Methods and apparatus for defeating malware

• US 20080120499A1
• Filed: 11/16/2006
• Published: 05/22/2008
• Est. Priority Date: 11/16/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Long, Qin
• Granted Patent: US 7,689,817 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A data processing system supports a virtualization enabled (VE) operating mode. An operating system (OS) is launched during a boot process. However, a trap agent is launched before the OS is launched. The trap agent may intercept an attempt to transition the data processing system to virtual machine (VM) operating mode. In response to intercepting the attempt to transition the data processing system to VM operating mode, the trap agent may automatically determine whether the program that requested the transition is an authorized program. If the program is not authorized, the trap agent may prevent the program from transitioning the data processing system to VM operating mode. In one embodiment, the trap agent is launched before the data processing system selects a boot device. In another embodiment, the trap agent is launched before executing any code from any third-party option ROMs. Other embodiments are described and claimed.

Claims

1. A method for protecting a data processing system, the method comprising:

launching an operating system (OS) during a boot process in a data processing system that supports a virtualization enabled (VE) operating mode;

before launching the OS, launching a trap agent;

with the trap agent, intercepting an attempt to transition the data processing system to virtual machine (VM) operating mode; and

in response to intercepting the attempt to transition the data processing system to VM operating mode, automatically determining whether a program that requested the transition is an authorized program.

2. A method according to claim 1, further comprising:

preventing the program from transitioning the data processing system to VM operating mode if the program is not authorized.

3. A method according to claim 1, comprising:

selecting a boot device for loading the OS; and

launching the trap agent before selecting the boot device.

4. A method according to claim 1, comprising:

launching the trap agent before handing off to an OS loader.

5. A method according to claim 1, comprising:

launching the trap agent before executing any code from any third-party option memories in the data processing system.

6. A method according to claim 1, wherein the data processing system comprises a processor provided by a processor manufacturer and assembled with other components to produce the data processing system by a system manufacturer, the method comprising:

launching the trap agent before executing any code provided by any entity other than the processor manufacturer or the system manufacturer.

7. A method according to claim 1, comprising:

executing the trap agent with the processor in a virtualization enabled (VE) mode.

8. A method according to claim 1, further comprising:

terminating the trap agent if the program is authorized; and

allowing the program to transition the data processing system to VM operating mode.

9. A method according to claim 1, further comprising:

after launching the trap agent, allowing instructions that do not pertain to virtualization to be executed without interference from the trap agent.

10. An apparatus comprising:

a machine-accessible medium; and

instructions in the machine-accessible medium, wherein the instructions, when executed by a data processing system that supports a virtualization enabled (VE) operating mode, cause the data processing system to perform operations comprising;

launching an operating system (OS) during a boot process in the data processing system;

before launching the OS, launching a trap agent;

with the trap agent, intercepting an attempt to transition the data processing system to virtual machine (VM) operating mode; and

in response to intercepting the attempt to transition the data processing system to VM operating mode, automatically determining whether a program that requested the transition is an authorized program.

11. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform further operations comprising:

preventing the program from transitioning the data processing system to VM operating mode if the program is not authorized.

12. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform operations comprising:

selecting a boot device for loading the OS; and

launching the trap agent before selecting the boot device.

13. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before handing off to an OS loader.

14. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before executing any code from any third-party option memories in the data processing system.

15. An apparatus according to claim 10, wherein the data processing system comprises a processor provided by a processor manufacturer and assembled with other components to produce the data processing system by a system manufacturer, and wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before executing any code provided by any entity other than the processor manufacturer or the system manufacturer.

16. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform operations comprising:

executing the trap agent with the processor in a virtualization enabled (VE) mode.

17. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform further operations comprising:

terminating the trap agent if the program is authorized; and

allowing the program to transition the data processing system to VM operating mode.

18. An apparatus according to claim 10, wherein the instructions cause the data processing system to perform operations comprising:

after launching the trap agent, allowing instructions that do not pertain to virtualization to be executed without interference from the trap agent.

19. A data processing system comprising:

a processing unit that supports a virtualization enabled (VE) operating mode;

non-volatile storage in communication with the processing unit;

system read-only memory (ROM) in communication with the processing unit; and

instructions in the system ROM, wherein the instructions, when executed, cause the data processing system to perform operations comprising;

launching a trap agent before launching an operating system (OS) during a boot process in the data processing system;

with the trap agent, intercepting an attempt to transition the data processing system to virtual machine (VM) operating mode; and

in response to intercepting the attempt to transition the data processing system to VM operating mode, automatically determining whether a program that requested the transition is an authorized program.

20. A data processing system according to claim 19, wherein the instructions in the system ROM comprise the trap agent.

21. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform further operations comprising:

preventing the program from transitioning the data processing system to VM operating mode if the program is not authorized.

22. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

selecting a boot device for loading the OS; and

launching the trap agent before selecting the boot device.

23. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before handing off to an OS loader.

24. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before executing any code from any third-party option memories in the data processing system.

25. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

launching the trap agent before executing any code provided by any entity other than a processor manufacturer for the processor or a system manufacturer for the data processing system.

26. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

executing the trap agent with the processor in a virtualization enabled (VE) mode.

27. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform further operations comprising:

terminating the trap agent if the program is authorized; and

allowing the program to transition the data processing system to VM operating mode.

28. A data processing system according to claim 19, wherein the instructions cause the data processing system to perform operations comprising:

after launching the trap agent, allowing instructions that do not pertain to virtualization to be executed without interference from the trap agent.