present invention further provides a method for performing a master boot record malicious program. The device needs to be described. In the specific implementation, for the device that processes the malicious program of the master boot record, the device can effectively block the MBR through the CPU, the memory, the hard disk, and other related parts, the BIOS, and the like. The destruction of computer systems by malicious programs in the area.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the present invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of the specification.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. The method disclosed is not to be interpreted as reflecting the invention as claimed. The claimed invention is claimed to have more features than those specifically recited in the appended claims. Rather, as the following claims reflect, inventive aspects lie in less than all features of the single embodiments disclosed above. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by the same, equivalent or similar purpose, unless stated otherwise. Features instead.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are not included in other embodiments, and other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some of some or all of the components of the device for processing a master boot record malicious program in accordance with an embodiment of the present invention. Or all features. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present invention may be stored on a computer readable medium or may have the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to limit the invention, and that alternative embodiments can be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of elements or steps that are not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

Rights request

1. A method for processing malicious programs in the master boot record, including:

During the process of starting the operating system, the security driver is loaded during kernel initialization;

Call the security driver after the hard disk initialization is completed;

Monitor disk read operations through the security driver;

When it is monitored that the read/write operation of the disk occurs, the read/written data is detected. If it is detected that the read/written data contains malicious code, a disk read failure is returned to prevent Break the link between malicious programs in the master boot record and malicious drivers in disk partitions.

2. The method according to claim 1, wherein during kernel initialization during the booting of the operating system, loading the security driver includes:

Register the security driver as a system reserved type in the operating system's registry so that the operating system can load the security driver during kernel initialization during startup.

3. The method according to claim 1 or 2, wherein calling the security driver after hard disk initialization includes:

When the security driver is loaded, a callback function is registered with the system so that the security driver is called by the operating system after the hard disk initialization is completed.

4. The method according to claim 1 or 2, further comprising:

Remove malicious programs from the master boot record.

5. The method of claim 4, wherein removing malicious programs in the master boot record includes:

Rebuild the master boot record.

6. The method according to claim 1 or 2, further comprising:

Delete malicious drivers from the disk partition.

7. A device for processing master boot record malicious programs, including:

The loading unit is used to load the security driver during kernel initialization during the startup of the operating system;

The calling unit is used to call the security driver after the hard disk initialization is completed; the monitoring unit is used to monitor the reading operation of the disk through the security driver; The detection unit is used to detect the read/write data when the read/write operation of the disk is monitored. If it is detected that the read/written data contains malicious code, return to the disk read operation. to block the connection between a malicious program in the master boot record and a malicious driver in a disk partition.

8. The device according to claim 7, the loading unit includes:

The registry writing unit is used to register the security driver as a system reserved type in the operating system's registry, so that the operating system can load the security driver during kernel initialization during startup.

9. The device according to claim 7 or 8, the calling unit includes: a callback function registration unit, configured to register a callback function with the system when the security driver is loaded, so that after the hard disk initialization is completed, the The security driver is called by the operating system.

10. The device according to claim 7 or 8, further comprising:

A cleaning unit, configured to clear malicious programs in the master boot record.

11. The device according to claim 10, the cleaning unit includes:

Rebuild subunit, used to rebuild the master boot record.

12. The device according to claim 7 or 8, further comprising:

The deletion unit is used to delete malicious drivers in the disk partition.

13. A device for processing a master boot record malicious program, including the device for processing a master boot record malicious program according to any one of claims 7 to 12.

14. A computer program, comprising computer readable code, when the computer readable code is run on a server, causing the server to execute the master boot record malicious program according to any one of claims 1-6 The method of processing.

15. A computer-readable medium in which the method for processing a master boot record malicious program as described in any one of claims 1-6 is stored.