System to Bypass a Compromised Mass Storage Device Driver Stack and Method Thereof

• US 20130247186A1
• Filed: 03/15/2012
• Published: 09/19/2013
• Est. Priority Date: 03/15/2012
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: LeMasters, Aaron
• Granted Patent: US 9,275,229 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

A method to circumvent malicious software via a system configured to bypass a device driver stack and, consequently, also bypass the malicious software that may be adversely affecting the device driver stack by using an alternative stack such as a crash dump I/O stack. The crash dump I/O stack is poorly documented relative to the device driver stack and functions independently from the device driver stack.

Claims

1. A method to circumvent malicious software in a computing device, the method comprising:

identifying a dump port driver having a function;

transmitting at least one command configured to obtain information related to a physical hardware device, the physical hardware device (i) in communication with the computing device and (ii) configured to execute an I/O command; and

causing the function to be executed for transmission of the I/O command to the physical hardware device using the request block.

2. The method according to claim 1, wherein the physical hardware device includes a mass storage area.

3. The method according to claim 1, wherein the physical hardware device is a mass storage device, and the identification of the dump port driver includes searching a loaded module list for one of a plurality of names to identify the dump port driver for the mass storage device.

4. The method according to claim 3, wherein the one of the plurality of names contains a prefix.

5. The method according to claim 3, wherein the identification of the dump port driver includes verifying the identified dump port driver is correct by parsing an export table.

6. The method according to claim 1, wherein the physical hardware device is a mass storage device configured to contain debugging data for use during a critical system crash of the computing device.

7. The method according to claim 6, wherein the debugging data is core dump data.

8. The method according to claim 1, wherein the at least one command includes (i) a first command configured to obtain at least one of a target identification, path, and logical unit number, and (ii) a second command configured to obtain a hardware register.

9. The method according to claim 1, wherein the function is at least one of a start in/out function and a DispatchCrb function.

10. The method according to claim 1, further comprising:

allocating and initializing a memory space before execution of the function.

11. The method of claim 10, wherein,

the memory space is identified as a dump port device extension, and

the dump port device extension is discovered using an information leak.

12. The method of claim 10, wherein,

the memory space is identified as a dump port device extension, and

the dump port device extension is discovered by calling to a function of the dump port driver and receiving the dump port device extension address.

13. The method of claim 2, wherein the request block is initialized to specify a READ command.

14. The method of claim 2, wherein the request block is initialized to specify a WRITE command.

15. A method to circumvent malicious software in a computing device via a physical hardware device linked to a computing device, the method comprising:

identifying a dump port driver;

getting boot device information to enable transmission of an I/O command to a boot device;

determining an entry point for a function for transmitting the command to the physical hardware device;

instantiating and initializing a request block; and

causing the function to be executed for transmission of the command to the physical hardware device using the request block.

16. The method of claim 15, further comprising:

allocating and initializing a memory space before execution of the function.

17. The method of claim 16, wherein,

the memory space is identified as a dump port device extension, and

the dump port device extension is discovered using an information leak.

18. The method of claim 16, wherein,

the memory space is identified as a dump port device extension, and

the dump port device extension is discovered by (i) calling to a function of the dump port driver and (ii) receiving a dump port device extension address.

19. The method of claim 15, wherein,

the physical hardware device is a mass storage device, and

the request block is initialized to specify a READ command.

20. The method of claim 15, wherein,

the physical hardware device is a mass storage device, and

the request block is initialized to specify a WRITE command.

21. A system to command a physical hardware device in communication with a computing device, the system comprising:

a bypass command driver configured to identify a dump port driver, obtain boot device information, find a function, instantiate a request block, and call the function, the dump port driver in communication with the bypass command driver;

a computer program comprising the function, the function configured to transmit a command to the physical hardware device;

a mini port driver in communication with the dump port driver;

a bus driver in communication with the mini port driver and the dump port driver;

a hardware bus in communication with the bus driver; and

a physical hardware device in communication with the hardware bus,

wherein the request block is configured for use by the function in transmitting the command.

22. The system of claim 21, wherein the function is configured (i) for storage in the dump port driver and (ii) to transmit the command via the bus driver.

23. The system of claim 21, wherein the request block includes a CDB configured to be initialized with the command.

24. The system of claim 21, wherein the physical hardware device is a mass storage device and the command is a READ or a WRITE command.

25. The system of claim 21, wherein the physical hardware device is a boot device.

26. The system of claim 21, further comprising:

a memory space to send or receive data transferred as a result of execution of the command.

27. A bypass command driver configured to cause data transfer in a computer system having a physical hardware device or an object representing the physical hardware device by (i) identifying a dump port driver in communication with the computer system and (ii) obtaining boot device information, the computer system having (i) a computer program capable of transmitting a command to the physical hardware device, (ii) a mini port driver in communication with the dump port driver, (iii) a bus driver in communication with the mini port driver and/or the dump port driver, and (iv) a hardware bus in communication with the bus driver, the bypass command driver comprising:

a set of instructions configured to be executed by the computer system.