CN1121012C - How to protect BIOS from being damaged by viruses - Google Patents

Abstract

The present invention relates to a method for protecting BIOS from being damaged by viruses. It mainly utilizes the necessary signal when a flash memory is written to generate a system management interrupt (SMI). Therefore, when the BIOS stored in the flash memory has a writing action, the SMI handler routine of the BIOS can prevent viruses. The method first connects the necessary signal sent by the flash memory to the SMI event source input pin of the computer chipset, so that the chipset can generate the corresponding SMI# to the CPU of the computer. When the CPU receives SMI#, it can check whether the BIOS stored in the flash memory has been written through the SMI handler routine of the BIOS. If the judgment result is that the virus has invaded, the writing is prohibited.

Description

How to protect BIOS from being damaged by viruses

The invention relates to a method for protecting computer firmware, in particular to a method for preventing computer BIOS (basic input/output system) from being damaged by viruses.

One of the most critical components in a computer system is firmware for booting, namely the BIOS, which is generally stored in a non-volatile memory. BIOS is an executable code (executable code) that enables the CPU to perform operations such as initialization (initialization), loading the kernel (kernel) of the operating system from the main memory, and routine I/O (input/output, input/output) function etc.

When the power is turned on, the CPU uses the instruction codes stored in the BIOS to start the computer. The BIOS must have two conflicting requirements at the same time, that is, (1) the BIOS must be well protected, because if the BIOS is modified or destroyed, the entire system will not be able to boot; (2) the BIOS must be easily modified, so that Allows the version to add improved features or bug-fixed update (update) actions.

Usually BIOS can be written in EPPOM (erasable programmable read-only memory, erasable programmable read-only memory). EPPOM has the advantage that it cannot be modified by current. To modify the content stored in EPPOM, EPPOM must be removed from the slot first. Then it can be realized by ultraviolet radiation for a long time. Therefore, the BIOS written in the EPPOM can be free from computer viruses. But on the other hand, the BIOS stored in the EPPOM cannot be updated at any time. Recently, due to the continuous innovation of the computer system structure, whether the BIOS can be updated at any time has become very important. Therefore, the current BIOS firmware mostly uses flash memory (flash memory). However, because it is easy to modify, the BIOS flash memory is easily damaged by computer viruses, and once it is infected by viruses, it will cause quite serious consequences. In a typical computer virus invasion, the virus code will execute a code sequence (code sequence) to modify the BIOS content. Once the BIOS is improperly modified, the infected executable code will further spread to other areas of the BIOS code or the core of the operating system. Moreover, because the BIOS is the first program executed after the computer system is turned on, before any system or network anti-virus software is started, it is more difficult to detect and remove viruses that mainly infringe on the BIOS. Evade scanning by antivirus software, making it impossible to know its existence.

The existing protection of BIOS can be roughly divided into two methods: (1) using hardware (H/W) protection, that is, using jumper (jump wire) or GPIO (General Purpose I/O, general-purpose input/output) to control the fast The input signal of the flash memory Vcc 12V to prevent the flash memory from being written. Although this method has a good protection effect, it is not convenient to operate. The disadvantage is that the prevention and response to viruses is a bit negative; (2) software (S/W) protection is used, and the common method is S/W protection. , do not support above-mentioned H/W protection for some flash memory, can directly carry out anti-virus with the mode of next group of order (command) to flash memory. However, the disadvantage of this method is that this group of commands is one of the specifications made by the flash memory, so it is easy to be deprotected by viruses in software, such as CIH virus, which can break this software protection.

Therefore, the object of the present invention is to propose a method for protecting BIOS from being damaged by viruses, which utilizes the necessary signal to generate SMI (system management interrupt, system management interrupt) when the flash memory is written, so when stored in the flash memory When there is a write action in the BIOS, the SMI handler routine (handler routine) of the BIOS can be used to prevent viruses.

According to the method for protecting BIOS from being damaged by viruses provided by the purpose of the above invention, it forms communication with the SMI event source input pin of the chipset by storing the flash memory of the BIOS, so as to prevent viruses from being written into the flash memory. The steps at least include: (a) execute the relevant BIOS settings to match the necessary signal WE# from the flash memory; (b) the computer CPU receives the SMI signal sent by the chipset; (c) check the SMI to the SMI handler routine of the BIOS source; (d) determining that the source of the SMI is that the flash memory is written by a virus; and (e) prohibiting the writing of the virus. Wherein the step (a) also includes: (a1) executing the POST when the BIOS starts; (a2) initializing the SMIhandler routine; (a3) performing related settings on the chipset, so that the chipset can generate an SMI signal when the flash memory is written. ; (a4) setting the I/O trap SMI function to prevent the virus from incapacitating the SMI and (a5) loading the operating system.

In order to make the above and other objects, features and advantages of the present invention more comprehensible, a preferred embodiment will be described in detail as follows in conjunction with the accompanying drawings.

Fig. 1 provides the computer system hardware circuit structural representation of the present invention;

Fig. 2 is a schematic diagram of the hardware setting of the method for protecting the BIOS of the present invention from being destroyed by viruses;

Fig. 3 provides the software setting flowchart of the method that the present invention protects BIOS from being destroyed by virus; And

Fig. 4 shows the implementation flowchart of the method for protecting BIOS from being damaged by viruses in the present invention.

The computer virus described in the present invention is a section of executable program code. Taking it as an example to infect the operating system when starting up, it will have the action of writing to the flash memory that stores the BIOS program code, causing the BIOS to be blocked. Modified and unable to boot. If the intrusion of the virus cannot be detected in time, that is, there is no poisoning warning function to notify the user to deal with it as soon as possible, the virus will continue to destroy other devices such as disks or memories, and cause the data stored in these storage units to be modified or deleted, causing serious damage. loss.

Therefore the method described in the present invention mainly is to protect the flash memory that has BIOS not to be encroached on by virus, promptly when there is write-in generation by BIOS flash memory, judge whether this write-in action is abnormal write-in, if judged The result is a virus, and the computer issues a poisoning warning, followed by preventive measures to prevent the computer system from being infected. The specific implementation process is described below.

Before that, please refer to the computer hardware circuit diagram shown in Figure 1 to understand the general structure of the computer system. Generally present widely used computer system, its CPU10 is connected with North Bridge NB (north bridge) 30 by CPU bus 20, and North Bridge 30 is connected with memory (can be memory such as SDRAM, EDORAM) 40, also through AGP bus 50 links to each other with AGP VGA card 60. In addition, the north bridge 30 is connected to the south bridge 80 via the PCI bus 70 for transferring data and information. And south bridge 80 is connected with hard disk (HDD) 90, optical disc drive (CD ROM or DVD ROM) 100, USB (Universal Serial Bus, universal serial bus) 110, input device (such as mouse, keyboard etc.) 120, uses In addition to accessing or inputting data, it also passes through the XD bus 130 and the ISA bus 140 to connect with the BIOS 150 and the audio device (Audio, such as a sound card) 160 respectively. Wherein the north bridge 30 and the south bridge 80 are both control chipsets (chipsets) on the motherboard, the north bridge chip 30 near the CPU 10 is also called the system host chip, and the south bridge chip near the bus is a peripheral device chip responsible for peripheral devices.

Firstly, it is discussed how the computer system knows that the BIOS flash memory is written. The method of the present invention is to use the characteristic that the necessary signal can generate SMI when the flash memory is written, so as to know that the BIOS flash memory has a writing action. This starts with two parts: hardware settings and BIOS settings. Please refer to FIG. 2 , which shows a schematic diagram of an SMI event source input pin (event source input pin) connecting the BIOS flash memory and the chipset in the hardware setting of the present invention. In this preferred embodiment, the BIOS flash memory 16 is connected to the system chipset 12 through the adapter unit 14 , such as the above-mentioned south bridge chip 30 , and the chipset 12 is connected to the CPU 10 . Wherein, switching unit 14 can utilize logic circuit (logic circuit) or utilize SIO (super I/O, input/output controller) to realize, mainly because the SMI source (cause) that chipset 12 needs to receive is quite a lot, and chip The SMI event source input pins of the group 12 are limited, so it is better to integrate and control the switching unit 14 so that the chipset 12 can know the SMI source from the BIOS flash memory. However, if the chipset 12 has vacant pins, the adapter unit 14 can also be omitted, and the BIOS flash memory 16 can be directly connected to the chipset 12 . This hardware setting method is completed when the motherboard is wired (layout), and the circuit design is used to make the BIOS flash memory 16 send necessary signals, such as the output of WE# (write enable signal), through the transfer of logic circuits or SIO The unit 14 or directly transmits to the chipset 12, so that the chipset 12 knows the source of the SMI and sends SMI# to the CPU 10.

After the hardware setting is completed, the BIOS setting needs to be combined next. Please refer to FIG. 3 , which shows the process of starting the BIOS after modifying the BIOS program code. In general computer systems, the function of the BIOS flash memory to generate the SMI signal is not enabled. That is to say, even if the above-mentioned hardware settings are completed, the system still needs to modify the BIOS program code, so that the system can know that the source of the corresponding SMI# is generated by writing into the BIOS flash memory 16 . First, as in step 101, when the computer is turned on, it will begin to start the "booting program". Various tests are performed to confirm that the computer functions are correct, and to initialize registers in certain hardware devices, and most POST executions also include loading BIOS program code (code) into the memory. After the POST starts, as in step 102, the function of sending the SMI signal from the BIOS flash memory needs to be enabled, so the procedure of initializing the SMI processing program is performed. Next, as in step 103 , the BIOS executes related settings on the chipset 12 to match the input signal from the BIOS flash memory or logic circuit or SIO. And, as the preventive measure of step 104, the I/O trap SMI function is set to prevent the virus from disabling the SMI function. Finally, as in step 105, after the POST is executed, the computer is loaded with an operating system such as Microsoft's MS-DOS or Windows.

After the relevant hardware and software settings are completed, the method for dealing with virus intrusion of the present invention will be described with the flow steps shown in FIG. 4 . As in step 201, when the CPU 10 receives an SMI#, it will go to the SMI processing program of the BIOS to check the source of the SMI (step 202). As in step 203, when it is determined that the writing of the BIOS flash memory causes this SMI#, and the action of writing is not caused by the BIOS or the BIOS update tool program, that is to say, the writing is abnormally modified BIOS by a virus (step 204) , then the system will send an alarm signal (step 205), such as sending a beeping sound or a sound with a special syllable, to remind the user that the virus is just trying to destroy the BIOS. And as in step 207, the system will take related measures to prohibit virus writing. In addition, in step 203, it is determined that the source of SMI# is not caused by the writing of BIOS flash memory, the system will continue to perform other SMI processing program contents (step 208), and finally get back to OS or AP (applicationprogram, application) (step 209). And in step 204, if it is determined that the writing of the BIOS flash memory is the reason of BIOS or BIOS update program or other non-normal writing, then also return to step 209 of OS or AP. As for step 207, different methods of prohibiting writing are used, and different processing methods are used. Please refer to the following description for details.

First explain how to judge in step 204 that BIOS flash memory is written and produces the method that SMI# is caused by virus program, proposes three kinds of preferred embodiments as follows:

(1) Before the BIOS or BIOS update program is written into the BIOS flash memory, first write a specific value in a specific location in the memory, which is to set the flash write flag (flag), and then write it clear. Therefore, when the SMI processing program of the BIOS judges whether the cause of the SMI is that the BIOS flash memory is written, check whether the above-mentioned flash write flag exists. If so, it is caused by the BIOS or the BIOS update program; if the flash mark does not exist, it is determined that the virus program has damaged the BIOS flash memory.

(2) When BIOS or BIOS update program is written into the BIOS flash memory, the BIOS service program is called to complete, and the BIOS service program must be placed in the address of memory 000E0000h to 000FFFFF ROM. When SMI occurs and the CPU enters SMM (system management mode), it will store the address of the program being executed before the interrupt in registers such as CS (code segment, program code segment) or EIP (expanded instruction pointer, expanded instruction pointer) SMRAM. Therefore, when the BIOS flash memory is written and an SMI is generated, the SMI handler checks whether the address of the program being executed before the interruption is in the address of the memory 000E0000h to 000FFFFF. If so, it is caused by BIOS or a BIOS update program; if not, it is determined to be caused by a virus.

(3) Before the BIOS or the BIOS update program is written into the BIOS flash memory, the switch that the BIOS flash memory is written into and generates SMI# is turned off, and then reopened after writing. In this way, no SMI# will be generated during the write process. Because the virus program does not know or cannot close the switch of the above-mentioned SMI#, so when the SMI processing program finds that the SMI is generated because the BIOS flash memory is written, it is determined to be the virus program.

As for the method for prohibiting virus writing in step 207, that is, the method for the SMI handler to deal with the virus destroying the BIOS flash memory, two preferred embodiments are proposed as follows:

(1) Use the system speaker (speaker) to continuously emit special sounds to warn the user. CPU just constantly carries out this sound program, no longer leaves SMI processing program in order to avoid that CPU returns to virus program and destroys BIOS flash memory, or prevents it from further destroying other devices such as hard disks. Since the system is in a down state at this time, the user can inquire the user manual or inquire the computer company according to the voice, and can know that the computer has been poisoned.

(2) Using the SMI processing program to write a specific value in a specific location in the memory is to set the poisoning flag. Because the BIOS flash memory data must be written into a series of command codes to its specific address before the data is written, the SMI processing program can destroy the write command code of the virus in the CPU register value of the SMRAM, making the write command invalid. BIOS flash memory cannot be corrupted. Therefore, this method will carry out above-mentioned step 208 at last and return to OS, and at this moment, corresponding writing program is carried out under OS again, regularly checks the poisoning flag in memory, or finds that poisoning flag is set up, then immediately displays information on the screen to warn user.

Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make appropriate changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined in the claims.

Claims (7)

1. protect BIOS to avoid by the method for virus damage for one kind, it forms with the SMI Event origin input pin of a chipset by a flash memory that has BIOS and is communicated with, and realizes preventing that virus from writing this flash memory that its step comprises at least:

Carrying out relevant BIOS sets with coupling and can write signal WE# from of this flash memory;

Computer CPU receives a SMI signal that is sent by this chipset;

Check that to the SMI handling procedure of BIOS SMI originates;

Judge this SMI source, if judge that this flash memory is write by virus, then forbid writing of this virus, otherwise handle by normal mode;

Wherein the step of the relevant BIOS setting of this execution further comprises:

POST when carrying out the BIOS startup;

This SMI handling procedure of initialization;

This chipset is carried out related setting, this chipset when this flash memory is written into

Can produce a smi signal;

Set I/O trap SMI function and close SMI to prevent virus; And

Be written into operating system;

2. protection BIOS as claimed in claim 1 avoids by the method for virus damage, judges that wherein this flash memory also comprises for the step that virus writes:

Set one when authoring program writes this flash memory, write a flash earlier and write and be marked on a storer; And

The SMI handling procedure checks that this mark does not exist to this storer, assert the Virus behavior that is written as, if this mark exists, assert that then writing not is the Virus behavior.

3. protection BIOS as claimed in claim 1 avoids by the method for virus damage, judges that wherein this flash memory also comprises for the step that virus writes:

Set one when authoring program writes this flash memory, will call out the BIOS service routine; And the program address that just is being performed before the SMI handling procedure inspection interruption is not in the address of storer 000E0000h to 000FFFFF, assert the Virus behavior that is written as, program address as execution is in the address of storer 000E0000h to 000FFFFF, assert that writing not is the Virus behavior.

4. protection BIOS as claimed in claim 1 avoids by the method for virus damage, judge that wherein this flash memory also comprises for the step that virus writes, set one when authoring program writes this BIOS flash memory, to close the generation smi signal, so the SMI handling procedure is checked when the SMI source is caused by this flash memory is written into, is assert the Virus behavior that is written as; Otherwise,, think that then writing not is the Virus behavior if smi signal is pent when requiring to write.

5. avoid by the method for virus damage as each described protection BIOS in the claim 2 to 4, wherein should comprise in BIOS or the BIOS refresh routine any one through authoring program.

6. protection BIOS as claimed in claim 1 avoids by the method for virus damage, forbids that wherein the step that writes of this virus also comprises:

Send alert news sound; And

Make execution not leave the SMI handling procedure.

7. protection BIOS as claimed in claim 1 avoids by the method for virus damage, forbids that wherein the step that writes of this virus also comprises:

The SMI handling procedure writes a poisoning mark in a storer;

SMI handling procedure break virus writes a command sequence of an address, and this write command was lost efficacy;

Get back to operating system; And

Check that this storer has this poisoning mark, show a warning message, there is no the poisoning mark, then do not show this warning message as inspection.

Images