FILE MANIPULATION DURING EARLY BOOT TIME

• US 20080046709A1
• Filed: 08/18/2006
• Published: 02/21/2008
• Est. Priority Date: 08/18/2006
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Wang, Min
• Granted Patent: US 7,769,992 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/4403 Processor initialisation

Abstract

A system and method for enabling access to user-level data is described. One embodiment includes accessing user-level data associated with a kernel-level function using a portable executable (PE) file. The user-level data is accessed during a boot-time of a computer. In this embodiment, the PE file is also accessed using the computer.

Claims

1. A method, comprising:

accessing a user-level portable executable (PE) file; and

modifying a boot loader registry of a computer during an installation period to include a reference to the user-level PE file, the reference is used by an operating system (OS) during an early boot-time to image the PE file into a memory as a boot-file.

2. The method of claim 1, accessing the user-level PE file using at least one of a driver PE file, non-driver PE file, or a dummy PE file.

3. The method of claim 1, further comprising accessing user-level data associated with a kernel-level during the early boot-time, the user-level data being included in the user-level PE file.

4. The method of claim 3, wherein the user-level data is associated with an index that is associated with a kernel-level function.

5. The method of claim 1, wherein at least one of a portion of user-level data from the user-level PE file or user-level data associated with the user-level PE file is stored in a location that can be accessed by a pestware monitor.

6. The method of claim 1, wherein the user-level PE file is at least one of a dynamic link library file, an executable file, or an object file.

7. The method of claim 1, further comprising modifying the boot loader registry during the installation period to include a reference to a driver PE file, the reference to the driver PE file is used by the OS during the early boot-time to image the driver PE file into the memory,

the driver PE file is configured to access user-level data associated with a kernel-level and associated with the user-level PE file.

8. A method, comprising:

accessing, during a boot-time of a computer, a user-level data associated with a kernel-level function using a portable executable (PE) file; and

accessing the PE file using the computer.

9. The method of claim 8, wherein the user-level data is associated with at least a portion of an index.

10. The method of claim 8, wherein the boot-time is an early boot-time.

11. The method of claim 8, wherein the PE file is loaded into a memory during the boot-time as a boot-file.

12. The method of claim 8, wherein the PE file is a first PE file, the accessing the user-level data includes accessing from a second PE file using the first PE file.

13. The method of claim 8, wherein the PE file is a first PE file, a second PE file that is loaded during the boot-time is linked to the first PE file.

14. The method of claim 8, wherein the PE file is a first PE file, the first PE file is configured to patch a second PE file.

15. The method of claim 8, further comprising:

modifying a boot loader registry during an installation period to include a reference to the PE file, the reference is used by an operating system (OS) during the boot-time to image the PE file into a memory.

16. The method of claim 8, wherein the PE file is a first PE file loaded into a memory during the boot-time, the first PE file is loaded before a second PE file containing the user-level data is loaded into the memory during the boot-time.

17. The method of claim 8, wherein the PE file is loaded into a memory during the boot-time at a first time, the PE file includes an instruction that prevents an operating system fault at a second time, the second time is after the first time.

18. The method of claim 8, wherein the PE file is configured to write data associated with at least a portion of the user-level data to a location that can be accessed by a pestware monitor.

19. The method of claim 8, wherein the retrieving the index includes retrieving an address, the kernel-level function is an application program interface (API).

20. The method of claim 8, wherein the PE file is at least one of an index-containing PE file or a dummy driver.

21. The method of claim 8, wherein the PE file is at least one of an NTDLL.DLL file or a dummy kernel-mode DLL file.

22. A method, comprising:

accessing at least a portion of a user-level index associated with a kernel-level function during an early boot-time of a computer; and

processing the portion of the index using the computer.

23. The method of claim 22, wherein the processing includes transmitting the portion of the user-level index to a location that can be accessed by a pestware monitor.

24. The method of claim 22, wherein the user-level index is a file with a structure that is substantially similar to that of a PE file.

25. The method of claim 22, wherein the processing includes processing the portion of the user-level index so that user-level data associated with the user-level index can be accessed by a pestware monitor.

26. The method of claim 22, wherein the processing includes processing the portion of the user-level index so that user-level data associated with the user-level index can be accessed by a pestware monitor, the pestware monitor is at least one of a kernel-level monitor or a user-level monitor.

27. The method of claim 22, further comprising modifying a boot loader registry during an installation period so that the portion of the user-level index can be accessed.

28. The method of claim 22, wherein the accessing includes accessing using at least one portable executable (PE) file.